How AI Search Is Recommending SIEM Software: Monthly Trends

Executive Summary

Splunk remains the category leader in October 2026 at 42.0% valid recommendation coverage, but the more consequential October story is the stretch of the field below it. Elastic Security posted the month's only significant coverage gain, rising 11.1 points from 17.2% in July 2026 to 28.3% in October 2026, and now sits in a clear second, 13.7 points behind Splunk and 12.4 points ahead of third-place Rapid7 InsightIDR. The category's top tier is no longer just Splunk.

IBM QRadar recorded the sharpest decline in the series. Its coverage fell from 17.5% in July 2026 to 0.0% in October 2026, down 17.5 points, a significant move and a second consecutive month of decline. The 0.0% reflects the brand's removal from the tracked set rather than the measured performance of an incumbent brand.

Splunk also produced a significant month-over-month move of its own, up 10.1 points from 31.9% in September 2026 to 42.0% in October 2026, recovering the ground lost in September and matching its August 2026 level. Elastic Security's September-to-October gain was larger still, up 10.9 points, also significant.

Against the July 2026 baseline, the category is mixed rather than uniformly rising or falling. Splunk is up 6.2 points, Elastic Security up 11.1 points, Securonix up 2.5 points, Rapid7 InsightIDR up 2.4 points, and Google Chronicle up 1.0 point. Losing ground against baseline are IBM QRadar (down 17.5 points, a roster removal), Exabeam (down 1.1 points), Microsoft SharePoint (down 1.3 points), and Sumo Logic (down 0.9 points).

Each monthly run begins with prompt-surface observations across the benchmark's defined AI/search surface universe. In October 2026, that was 780 source prompt-surface observations (617 unique questions); 780 mentioned a tracked brand or competitor; 439 were relevant and 341 were irrelevant. The public metrics use the 283 qualified observations that survive both qualification stages. For comparison, July 2026 began with 787 source prompt-surface observations (526 unique questions), of which 786 mentioned a tracked brand or competitor, 507 were relevant and 279 were irrelevant, yielding 355 qualified observations. August 2026 produced 800 observations (596 unique questions), 760 brand mentions, 606 relevant and 154 irrelevant prompts, and 424 qualified observations. September 2026 produced 793 observations (603 unique questions), 793 brand mentions, 532 relevant and 261 irrelevant prompts, and 379 qualified observations.

Key Findings

AI Response Inconsistency Alerts

Two critical factual inconsistencies were detected across two AI platforms, both concerning Splunk and both involving whether the company remains an actively traded public stock.

Splunk

AI platforms provided conflicting information about Splunk's publicly traded status. When asked "What is Splk stock?", Gemini stated that Splunk is no longer an independently traded public company and that SPLK was delisted from NASDAQ following Cisco's March 2024 acquisition. Perplexity stated that Splunk Inc. (ticker: SPLK) is a publicly traded technology company listed on the NASDAQ. Gemini cited its investor relations and stock reference pages including Investing.com and The Motley Fool; Perplexity referenced MSN Money, Robinhood, and Public.com. The conflict is a critical availability inconsistency: SPLK cannot both be delisted and simultaneously be an actively traded NASDAQ-listed company. Flagged sources on Gemini's side included a Motley Fool page carrying the note "This security has been delisted. This page is retained for historical reference," and a MarketBeat page stating "This company has been marked as potentially delisted and may not be actively trading. As of March 18, 2024, Splunk Inc. operates as a subsidiary of Cisco Systems, Inc."

Responses also differed on Splunk's investment status. When asked "Has Splunk stock been a good investment?", Gemini stated that Splunk is no longer an independent publicly traded company and that Cisco completed its acquisition on March 18, 2024, citing Stockopedia, SecurityWeek, and Morningstar. Perplexity stated that Splunk (SPLK) is still an investable stock with recent performance and analyst signals, citing Yahoo Finance and AAII. The two answers diverge on a basic availability question: if Splunk was acquired and delisted in March 2024, it cannot still be an independently traded stock with recent performance data. Flagged sources on Perplexity's side included a Yahoo Finance article referencing a valuation and current trading price, while Gemini's cited Morningstar page described a $28 billion acquisition by Cisco.

Benchmark Context

The report separates the raw collection universe from the qualified analysis set. Brand-level recommendation percentages are calculated within the qualified benchmark set.

The August 2026 run represented the series high point in qualified observations at 424, and September 2026 produced 379. October 2026's 283 qualified observations is the smallest of the four months, a denominator 72 below July's 355. Every brand-level percentage in this report is calculated against that 283-observation base.

Benchmark-Level Metrics

The October 2026 run produced 97 recommendation-shaped answers (34.3% share) and 135 valid recommendation shortlists (47.7% share) from 283 qualified observations. That compares with 90 recommendation-shaped answers (25.4% share) and 140 valid recommendation shortlists (39.4% share) from 355 qualified observations in July 2026 — a higher share on both measures even though the underlying count of valid recommendation shortlists declined alongside the smaller denominator.

AI Recommendation Trend

Questions This Section Answers

• Who leads SIEM recommendation coverage in October 2026, and how far ahead is the leader?
• Which brands moved most against the July 2026 baseline, and what explains those movements?

Splunk remains the leader while Elastic Security has moved into a clear second position, turning a previously flat field into a three-step structure. Splunk holds 42.0% coverage, Elastic Security 28.3%, and the remainder of the field sits at 15.9% or below.

Valid Recommendation Coverage by Brand

Only one brand, Elastic Security, exceeded normal month-to-month variation across the full series, with a significant 11.1-point gain over baseline. The significant decliner was IBM QRadar, whose movement reflects its removal from the tracked roster rather than an incumbent's measured decline. The category-level change therefore came from a single brand's gain combined with a roster change, not from broad coordinated movement.

What Changed This Month

Questions This Section Answers

• What drove Elastic Security's significant jump in SIEM recommendation coverage?
• What happened to IBM QRadar's coverage, and why does its decline not reflect an incumbent's performance?
• How did Splunk recover to its series high, and what placement measures moved with it?

Elastic Security Posted the Series' Only Significant Brand Gain

Elastic Security rose from 17.2% valid recommendation coverage in July 2026 to 28.3% in October 2026, up 11.1 points, a significant gain over the baseline. The September-to-October move was sharper still: up 10.9 points from 17.4% in September 2026, also significant.

The gain is reflected across placement measures. Its top-three rate rose from 3.4% in July 2026 to 10.6% in October 2026, up 7.2 points, a significant move. Raw mention presence rose from 41.1% to 53.0%, up 11.9 points, also significant. Against the October qualified base of 283 observations, the 28.3% coverage translates to 80 valid recommendations.

The distinction to notice is that Elastic Security's rise is driven by both broader presence and stronger placement, not by one alone. The brand did not record a rank-one placement in October 2026, however, so its gain is a top-three and coverage effect rather than a first-position effect.

Highest-priority diagnostic: Which surfaces and prompt patterns produced the coordinated rise in both presence and top-three placement, and why has that strength not yet converted into rank-one placements?

IBM QRadar Fell Out of the Tracked Roster

IBM QRadar's coverage moved from 17.5% in July 2026 to 0.0% in October 2026, down 17.5 points, a significant move. The brand does not appear in the October 2026 companies list. This is a roster removal, not a measured performance result for an incumbent brand. The brand was tracked in July 2026 on 62 valid recommendations at 17.5% coverage, and stood at 14.5% in September 2026.

The distinction to notice is that IBM QRadar's exit reshapes the category by subtraction. It removes a brand that held the second-highest baseline coverage in July 2026, and its October 2026 replacement in the tracked set is IBM Consulting, which entered at 0.7% coverage on 2 valid recommendations, a substantially different position.

Highest-priority diagnostic: Which tracked brands now capture the recommendation share IBM QRadar held in September 2026, and does the query intent that previously supported IBM QRadar persist in the October run?

Splunk Recovered to Its Series High

Splunk rose from 31.9% valid recommendation coverage in September 2026 to 42.0% in October 2026, up 10.1 points, a significant month-over-month move. That reading matches its August 2026 level of 42.0% and stands above its July 2026 baseline of 35.8% by 6.2 points, which is within normal range over the full series.

Placement measures moved with coverage. Its top-three rate rose from 24.5% in September 2026 to 34.6% in October 2026, and its rank-one rate rose from 11.3% to 14.8%, on 42 rank-one placements. Raw mention presence held at 93.3%, on 264 mentions. Against the October qualified base, the 42.0% coverage represents 119 valid recommendations.

The distinction to notice is that Splunk's October position rests on strong placement within a small denominator. The brand gained 10.1 points of coverage on a base of 283 observations, and its top-three count of 98 is the highest of the four months on the smallest base, which concentrates each additional placement into a larger percentage share.

Highest-priority diagnostic: Which response types and surfaces drove the September-to-October recovery, and are those patterns stable against the larger August denominator?

Buyer-Intent Interpretation

Questions This Section Answers

• Which buyer-intent clusters produced qualified SIEM observations in October 2026?
• What commercial questions about SIEM pricing and head-to-head comparisons can the benchmark not yet answer?

All 283 qualified observations in October 2026 fell into the Brand Recommendation cluster, matching the pattern seen across July, August, and September. There were no qualified observations in the Pricing & Value or Multi-Brand Comparison clusters in October 2026. The public benchmark can therefore answer which brands AI systems recommend for SIEM software, but it cannot yet answer how AI systems compare options head-to-head or how they frame pricing and value. Those commercial questions remain outside the current benchmark's reach.

Brand Opportunity Summary

Questions This Section Answers

• Which SIEM brands show the strongest or weakest signals in October 2026, and what diagnostic should each prioritize?
• What should brands do about the coverage gaps and movements the benchmark identifies?

The benchmark identifies where attention is warranted; a company-level analysis is needed to explain why.

Evidence Behind the Benchmark

The aggregate metrics are built from prompt-level observations (query, surface, recommendation outcome, rank, sentiment, and citations where exposed). Company-level analysis can go deeper into prompt, competitor, surface, and evidence patterns. Source presence is not automatically treated as proof of causation.

About This Benchmark

This report is part of the CiteWorks Studio AI Visibility Market Discovery research program.

• AI Visibility Industry Market Index
• AI Visibility Industry Market Methodology
• AI Visibility Industry Market Metrics
• AI Visibility Industry Market Standards

Report-Specific Interpretation Notes

• This four-month series relies on small observation counts for several brands. IBM Consulting's October result rests on 2 valid recommendations and Microsoft SharePoint's on 2; movement in these figures should be read with that context in mind.
• All percentages are calculated against the qualified benchmark denominator (355 observations in July 2026, 424 in August 2026, 379 in September 2026, and 283 in October 2026), not the larger raw collection universe of 787, 800, 793, and 780 source prompt-surface observations respectively.
• The October 2026 qualified base of 283 observations is the smallest of the four months. Percentage movement on a smaller denominator magnifies each additional placement, so month-over-month comparisons should be read alongside the underlying counts.
• Month-over-month movement identifies changes worth investigating; it does not by itself establish the cause of those changes.
• IBM QRadar's and IBM Consulting's movements reflect removal from and entry into the tracked benchmark roster, not like-for-like comparisons of an incumbent brand across all four months.

Next Step

The Public Benchmark Shows Where a Brand Is Winning or Losing. A Company-Level Audit Shows Why.

The aggregate percentages leave the most commercially important questions unanswered: which high-intent prompts does a brand win, which competitor takes the recommendation when a brand loses, what attributes does the AI associate with each option, and which external sources shape those answers? These patterns sit beneath the coverage rate and determine whether a brand's position is durable or vulnerable. In a category where October's second tier has moved behind Splunk, the gap between second and third place turns on prompt-level dynamics the public benchmark cannot expose.

A company-specific AI visibility audit maps those prompt, surface, competitor, ranking, sentiment, and evidence-source patterns into a prioritized visibility strategy. It converts the benchmark's category-level signals into actionable intelligence for a single brand.

Request an AI visibility audit