Cybersecurity Services: AI Market Discovery Index

Benchmark Summary

CrowdStrike Falcon leads the September 2026 benchmark with 50.7% valid recommendation coverage, ahead of Sophos Intercept X at 32.5%: a gap of 18.2 percentage points. CrowdStrike Falcon also led the July 2026 baseline, when it measured 53.7% coverage. Across the full baseline-to-current series, no brand registered a significant rise or decline in valid recommendation coverage; all 16 tracked brands are classified as stable.

Month-over-month, several brands showed sharp swings between August 2026 and September 2026. That pattern reflects a change in how tracked brands were identified and named that month, not organic movement in recommendation behavior. Parent-brand names used in August 2026 (CrowdStrike, Palo Alto Networks, Rapid7, Secureworks, Sophos, Mandiant (Google)) were not tracked in September 2026, while the product-line names tracked in July 2026 and September 2026 (CrowdStrike Falcon, Palo Alto Cortex XDR, Rapid7 InsightIDR, Secureworks Taegis, Sophos Intercept X, Arctic Wolf, Google Chronicle, Deepwatch) registered 0.0% in August 2026 because they were not part of that month's tracking list. Read against the July 2026 baseline rather than the August 2026 reading, all of these brands sit within normal month-to-month variation.

The benchmark began with 764 prompt-surface observations in September 2026 and produced 416 qualified observations after qualification.

Current Benchmark at a Glance

Qualified surface breadth counts the number of canonical AI surface families with at least one qualified observation. The six canonical families are ChatGPT, Copilot, Gemini, Perplexity, AI Overviews, and AI Mode. In August 2026 the surface breadth also measured six; the tracked brands that month were identified under parent-brand names before reverting to product-line names in September 2026.

For the strategic interpretation of this benchmark, read CiteWorks Studio's analysis of How AI Search Is Recommending Cybersecurity Services

Research Scope and Qualification

The public benchmark is narrower than the raw collection universe by design. In July 2026 the benchmark began with 750 source prompt-surface observations, of which 404 qualified for the public benchmark. In September 2026 the benchmark began with 764 source prompt-surface observations, of which 416 qualified. The table below details each stage.

Brand-level percentages use the qualified observations as the public denominator, not the raw collection. Link: AI Market Discovery Methodology.

Current Brand Standings

This table is the primary current-month benchmark view. Standings are sorted by valid recommendation coverage.

How to Read the Standings

• Presence rate: the share of qualified observations in which the brand is mentioned.
• Valid recommendation coverage: the share of qualified observations in which the brand receives a valid recommendation.
• Top-three rate: the share of qualified observations in which the brand appears in the top three recommended positions.
• Rank-one rate: the share of qualified observations in which the brand is the first recommended.
• Net sentiment: the balance of positive over negative mentions among observations where sentiment is detected.

For formulas and denominator rules, see AI Market Discovery Metric Definitions.

Recommendation Coverage Movement

The table below shows movement from the July 2026 baseline to September 2026. Tracked brand naming shifted between months, so several brands enter, exit, and re-enter the series.

Every brand's baseline-to-current movement falls within normal month-to-month variation; none is classified as a significant riser or decliner. Versus the immediate prior month, the August 2026 readings for CrowdStrike Falcon, Palo Alto Cortex XDR, Rapid7 InsightIDR, Secureworks Taegis, Sophos Intercept X, Arctic Wolf, Google Chronicle, and Deepwatch were all 0.0% because those product-line names were not part of the August 2026 tracking list; the parent-brand names that tracked that month (CrowdStrike, Palo Alto Networks, Rapid7, Secureworks, Sophos, Mandiant (Google)) were not tracked in September 2026. This naming shift, rather than organic change in recommendation behavior, drives the large month-over-month swings.

Category Leader: CrowdStrike Falcon

CrowdStrike Falcon leads the September 2026 benchmark with 50.7% valid recommendation coverage, the same leader as the July 2026 baseline, when the brand measured 53.7%. The brand appears in 88.0% of qualified observations in September 2026. Its top-three rate came in at 45.9% and its rank-one rate at 30.0%. Coverage sits slightly below the July 2026 reading but within normal month-to-month variation, and the brand's presence rate of 88.0% in September 2026 is down 4.6 points from 92.6% in July 2026.

Recommendation Placement Snapshot

Coverage alone does not show how prominently a brand is recommended. For the leading brands, the top-three and rank-one rates show placement strength within those recommendations.

Close coverage can still hide different first-position rates. CrowdStrike Falcon pairs the highest coverage with the highest rank-one rate at 30.0% in September 2026, while Sophos Intercept X carries a 32.5% coverage rate but reaches the first position only 1.7% of the time. Palo Alto Cortex XDR, at 25.7% coverage, places first in 2.2% of observations.

Buyer-Intent Distribution

The qualified observations in September 2026 fell into the Brand Recommendation class. The current public series measures this class of discovery.

All qualified observations sit in the Brand Recommendation class, so the current public series measures that class of discovery and does not yet contain qualified observations in the Pricing & Value or Multi-Brand Comparison classes. Pricing, value, and head-to-head comparison have no public signal in this data.

Historical Measurement Record

This is an evergreen benchmark URL. New measurements are added to the same report.

Evidence and Source Layer

The benchmark is built from prompt-level observations that retain the query, AI/search surface, answer, brand outcome, recommendation placement, sentiment, and, where exposed, citations or attributable evidence sources. Source presence is evidence about the information environment. It is not automatically proof that the source caused the recommendation.

Scope Boundaries

This public benchmark does not measure market share, attributable sales, every possible AI response, organic-search ranking, social mention volume, private or sponsored channels, or causality from a metric movement alone. Movement between months reflects changes in recommendation patterns across the tracked AI surfaces; the benchmark records the change and does not, by itself, establish why the change occurred.

About This Benchmark

The LLM Authority Index AI Market Discovery Index is a neutral industry benchmark that measures how brands appear in AI-generated responses across six canonical AI search and assistant surfaces. The benchmark tracks presence, recommendation coverage, placement, and sentiment for each brand on a monthly basis.

• AI Market Discovery Methodology
• AI Market Discovery Metric Definitions
• AI Market Discovery Research Standards
• Modeled AI Authority Value

Get a Company-Level Authority Index

The public industry benchmark shows category-level standings. A company-level Authority Index can go deeper, examining a specific brand's AI presence across surfaces, queries, and placement patterns in more detail.

Get my free AI Company Index