How security buyers use AI to build shortlists

Short answer: software buyers now ask AI tools for a shortlist before they speak to a vendor, and AI answers lean on third-party sources. In security and compliance that favours the vendors with the most coverage. Challengers get on the list by publishing specific, quotable pages, earning accurate mentions in the sources AI cites, and measuring the result across many runs.

The shortlist now starts in an AI answer

• 51% of B2B software buyers start research in an AI chatbot more often than in Google, up from 29% a year earlier (G2, 1,076 buyers, March 2026).
• G2 reports AI chatbots as the top source influencing buyer shortlists, ahead of review sites, analyst firms and vendor websites, and 69% of buyers chose a different vendor than planned because it appeared in a chatbot's recommendation.
• 94% of B2B buyers use AI tools while buying, and 95% of deals go to a vendor on the buyer's first shortlist (6sense, 2025).

These surveys cover B2B software buyers in general, not security buyers alone. We know of no published study that isolates CISOs or compliance buyers, so treat the figures as the direction of travel, not a precise measure for your category.

What security buyers ask

Buyer questions fall into a few patterns. Examples:

• Category: “best SOC 2 compliance software for startups”, “best CSPM tools for AWS”.
• Alternatives: “Vanta alternatives”, “cheaper alternative to Drata”.
• Head to head: “CrowdStrike vs SentinelOne for a 300-person company”.
• Constraint-heavy: “ISO 27001 and HIPAA automation that integrates with Okta and Jira”.

The constraints (framework, cloud, company size, integrations, budget) are where a challenger can win. A leader is named for the broad question; a specialist can be the best answer to the narrow one, if its pages state those facts plainly.

Why the same leaders keep getting named

When AI tools answer with live search, they read a handful of pages and write from them. A 2025 study found that for software questions, about three quarters of the sources AI search cited were earned media (reviews, articles and directories), far more than in Google's own results. Ahrefs found “best X” list articles among the most cited page types for vendor questions. The vendors that appear most across those roundups, review grids and comparisons are the ones AI repeats. Your own site matters, but rarely on its own.

Apply the GEO research to a security site

The original GEO paper (KDD 2024) found that adding statistics, quotations and citations of credible sources boosted a page's visibility in generated answers by up to 40% on its benchmark, while keyword stuffing did not help. Its engine was simulated and most questions were informational, so read it as a guide to how answers are assembled, not a guarantee for vendor lists. For a security vendor it translates to:

• Statistics: specific, checkable facts. Frameworks supported, number of integrations, typical time to audit readiness from your own customer data, with the method stated.
• Quotations: named security leaders and auditors describing a concrete result, with permission.
• Citations: link the standards you map to, such as the AICPA SOC 2 criteria, ISO/IEC 27001 or NIST frameworks, so claims are traceable.

The pages that carry these facts:

• Alternatives and comparison pages against the leaders, with honest, specific differences.
• Framework pages (SOC 2, ISO 27001, HIPAA, GDPR) and integration pages (AWS, Azure, Google Cloud, Okta).
• Pricing with real numbers or clear ranges. Vague pricing is often reported as “contact sales” or guessed wrongly.
• A trust centre and docs in plain HTML, reachable by OAI-SearchBot, PerplexityBot, Googlebot and Bingbot. OpenAI states that sites blocking OAI-SearchBot are not shown in ChatGPT search answers.

Earn the sources AI already cites

• Find which pages each AI cites for your buyers' questions, then get listed accurately on them or correct outdated facts.
• Keep G2 and similar review profiles complete and current, with genuine reviews.
• Publish original data others will cite, such as anonymised findings from your own product or a customer survey with its method.

Measure across many runs

AI answers vary: SparkToro found the same brand list repeated for the same question less than 1 time in 100. Pick 20 to 60 real buyer questions, run each several times on each tool, and record who is named, whether your facts are right and which sources are cited. Repeat the same set monthly and report a mention rate, not a rank.

What not to do

• Fake reviews or undisclosed posts. They break platform rules and tend to be filtered.
• Special files or markup as the fix. Google says its AI features need no special markup or AI text files.
• Trusting guarantees. Nobody outside these companies controls what AI tools say.

To see where you stand, the free AI check below runs 10 of your buyers' questions by hand. Related: how to get mentioned in ChatGPT and how we measure.