AEO audit for a managed security services provider

The company

Technology buyers use assistants but check them. In a TrustRadius survey of 1,862 technology buyers, 63% used AI during their purchase, and 94% of those fact-check its answers at least some of the time (July 2026; the publisher runs a review platform). No primary survey was found on how mid-market companies choose an MSSP.

The questions buyers ask assistants

The panel follows AEO HQ's measurement design: 40 buyer intents, each written three ways (120 unbranded prompts), plus 20 branded prompts. Prompts that ask for a provider name the region the company serves. Each prompt runs three times a week on each of the four assistants the audit measures (ChatGPT, Perplexity, Gemini, and Google AI Overviews), in a new chat with a clean session; the ten most important prompts run eight times a week. Results are reported as rates with error ranges, because ChatGPT and Google's AI returned the same list of brands less than once in 100 repeated runs (vendor study; 2,961 runs). The table shows 13 of the 140 prompts.

How the assistants reach the company

An assistant can cite a page through search only after its search system has crawled and indexed it. The diagrams show the documented routes; how AI assistants find and cite sources has the details. For a security company, the firewall matters as much as robots.txt:

• Google lists making sure crawling is allowed "in robots.txt, and by any CDN or hosting infrastructure" among the SEO fundamentals that still matter for its AI features, and Microsoft says Bing and Copilot "rely on the same core crawling, indexing, and ranking foundation as traditional search".
• OpenAI says that, to be eligible, a site's host or CDN must allow traffic from its published searchbot IP addresses. Perplexity recommends allowing PerplexityBot in robots.txt "and permitting requests from our published IP ranges," and gives firewall rules that match both user agent and IP. Anthropic publishes a list of the IP addresses its crawlers use.

Third-party sources carry weight. In 680 million citations studied by a visibility-tracking vendor, Gartner was among the ten most-cited domains on Google AI Overviews and Perplexity, and G2 on ChatGPT and Perplexity. In an SEO agency's study of about 1,000 decision-stage prompts, Reddit appeared in about 62% of responses. Clutch launched an app inside ChatGPT in April 2026. Google's results are a weak guide to AI answers for local services: for IT support, the domains cited by Google and by a web-enabled AI engine overlapped by 0.1% (preprint). The first two studies come from companies that sell related services.

What the audit checks

Access, pages, and trust signals

• Crawler rules. robots.txt is read per crawler, since a crawler follows the group that names it and uses the * group only when none does. Search crawlers are checked apart from training crawlers, and Anthropic tells site owners to repeat opt-out rules "for every subdomain".
• Firewall and CDN. Bot-management rules are exported and tested against each crawler's user agent and published IP list.
• Facts in HTML. In Vercel's December 2024 data, none of the major AI crawlers rendered JavaScript, and Microsoft advises against relying on PDFs for core information. SOC staffing, supported tools, and service levels belong in page text, not in gated guides.
• City pages. Google's spam policies name pages "targeted at specific regions or cities that funnel users to one page" as doorway abuse. For its Business Profile, a service-area business should hide its address if it does not serve customers there, with a service area generally no more than about two hours' drive.
• Trust signals. Google's rater guidelines include "safety online" within "YMYL Health or Safety", so threat advisories and guides should carry a named, credentialed author and a date.
• Profiles. Gartner Peer Insights, G2, Clutch, and endpoint vendors' partner directories are compared with one fact sheet.

Security and compliance claims

Measurement setup

GA4 has a default AI Assistant channel, but links from Claude's app carry no referrer. The audit checks that the contact form asks "How did you hear about us?" with AI assistants as options and stores the answer in the CRM, and that the web logs the company already collects can be filtered by crawler user agent.

Sample findings

These are sample findings for the hypothetical company, showing the form a finding takes. They describe no real company, and nothing in them was measured.

The deliverable

The report has nine parts, followed by a readout call.

1. Summary. Scope, dates, assistants tested, and the ten fixes to make first.
2. Method. The full panel, session controls, run counts, matching rules, and statistics.
3. Baseline measurement. For each assistant: mention rate, citation rate, share of voice against named competitors, and accuracy on branded prompts, each with a 95% interval, plus the cited domains sorted into the company's pages, review sites, forums, and publishers. No pooled score and no rank.
4. Access report. A table by crawler of robots.txt status, firewall and CDN outcome, and index coverage, with the rule changes to make through the company's own change control.
5. Claims register. Each claim, where it appears, the rule, the evidence on file, and suggested wording for counsel's review. AEO HQ flags; it gives no legal or compliance advice.
6. Third-party profiles. Fact mismatches across Gartner Peer Insights, G2, Clutch, and partner directories.
7. Content gaps. Each intent mapped to a page or marked as a gap.
8. Priority fix list and measurement plan. Every finding with impact, effort, owner, and evidence, and the plan below.
9. Run log. Every answer and citation from the baseline, as a spreadsheet.

Measurement plan

The plan follows how to measure AI visibility: rates use Wilson intervals, which suit small samples, and a change counts only when the interval for the difference excludes zero.

Engagement timeline

The pricing page gives the audit's current delivery time; this example assumes about two weeks from completed intake.

What this example does not show

• Results. No rates, citations, traffic, or pipeline figures, because the company does not exist. No study has measured how long changes like these take to show up in AI answers.
• Real prompts. A real panel comes from sales calls, security questionnaires, and Search Console queries.
• Legal conclusions. The claims table summarizes rules and cases; counsel decides. The CMMC program was under review on 27 September 2026 and may change.
• Evidence specific to MSSPs. The buyer survey covers technology purchases in general, and the citation studies come from companies that sell related services.
• Every assistant. Runs cover four assistants. Copilot and Google AI Mode appear only through Microsoft's and Google's reports, and Claude only through logs and referrals.

Next step

The audit's current scope, price, and delivery time are on the pricing page. The cybersecurity industry page covers AEO for security companies more broadly, and the methodology page gives the full measurement design.