How AI Search Is Recommending Cybersecurity Services: Monthly Trends

Executive Summary

CrowdStrike is the category leader in AI search recommendations for cybersecurity services, with valid recommendation coverage of 53.5% in August 2026, 5.9 points ahead of Palo Alto Networks at 47.6%. This leadership picture reflects a benchmark instrument update: the tracked brand set shifted from product-specific names (CrowdStrike Falcon, Palo Alto Cortex XDR, Sophos Intercept X, Rapid7 InsightIDR, Secureworks Taegis) to parent-company names (CrowdStrike, Palo Alto Networks, Sophos, Rapid7, Secureworks), with Google Chronicle giving way to Mandiant (Google).

The largest upward mover was CrowdStrike, rising from 0.0% baseline coverage in July 2026 to 53.5% in August 2026. Palo Alto Networks moved up 47.6 points from 0.0% to 47.6%, and Sophos rose 26.3 points from 0.0% to 26.3%. These moves track closely with the switch from measuring product lines to measuring parent companies, which redistributes recommendation credit across the full answer set under new tracked names.

The sharpest declines, including CrowdStrike Falcon (down 53.7 points, from 53.7% to 0.0%), Sophos Intercept X (down 34.4 points, from 34.4% to 0.0%), and Palo Alto Cortex XDR (down 25.0 points, from 25.0% to 0.0%), pair one-for-one with the naming change rather than a loss of recommendation credit. The underlying vendors remain strongly represented, under different tracked names.

Against July 2026, the category shows movement concentrated in the brand-identity shift. The two names that carried across the instrument change, Optiv (1.0% to 1.2%) and Trustwave (1.5% to 1.5%), illustrate the category's underlying quietness outside the renamed cluster. Arctic Wolf is the clearest organic mover in the dataset, falling 8.1 points from 17.3% to 9.2%, a change not explained by the naming shift.

Each monthly run begins with 750 prompt-surface observations (475 unique questions) in July 2026, and the August 2026 run began with a comparable prompt universe. Of the July prompts, 750 mentioned a tracked brand or competitor; 500 were relevant and 250 were irrelevant. The public metrics use the 404 observations that survived both qualification stages in July 2026, and 338 observations in August 2026.

Key Findings

Benchmark Context

The benchmark separates the raw collection universe from the qualified analysis set. Brand-level recommendation percentages are calculated within the qualified benchmark set.

The qualified denominator moved from 404 to 338 observations between the two months, and the two months also carry different tracked platform IDs (rolling up to the same six canonical AI surface families in both periods). The metrics below summarize category-wide movement across that qualified set, independent of the individual brand-naming changes covered later in this report.

Benchmark-Level Metrics

AI Recommendation Trend

The top of the category is now a two-brand cluster with a single-digit gap, and the ranking changed because the benchmark tracks parent companies rather than product lines.

The category-level change comes overwhelmingly from the instrument's brand-naming shift rather than from organic movement in recommendation behavior. Several brands moved beyond normal month-to-month variation, but those moves pair one-for-one with the switch from product-line names to parent-company names, which redistributes the same underlying recommendation credit across newly tracked entities. Arctic Wolf's decline is the one movement in this table that is not explained by the naming shift.

What Changed This Month

CrowdStrike: New Leader Under a Parent-Company Name

CrowdStrike's valid recommendation coverage moved from 0.0% in July 2026 to 53.5% in August 2026. The prior month's coverage for CrowdStrike Falcon was 53.7%, which means the parent-company name now captures essentially the same recommendation credit the product line held before. The brand was present in 82.2% of August 2026 observations, with a top-three recommendation rate of 47.9% and a rank-one rate of 27.5% across 162 top-three placements and 93 rank-one placements.

CrowdStrike was already the most recommended vendor in July under the Falcon product name, and it remains so in August under the corporate name. The current benchmark records this as a naming-driven leadership carryover rather than a new competitive gain.

Highest-priority diagnostic: whether the parent-company name captures recommendation credit in prompts where the product line was previously invisible, or whether the same set of prompts is now simply credited to the parent name.

Palo Alto Networks: Close Second, Not a Simple Rename

Palo Alto Networks rose from 0.0% baseline to 47.6% valid recommendation coverage in August 2026, while Palo Alto Cortex XDR fell from 25.0% to 0.0%. The gap between CrowdStrike and Palo Alto Networks is 5.9 points. Palo Alto Networks was present in 76.3% of August 2026 observations, with a top-three rate of 37.6% and a rank-one rate of 18.1% across 127 top-three placements and 61 rank-one placements.

Palo Alto Networks' parent-company coverage is higher than its product-line coverage was in July, which the data cannot fully attribute to the naming change alone since the corporate name appears to capture additional recommendation credit beyond the Cortex XDR product line.

Highest-priority diagnostic: which specific product names within Palo Alto Networks' portfolio are driving the parent-company credit, and which prompts route to the corporate name versus the product name.

Sophos: Third Place With a Lower Parent-Company Total

Sophos moved from 0.0% baseline to 26.3% valid recommendation coverage in August 2026, while Sophos Intercept X fell from 34.4% to 0.0%. The parent-company name captured less credit than the Intercept X product line did in July. Sophos was present in 36.7% of August observations, with a top-three rate of 10.7% and a rank-one rate of 1.5% across 36 top-three placements and 5 rank-one placements.

Unlike CrowdStrike and Palo Alto Networks, Sophos' parent-company coverage is lower than its flagship product's July coverage, meaning some recommendation credit that previously attached to Intercept X does not appear under the corporate name in this dataset.

Highest-priority diagnostic: whether the gap represents credit spread across the broader Sophos brand or credit attached to other Sophos products not tracked in July.

Arctic Wolf: The Clearest Organic Decliner

Arctic Wolf's valid recommendation coverage fell from 17.3% in July 2026 to 9.2% in August 2026, a drop of 8.1 points that exceeds the significance threshold applied to this brand. Its raw mention presence fell from 24.5% to 13.0%, and its top-three rate declined from 8.9% to 5.3%. Arctic Wolf held 31 valid recommendations in August 2026, down from 70 in July, with 18 top-three placements and 6 rank-one placements.

Arctic Wolf's decline is not explained by a naming shift, making it the clearest organic movement in the category this month. The brand remains present and positively framed, with a net sentiment score of 0.8 in August 2026, but both its visibility and its recommendation share contracted.

Highest-priority diagnostic: which prompt categories and AI surfaces drove the visibility loss, and whether the benchmark can distinguish that loss from measurement effects tied to the broader instrument change.

Instrument Note: The July-to-August Naming Shift

The benchmark's tracked brand set changed between July 2026 and August 2026. Six product-line names (CrowdStrike Falcon, Palo Alto Cortex XDR, Sophos Intercept X, Rapid7 InsightIDR, Secureworks Taegis, Google Chronicle) were replaced by parent-company names (CrowdStrike, Palo Alto Networks, Sophos, Rapid7, Secureworks, Mandiant (Google)). Pairwise movements between these paired names are best read as effects of the naming change rather than independent gains or losses. The two names that carried across the change, Optiv and Trustwave, were both stable.

Highest-priority diagnostic: whether future months hold the parent-company names as the stable tracking set, and whether the product-line names re-enter as separately tracked entities.

Buyer-Intent Interpretation

In August 2026, the qualified observations fell entirely into the Brand Recommendation cluster, with no qualified observations in the Pricing & Value or Multi-Brand Comparison clusters. The public benchmark therefore answers the "which vendor" question well, but it cannot answer commercial questions about price positioning, value perception, or head-to-head competitive outcomes. Those questions require a company-level audit that goes beneath the aggregate benchmark.

Brand Opportunity Summary

The benchmark identifies where attention is warranted across the tracked brand set; a company-level analysis is needed to explain why those patterns exist and what drives them.

Evidence Behind the Benchmark

The aggregate metrics are built from prompt-level observations capturing the query, the AI surface, the recommendation outcome, the rank, the sentiment, and the citations where exposed. Company-level analysis can go deeper into prompt, competitor, surface, and evidence patterns. Presence in a benchmark answer is not automatically evidence of causation.

About This Benchmark

This report is part of the CiteWorks Studio AI Industry Market Discovery research program.

• AI Industry Market Discovery
• AI Industry Market Discovery Methodology
• AI Industry Market Discovery Metrics
• AI Industry Market Discovery Standards

Report-Specific Interpretation Notes

• The August 2026 brand set changed from product-line names to parent-company names; pairwise movements between the old and new names track closely with that naming change rather than independent organic shifts.
• The qualified denominator (338 observations in August 2026, 404 in July 2026) differs from the raw collection universe (750 prompt-surface observations); percentages are calculated within the qualified set.
• With 16 tracked brand names across two months, several carry small observation counts; treat single-digit coverage figures as directional signals, not definitive rankings.
• Movement between months identifies changes worth investigating; the data describes the output distribution, not its cause.

Next Step

The Public Benchmark Shows Where a Brand Is Winning or Losing. A Company-Level Audit Shows Why.

The aggregate percentage answers which brands AI systems recommend, but not why. Beneath CrowdStrike's 53.5% coverage sit questions about which high-intent prompts it wins, which competitor takes the recommendation when it loses, what attributes AI associates with each option, and which external sources shape those answers. The same questions apply to Arctic Wolf's 8.1-point decline and to the gap between Sophos' parent-company coverage and its product-line coverage.

A company-specific AI visibility audit maps those prompt, surface, competitor, ranking, sentiment, and evidence-source patterns into a prioritized visibility strategy. It identifies the highest-intent prompts where a brand is losing, the competitor that wins in its place, and the external sources that drive the AI's answer.

Request an AI visibility audit