SEO, AEO, and GEO for cybersecurity and IT services

SEO, answer engine optimization (AEO), and generative engine optimization (GEO) for cybersecurity and IT services are the work of making a security vendor's or IT service provider's facts easy for search engines and AI assistants to find, cite, and state correctly: what the product or service does, what it has been tested or audited against, how it handles vulnerabilities and incidents, and where it is offered. AEO and GEO rest on SEO, because assistants that search the web draw their sources from search indexes. For security companies, the research points to four additions: claims about performance, AI, and compliance that are worded exactly and backed by evidence, because regulators have acted on exactly these claims; public pages for the facts that government agencies tell buyers to check; accurate profiles on the review platforms, marketplaces, and communities that answers cite; and measurement per assistant and, for managed service providers, per city.

Many security vendors sell software, so most of SEO, AEO, and GEO for B2B SaaS companies applies to them, including its sections on pricing pages and comparison pages. This page covers what differs for security and IT services: the rules on security, AI, and compliance claims; the questions U.S. and allied cybersecurity agencies tell buyers to ask; and local search for managed service providers (MSPs).

This page is part of AEO HQ's guides by industry. It covers SEO, AEO, and GEO together, as one practice that AEO HQ calls SEO+. Google's guidance on outside services uses both names for the same work, referring to "AI experiences (sometimes called AEO for 'answer engine optimization' or GEO for 'generative engine optimization')" (opens in a new tab) (official documentation). AEO HQ's keyword data showed no AEO or GEO queries for cybersecurity, MSPs, or IT services, so this page is not built around a measured query. It is built from evidence on how technology buyers use AI, which sources AI answers cite, the guidance government agencies give to buyers, and the regulators' own documents. Facts link to their sources, evidence strength is labeled where it matters, and recommendations are marked as ours. Much of the evidence on AI citations comes from companies that sell marketing services or data, and the text says so each time. The summary of rules is not legal advice.

Scope and definitions

This page is for marketing, product marketing, and compliance staff at U.S. cybersecurity vendors, MSPs, managed security service providers (MSSPs), and IT services firms, and for the agencies that work for them. It covers unpaid visibility in search results and AI answers, and the pages, profiles, and reviews behind it. The rules and program terms covered are U.S. ones, as read on 27 September 2026: FTC law and policy on deceptive claims, substantiation, reviews, and endorsements; the FTC's guidance on HIPAA claims; the AICPA's terms for SOC logos; the Department of War's CMMC program; FedRAMP; CISA's Secure by Design pledge; and a False Claims Act settlement over cybersecurity representations. State laws and rules outside the United States are not covered.

• Answer engine. An AI system that answers a question in its own words and names or links its sources, such as ChatGPT, Gemini, Claude, Perplexity, Microsoft Copilot, and Google's AI Overviews and AI Mode.
• Retrieval. The step in which an assistant fetches pages from a search index while it writes an answer.
• Managed service provider (MSP). A joint advisory from cybersecurity agencies in five countries defines MSPs as "entities that deliver, operate, or manage ICT services and functions for their customers via a contractual arrangement, such as a service level agreement" (opens in a new tab), with offerings that may include cybersecurity services. On this page, an MSSP is an MSP whose main services are security services.
• SOC report. A report on a service organization issued by a licensed, independent CPA. The AICPA's SOC logo may be used by a service organization that has received a SOC 1, SOC 2, or SOC 3 report from a licensed CPA (opens in a new tab).
• CMMC. The Department of War's Cybersecurity Maturity Model Certification program, which assesses defense contractors' compliance with cybersecurity standards "at progressively advanced levels" (opens in a new tab).
• FedRAMP. The federal program behind the FedRAMP Marketplace, which it describes as "the federal government's catalog for cloud service offerings, independent assessment services, and advisors" (opens in a new tab).
• Vulnerability disclosure policy (VDP), CVE records, and SBOM. A VDP tells outside researchers how to report flaws, and CISA says it "should be a public webpage" (opens in a new tab); CVE records are public records of specific vulnerabilities, which CISA says serve "as a standardized way to communicate actions that customers should take to protect against vulnerabilities" (opens in a new tab); and a software bill of materials (SBOM) "lists third-party software components used by the product" (opens in a new tab).
• YMYL. Google's rater guidelines treat as "Your Money or Your Life" topics those that could harm "any form of safety such as physical safety or safety online" (opens in a new tab), which covers much security advice (our reading).

How security and IT buyers use AI assistants

No survey found for this page is specific to cybersecurity buyers or to the businesses that hire MSPs. The closest evidence comes from surveys of technology and software buyers, most of them published by review platforms or marketing-software companies. The table gives each finding with its sample.

Security review is where deals slow down. Buyers who reach a shortlist through AI still have to clear their own security review, and the survey above names it as the biggest delay after selection. Our reading: public, specific security documentation answers the questions that a security review asks, and it is also what an assistant can retrieve and cite.

Limits. All of these figures are self-reported, and each publisher sells products or services to software vendors or marketers (our assessment). None of the surveys separates security products from other software, and no study found for this page describes how small and midsize businesses find or choose an MSP. The direction of the evidence is consistent (moderate); how well it transfers to security buying is unknown.

How assistants find and choose security vendors and IT providers

An assistant can answer from what its model learned in training, its parametric knowledge, or it can search the web and write from the pages it retrieves. Four findings describe security and IT questions:

• Assistants that search rely on search indexes. Google says its generative AI features are "rooted in our core Search ranking and quality systems" (opens in a new tab), and Bing says "Bing and Copilot search experiences rely on the same core crawling, indexing, and ranking foundation as traditional search" (opens in a new tab). OpenAI says ChatGPT search "sometimes partners with other search providers," and it names Microsoft and Shopify (opens in a new tab) (all official documentation).
• For B2B technology, AI Overview citations track organic rankings closely. An SEO platform found that 71.0% of AI Overview citations for B2B technology queries also ranked organically, against 32.2% for finance (opens in a new tab) (September 2025; vendor data). For a security vendor, ranking well in Google remains a main route into Google's AI answers (our reading).
• For local IT support, AI answers and Google's results barely overlap. In a preprint comparing a web-enabled AI engine with Google on local-business queries, the share of cited domains the two had in common ranged from 0.1% for IT support to 20.6% for home cleaning (opens in a new tab) (mid-2025). For MSPs, ranking in Google's local results does not ensure that an assistant cites the same sources (our reading).
• Assistants lean on third-party sources. Across several verticals, languages, and phrasings, AI search showed "a systematic and overwhelming bias towards Earned media," meaning third-party sources, compared with Google's more balanced mix (opens in a new tab) (preprint; mid-2025; consumer and software categories, not security specifically).

Evidence on which sources AI answers cite for security and IT questions is thin, and all of it comes from companies with a commercial interest:

Answers also change from one run to the next. When the same prompt was repeated, ChatGPT and Google's AI returned the same list of brands less than once in 100 runs, and Claude only slightly more often (opens in a new tab) (2,961 runs, November–December 2025; industry study; a co-investigator works for a tracking vendor). How ChatGPT, Gemini, Claude, Perplexity, and Copilot find and cite sources describes each assistant's index and crawlers.

The questions buyers ask, and what security marketers ask

Questions CISA tells software buyers to ask

CISA's Secure by Demand guide (August 2024) (opens in a new tab) gives organizations that buy software a list of questions for manufacturers and a list of artifacts to collect. It notes that buyers' due diligence often focuses "on the enterprise security measures of the manufacturers, such as by ensuring the manufacturers meet various compliance standards," and that "customers also need to focus on how a manufacturer approaches product security" (opens in a new tab). Each item below is a fact a vendor can publish and a buyer or an assistant can check. The right-hand column is our recommendation.

Questions MSP customers are told to settle

A joint advisory from U.S., UK, Australian, Canadian, and New Zealand cybersecurity agencies tells MSP customers what their contracts should cover, and tells MSPs what to explain. The right-hand column is our recommendation.

Questions buyers put to assistants

The example wording below is illustrative. The evidence column shows why each kind of question matters.

What security and IT marketers ask about AEO

In AEO HQ's keyword data for the United States, pulled on 27 September 2026, no AEO or GEO query named cybersecurity, infosec, MSPs, managed service providers, or IT services. The pull was seeded with AEO and GEO terms, so demand worded differently may exist that it did not capture.

In AEO HQ's query research (Google and Bing suggestions, and forum thread titles, 27 September 2026), security and IT marketers' questions fell into the groups below. Four questions are FAQ headings on agency guides that appeared in the search results, one for cybersecurity companies (opens in a new tab) (December 2025) and one for MSPs (opens in a new tab) (January 2026), and are marked "FAQ heading." The seed "how to choose an msp" returned mostly unrelated Bing suggestions, a sign of little search demand for that wording.

Rules that limit security marketing claims

This section is not legal advice. It summarizes U.S. regulator documents and program terms read on 27 September 2026. Rules and program terms change, and CMMC and FedRAMP both changed in 2026. Before publishing, have counsel or compliance staff check every claim against the rules and contracts that apply to you.

Performance, AI, and privacy claims (FTC)

Compliance and certification claims

Representations to government customers

In March 2025 a defense contractor agreed to pay $4.6 million to settle False Claims Act allegations over cybersecurity requirements in its Army and Air Force contracts; it admitted that it had reported a score of 104 for its implementation of NIST SP 800-171 controls when a consultant later put the score at −142, and that it had used an email host that did not meet security requirements equivalent to the FedRAMP Moderate baseline (opens in a new tab). The case concerned formal representations, not marketing. Our recommendation: keep public claims about your security posture consistent with what you report to government customers, so the two never contradict each other.

Reviews, endorsements, and community participation

Chat assistants

If a chat assistant on your site serves people in the European Union, Article 50 of the EU AI Act applies from 2 August 2026, and AI systems that interact directly with people must be designed so that people are informed from the first interaction that they are dealing with an AI system, unless this is obvious (opens in a new tab). Our recommendation, wherever you sell: say that the assistant is AI, and answer questions about certifications, statuses, and incidents only from approved text.

Content that complies and still answers the question

Assistants favor specific, checkable facts. In lab trials, specifications, comparisons, evidence, confident wording, and consistent claims raised a source's odds of being cited first in at least four of six models, and a stated price and a recent date did so in all six (opens in a new tab) (peer-reviewed; laboratory setting; the authors work for a marketing software vendor). The FTC's substantiation policy asks for the same thing from a different direction: a claim needs evidence before it is published. Our observation: a claim with its test, date, and scope attached is both the compliant form and the checkable form.

Google's systems "give even more weight to content that aligns with strong E-E-A-T for topics that could significantly impact the health, financial stability, or safety of people" (opens in a new tab) (experience, expertise, authoritativeness, and trustworthiness). Much security advice fits that description (our reading). Our recommendation: publish security guidance under the name of a practitioner who does the work, show when it was written and reviewed, and add what your team has seen in real incidents rather than restating common knowledge.

Local search for MSPs and IT services firms

For an MSP that serves businesses in its own region, Google's local results and Business Profiles matter more than they do for a product vendor (our reading).

Location pages. An MSP marketing agency advises creating location pages to target each area an MSP covers, including cities where it has no office (opens in a new tab). Google's spam policies list "having multiple domain names or pages targeted at specific regions or cities that funnel users to one page" (opens in a new tab) as doorway abuse, and Google's guidance says that creating "separate content for every possible variation" (opens in a new tab) of how people search, primarily to manipulate rankings or AI responses, violates its scaled content abuse policy. Our recommendation: publish a page for an area only when you actually serve it, and fill it with facts specific to that area, such as the staff who cover it, on-site response times, and clients there who have agreed to be named.

AI answers for local IT support draw on different sources than Google. Given the 0.1% domain overlap for IT support (opens in a new tab) (above), an MSP cannot assume that its Google ranking carries into assistants' answers. Marketplace and directory profiles are one candidate route, since Clutch now runs an app inside ChatGPT (above); no study found for this page measures how often assistants cite MSP directories.

Profiles, entity facts, and crawling

An entity is a person or organization that search systems treat as one distinct thing. Our recommendation: keep your company name, product names, certifications and their dates, supported platforms, and service areas identical on your site, trust center, review profiles, marketplace listings, government listings such as the FedRAMP Marketplace, and partner directories. The reason is indirect: language models often merge information about different entities that share a name (opens in a new tab) (peer-reviewed), and in lab trials consistent rather than contradictory claims raised a source's odds of being cited first in at least four of six models (opens in a new tab) (peer-reviewed; laboratory setting). No study has tested this for security companies, so treat it as an inference. Organization structured data can help Google "disambiguate your organization in search results" (opens in a new tab), but it is not an AI citation lever: in a matched study of 1,885 pages that added structured data, AI Overview citations fell 4.6%, and changes for AI Mode (+2.4%) and ChatGPT (+2.2%) were statistically indistinguishable from zero (opens in a new tab) (vendor study).

Assistants can cite only pages their crawlers can reach. Sites that block OAI-SearchBot "will not be shown in ChatGPT search answers" (opens in a new tab); blocking Claude-SearchBot may reduce visibility in Claude's search results (opens in a new tab); PerplexityBot access is controlled by robots.txt (opens in a new tab); and Google's AI features can show only pages that are indexed and eligible to appear with a snippet (opens in a new tab) (all official documentation). In December 2024, none of the major AI crawlers rendered JavaScript (opens in a new tab) (network measurement), and Microsoft advises against hiding key answers in tabs or expandable menus, or leaving them only in PDFs or images (opens in a new tab). A trust center that loads by script, sits behind a login, or offers only a PDF shows assistants little or nothing (our reading). If your site sits behind bot protection or a web application firewall, check that its rules let the search crawlers through (our recommendation).

Which third-party sources carry weight

What the evidence does not show. No study found for this page measures which sources assistants cite for cybersecurity questions with a published method, or whether profiles on review platforms cause recommendations rather than accompany them. Established vendors tend to have both (our reading).

Our recommendations:

1. Complete the free profiles first: review platforms, marketplaces, and program listings, with the same facts as your site.
2. Ask every customer for reviews the same way, disclose any incentive, and never tie an incentive to a positive review.
3. Take part in communities under your own name and say where you work. Google says "seeking inauthentic 'mentions' across the web isn't as helpful as it might seem" (opens in a new tab). The evidence on brand mentions has its own guide.
4. Publish evidence others can cite: advisories, test results with their methods, and research with its data.

How to measure SEO and AEO for a security or IT services company

Measure AI visibility as a rate across repeated runs, per assistant, per product category, and, for MSPs, per city, and connect it to pipeline by asking new customers how they found you. A single answer shows little, because answers change from run to run (see above).

Change one thing at a time, and keep a group of pages you did not change. In the only controlled field study found, ChatGPT referrals to pages that were not changed grew 3.5 times over the same period (opens in a new tab) (preprint; one site), so a before-and-after comparison without a control would have credited that growth to the changes.

How to do SEO and AEO for a cybersecurity or IT services company

These steps are recommendations. Each draws on the evidence above.

1. Inventory every security, AI, and compliance claim on your site, profiles, listings, and sales material, and match each one to the evidence on file. Remove or reword any claim without evidence.
2. List the questions buyers ask: CISA's questions for software vendors, the joint advisory's contract points for MSPs, and the questions in your sales calls and security questionnaires.
3. Publish the facts buyers are told to check: the VDP, security advisories and CVE records, SBOM availability, security features and logging by plan, and the patch policy; for MSPs, the service scope, responsibilities, incident notification, and backup terms.
4. Word every status exactly: the SOC report and its period, the CMMC level and assessment type, the FedRAMP designation as the Marketplace shows it, and the date you signed CISA's pledge.
5. Make the pages crawlable and indexable: keep the trust center public and server-rendered, and check that your own bot protection lets the search crawlers through.
6. Make profiles, listings, and your site state the same facts.
7. For MSPs, follow Google's Business Profile rules and publish location pages only for areas you actually serve.
8. Ask every customer for reviews the same way, and have staff disclose where they work when they post in communities.
9. Measure with a fixed prompt panel and a form question, and change one thing at a time.

Checklist for cybersecurity and IT services

What the evidence shows and does not show

Antipatterns in security marketing

Each antipattern below is common in security and IT marketing and fails for a documented reason.

Frequently asked questions

What makes SEO for cybersecurity different from SEO for an MSP?

They differ mainly in who buys and where the search happens. A security product sold to organizations goes through the buyer's security review, which is the biggest delay after a vendor is chosen (opens in a new tab). An MSP that serves businesses in its own region competes in Google's local results, where Business Profile rules (opens in a new tab) apply, and AI answers for local IT support draw on different sources than Google's results (opens in a new tab). The rules on claims are the same for both.

Is SEO still necessary now that buyers use AI assistants?

Yes. Google says optimizing for its generative AI features "is optimizing for the search experience, and thus still SEO" (opens in a new tab), and Bing says its Copilot experiences rely on the same crawling, indexing, and ranking foundation as traditional search (opens in a new tab). Assistants that search can cite only what they can retrieve. AEO adds work on third-party sources, exact facts, and measurement; it does not replace SEO.

What is MSP AI search?

An MSP marketing agency defines it as making sure an MSP "appears in AI-powered search results and chatbot responses when potential customers ask questions about IT services" (opens in a new tab). It is the same practice as AEO, applied to IT service providers. The parts specific to MSPs are local: Business Profiles, service-area pages, marketplace profiles, and measurement by city.

Can we call ourselves "SOC 2 certified" or "HIPAA compliant"?

Check with counsel. The AICPA describes a SOC report "issued by a licensed, independent CPA" (opens in a new tab), not a certification, so the accurate statement names the report, the firm, and the period (our reading). The FTC tells companies not to make false or misleading claims that they are "HIPAA Compliant," "HIPAA Secure," or "HIPAA Certified" (opens in a new tab). Specific statements are also easier for buyers and assistants to check.

Do the FTC's rules apply when our customers are businesses?

The FTC's review rule and its guidance are written for consumer reviews and do not say how the rule applies to reviews by business customers (opens in a new tab) (our reading). The FTC's action against Evolv shows that it acts on security and AI claims made to organizations: Evolv's scanners are used in schools, sports stadiums, and hospitals, and its customers include school systems (opens in a new tab). Our recommendation: treat claims to business buyers as held to the same substantiation standard.

How much does SEO or AEO cost for a security company, and which agency should we hire?

We found no published survey of what security companies or MSPs pay for SEO or AEO. A software company that sells its own AEO product puts agency work at about $3,000 and up for a one-time audit or sprint, and about $9,000 to $15,000 or more a month for ongoing programs (opens in a new tab) (September 2026); the index of what AEO costs compares published prices. AEO HQ sells this work itself (see Answer engine optimization (AEO) services), so we have an interest, and we do not rank agencies. Google says third-party tools "can't guarantee performance," and lists AEO and GEO tools among the services to evaluate critically (opens in a new tab). How to choose an AEO or GEO agency lists the questions to ask; for a security company, add one: who checks every performance, AI, and compliance claim against the evidence before it is published?

How long does it take?

No study has measured it. A 2026 review of 45 studies found no technique with a stable, longitudinal, cross-platform causal effect on organic discoverability (opens in a new tab) (preprint), so there is no evidence base for a timeline. Google says crawling a URL "can take anywhere from a few days to a few weeks" (opens in a new tab). Treat a promised timeline as a sales claim.

Next steps

AEO HQ sells this work at fixed, published prices, from a $499 automated audit to $8,995 for an audit, a plan, and technical implementation that includes analytics setup. We do not give legal advice or compliance opinions: your counsel or compliance staff approve every claim before it is published. See the prices and what each package includes.

Change log

• September 28, 2026: First published.