Summary
We set three independent layers of data side by side for the cybersecurity market: what companies earn and spend (financial filings), how visible they are in search, and how often six AI assistants cite them. The question is simple: does market leadership carry over into AI answers?
It doesn’t, not automatically. The largest vendor by revenue gets a third of the share of citations its revenue would suggest, while a mid-sized company collects a third of all the public vendors’ citations. Marketing budgets turn into citations with a 23-fold difference in efficiency. What predicts citation most strongly is neither revenue nor budget but the search footprint: how many keywords a company ranks for, how many of them in the top three, and how much organic traffic that brings.
- ×23
- spread in marketing budget per citation
- 0.89
- correlation of citations with search keywords (revenue: 0.69)
- 62%
- of citations go to the top ten of 68 vendors
- 38%
- of niche citations go to four consumer antivirus brands
Key findings
Share of answers doesn't mirror market share
Palo Alto Networks accounts for 24.0% of the revenue of the 17 public vendors but only 8.1% of their citations in AI answers. Cloudflare is the opposite: 4.5% of revenue and 34.0% of citations.
Marketing budget turns into visibility with a 23-fold difference
Cloudflare spends $55k of annual sales and marketing budget per citation; Zscaler spends $1.26m. The median across 17 companies is $531k.
Search footprint decides
Citation correlates most strongly with search footprint: keywords ranking in the top three (0.90), all ranking keywords (0.89) and organic traffic (0.88). Revenue, budget and links add no significant contribution beyond them.
Small companies beat large ones on return
Per thousand search visits, UpGuard gets 25.9 citations, while Okta and HackerOne get 0.8 each. That’s a 32-fold gap; the median is 5.5.
Most vendors are barely cited at all
The top ten collect 62% of citations, while 32 of the 68 vendors get less than 0.5% each. In ChatGPT, Cloudflare alone accounts for 39.7% of all links in the niche.
- 68
- vendors in 6 segments, 17 of them public
- $47.8bn
- revenue of the public vendors, last fiscal year
- $16.7bn
- their sales and marketing spend for the year
- 24.5m
- search visits a month across the 68 vendors
How citations are distributed
Citations are spread very unevenly: Cloudflare takes one in every five links in the niche, while most of the 68 vendors stay below one per cent. The chart shows the top 15 companies among 82,814 links collected from six assistants.
Share of AI assistant citations
ChatGPT, Perplexity, Gemini, Copilot, Google AI Overviews, Google AI Mode · September 2026
- Network and access
- Website and application protection
- Endpoints and MDR
- Vulnerabilities and cloud
- Data, email and monitoring
- Access management
Source: Ahrefs
Share of the top five vendors in each assistant
Cloudflare is first in all six assistants
Source: Ahrefs
How concentrated the answers are depends on the assistant. It’s strongest in ChatGPT: the top five vendors take 64% of links, 39.7% of them going to Cloudflare alone. The other 63 vendors share the remaining 36%.
In Gemini and Perplexity the distribution is more even: the top five take 38.2% and 41.9% respectively, the circle of sources is wider, and second-tier vendors get into the answers more often.
What predicts citation
The rank correlation between the number of citations and each signal: 1 means the order of vendors matches completely, 0 means there is no relationship. An asterisk marks measures available only for the 17 public companies.
Link between each signal and citation in AI answers
Spearman coefficient, 68 vendors (marked with *: 17)
Sources: Ahrefs, SEC EDGAR, Wikimedia
What adds anything beyond the search footprint
Large companies are strong at everything at once, so a high correlation doesn’t prove that a signal has an effect of its own. To separate the effects, we removed the share of citation explained by the number of keywords and tested the remainder against the other signals.
Link between each signal and citation beyond the search footprint
Correlation with the residual; only paid search spend is statistically significant (p below 0.01)
- Statistically significant
- Not significant
Sources: Ahrefs, SEC EDGAR, Wikimedia
Visibility in AI answers is determined by search: links, recognition in reference sources and the size of the budget affect it only through pages that rank well.
The only signal that stays significant beyond the search footprint is paid search spend. Even that link probably reflects a company’s overall activity: those who invest in paid search are usually visible in organic search too.
Market share and answer share diverge
For the 17 public vendors we compare two shares: of total revenue ($47.8bn in the last fiscal year) and of citations in AI assistants’ answers. The last column shows the difference in percentage points.
| Company | Revenue, $bn | Sales & marketing, $bn | Search visits, k/month | AI citations | Revenue share | Answer share | Difference, pp |
|---|---|---|---|---|---|---|---|
| Cloudflare | 2.17 | 0.92 | 8,162 | 16,733 | 4.5% | 34.0% | +29.5 |
| Fortinet | 6.80 | 2.35 | 3,647 | 9,581 | 14.2% | 19.5% | +5.2 |
| SentinelOne | 1.00 | 0.53 | 371 | 3,270 | 2.1% | 6.6% | +4.6 |
| Radware | 0.30 | 0.13 | 61 | 622 | 0.6% | 1.3% | +0.6 |
| Tenable | 1.00 | 0.42 | 97 | 976 | 2.1% | 2.0% | −0.1 |
| Varonis | 0.62 | 0.30 | 94 | 568 | 1.3% | 1.2% | −0.2 |
| Rapid7 | 0.86 | 0.32 | 94 | 789 | 1.8% | 1.6% | −0.2 |
| Netskope | 0.71 | 0.39 | 61 | 572 | 1.5% | 1.2% | −0.3 |
| Check Point | 2.73 | 0.95 | 620 | 2,561 | 5.7% | 5.2% | −0.5 |
| Qualys | 0.67 | 0.14 | 37 | 230 | 1.4% | 0.5% | −0.9 |
| SailPoint | 1.07 | 0.57 | 90 | 524 | 2.2% | 1.1% | −1.2 |
| Akamai | 4.21 | 0.57 | 481 | 3,244 | 8.8% | 6.6% | −2.2 |
| Okta | 2.92 | 1.02 | 1,332 | 1,118 | 6.1% | 2.3% | −3.8 |
| Zscaler | 3.35 | 1.50 | 265 | 1,190 | 7.0% | 2.4% | −4.6 |
| CrowdStrike | 4.81 | 1.83 | 495 | 2,525 | 10.1% | 5.1% | −4.9 |
| F5 | 3.09 | 0.86 | 275 | 707 | 6.5% | 1.4% | −5.0 |
| Palo Alto Networks | 11.48 | 3.93 | 1,128 | 3,982 | 24.0% | 8.1% | −15.9 |
Sorted by the difference between answer share and revenue share; shares are calculated within the 17 companies, visits are monthly. Sources: SEC EDGAR (10-K, 20-F), last full fiscal year; Ahrefs, all countries, September 2026.
Four companies have a higher share of AI answers than of revenue. The biggest gaps are Cloudflare (+29.5 pp), Fortinet (+5.2) and SentinelOne (+4.6). The largest player, on the other hand, under-collects: Palo Alto Networks has 24.0% of the sample’s revenue and only 8.1% of citations.
Market share doesn’t carry over into AI answers automatically: leadership built on sales and partners shows up there only when the company is visible in search.
How much budget goes into one citation
Annual sales and marketing spend divided by the number of citations in AI answers. The measure reflects marketing efficiency: the lower it is, the more links a company gets for the same budget.
- $55k
- Cloudflare, the minimum
- $531k
- median across 17 companies
- $1.26m
- Zscaler, the maximum
Sales and marketing budget per citation
Thousands of US dollars · last fiscal year · 17 public vendors
- Under $200k
- $200k to $1m
- Over $1m
Sources: SEC EDGAR, Ahrefs
A citation is cheapest at Cloudflare, SentinelOne and Akamai (under $200k), while at Zscaler, F5 and SailPoint it costs more than $1m.
For comparison: organic search gives these 17 companies as much traffic as $251m of paid advertising a year, just 1.5% of their sales and marketing budget ($16.7bn). Yet it influences visibility in AI answers more than any other channel.
Place in answers vs place in search
Each vendor has two places: by search traffic and by the number of citations in AI answers. The chart shows the difference for the largest gaps among the 68 companies; a positive value means the vendor ranks higher in answers than in search.
Difference in places: search vs AI answers
The eight largest gaps in each direction · note: place in search → place in answers
Source: Ahrefs
Citations per 1,000 search visits
The six best and six worst of the 65 vendors with at least 10,000 visits a month · median 5.5
- Above the median
- Below the median
Source: Ahrefs
Smaller companies pull ahead. Twingate rises from 56th place in search to 30th in answers, Netwrix from 44th to 21st.
HackerOne shows the opposite picture: 14th by traffic and only 50th by citations, while Okta is 3rd by traffic and only 16th in answers. Traffic to pages that AI doesn’t cite gives you nothing in answers.
Answer share moves faster than the market
Share of voice measures how often a brand is mentioned among answers that name at least one of the tracked brands, weighted by how often the question is asked. Shares add up to more than 100% because one answer can name several brands. We tracked it month by month for questions containing security terms (security, firewall, ransomware, zero trust and others) in ChatGPT, Google AI Overviews and Google AI Mode.
| Brand | September 2025 | September 2026 | Change, pp |
|---|---|---|---|
| Palo Alto Networks | 25.8% | 34.1% | +8.3 |
| Fortinet | 40.1% | 33.4% | −6.7 |
| SentinelOne | 27.1% | 12.6% | −14.5 |
Monthly average. CrowdStrike ended the period at 32.2%. Source: Ahrefs Brand Radar, Ahrefs query base.
The biggest drop over the year was SentinelOne’s, from 27.1% to 12.6%. Over the same period Palo Alto Networks grew from 25.8% to 34.1%, while Fortinet fell from 40.1% to 33.4%.
A spike in February coincided with a sharp increase in the number of queries in the Ahrefs database: Palo Alto Networks briefly rose to 80% and Check Point to 77%. That is most likely a rebuild of the database rather than a change in the market, which is why comparisons are more reliable on a fixed set of questions than on the database’s absolute numbers.
What this means for leadership
Measurement
Answer share isn't tied to market share
Lever
The main lever is the search footprint
Return
Return on traffic matters more than its volume
If you want to see where your own company stands on these measures, the same three layers (filings or budget, search, AI answers) can be measured for any category. That’s the first step of our AI Search Strategy Programme.
Method and limitations
Sample. 72 vendors in six segments: the organic competitors of three reference domains in US search, and all public companies whose core business is security. The core slice is 68 vendors, without four consumer antivirus brands (Kaspersky, ESET, Bitdefender, Malwarebytes). Microsoft, Cisco, IBM and Google aren’t included: security is only part of their business, and their domain metrics aren’t comparable with the rest.
Money. SEC EDGAR, XBRL data: revenue from contracts with customers and sales and marketing expenses for the last full fiscal year. Fiscal years closed between September 2025 and July 2026. 17 companies.
Search. Ahrefs, all countries, September 2026: organic traffic, keywords, referring domains, domain rating, and traffic value at paid-search prices.
AI answers. Ahrefs: the number of links to each domain in the answers of ChatGPT, Perplexity, Gemini, Copilot, Google AI Overviews and Google AI Mode, across the Ahrefs query base. AI Overviews collected through the keyword base are excluded: they make up 81% of the “all platforms” figure in Ahrefs, but they’re derived from the search results and would inflate the link with search.
Trend. Share of voice from the Ahrefs query base, questions containing security terms, monthly average.
Wikipedia. Views of the English-language article from September 2025 to August 2026. Article matching was checked by hand. Rapid7 is excluded because its name redirects to the Metasploit article; Sucuri has no article.
Statistics. Spearman rank correlation. “Beyond the search footprint” is the correlation with the residual of a linear regression of citation ranks on keyword ranks.
Limitations. A citation is a link, not a mention by name. The Ahrefs query base isn’t limited to purchase questions. Companies’ fiscal years don’t coincide. Budget per citation is a ratio, not a price. Selecting vendors through search shifts the sample towards companies that are visible in search.