How AI Search Is Recommending VPN Services: Monthly Trends

Executive Summary

Proton VPN remains the coverage leader in September 2026 at 80.3% valid recommendation coverage, a modest 0.4-point dip from August. The gap to second-place NordVPN stands at 3.9 points (80.3% vs 76.4%), with Surfshark close behind at 73.4%. The leader has held the top position across all three months of the series, though the entire top tier has eased lower since July.

TunnelBear is the month's only significant mover, falling 5.0 points from August to 7.4% coverage, down 6.2 points from 13.6% in July. This marks the second consecutive month of decline and places TunnelBear as the standout decliner in an otherwise stable category. Private Internet Access was the strongest upward mover, rising 3.8 points from August to 33.3% coverage, up 3.7 points from 29.6% in July, though the move stayed within normal variation.

Across the three-month series, the category shows a consistent pattern: high presence rates across most tracked brands, with the meaningful competitive differences showing up in how often each brand is actually recommended rather than simply mentioned. The top tier has softened gradually, while the middle tier shows signs of repositioning, most visibly in Private Internet Access's steady climb and TunnelBear's accelerating decline.

Each monthly run begins with 800 prompt-surface observations (534 unique questions in July; 574 in August; 593 in September) across the benchmark's defined AI/search surface universe. Of those, 800 mentioned a tracked brand or competitor in all three months; 798 were relevant and 2 were irrelevant in July, all 800 were relevant in August, and 799 were relevant and 1 was irrelevant in September. The public metrics use the 707 qualified observations in July, 709 in August, and 700 in September that survive both qualification stages.

Key Findings

Benchmark Context

The report separates the raw collection universe from the qualified analysis set. Brand-level recommendation percentages are calculated within the qualified benchmark set.

The qualified benchmark observations in each column are the denominator used throughout the brand-level tables below.

Benchmark-Level Metrics

The recommendation-shaped answer share and valid recommendation shortlist share both trended lower across the series, with August (50.6% and 81.5%) sitting between the July and September levels. Coverage rates for most tracked brands also softened across the same period, though the benchmark cannot establish a causal relationship between these two trends.

AI Recommendation Trend

The category structure held steady in September, with Proton VPN maintaining leadership for a third consecutive month despite a gradual decline in its coverage rate. No brand outside TunnelBear moved beyond normal month-to-month variation, leaving the competitive tiers largely intact.

Recommendation Coverage by Brand

TunnelBear was the only brand to exceed normal month-to-month variation in September. The rest of the category moved in smaller increments, with the most visible pattern being a slow convergence between the top tier and the middle tier while leaders eased and Private Internet Access climbed.

What Changed This Month

Proton VPN: Leader Holds With Narrowing Lead

Proton VPN remained the coverage leader at 80.3% in September, down 3.6 points from 83.9% in July and essentially flat against August's 80.7%. The two-month decline stayed within normal month-to-month variation.

Presence remained strong at 96.3%, up 1.0 point from 95.3% in July, while top-three recommendation rate slipped 1.4 points to 45.0% from 46.4%. Rank-one rate fell 2.4 points to 12.7% from 15.1%. Valid recommendation count was 562 out of 700 qualified observations, down from 593 out of 707.

The distinction to notice: Proton VPN's coverage lead now rests on consistent recommendation across a broad set of prompts rather than on dominance in first position, where NordVPN holds a 47.7% rank-one rate versus Proton VPN's 12.7%.

Highest-priority diagnostic: Which prompt patterns moved Proton VPN out of the top three, and which competitor absorbed those placements?

TunnelBear: Significant Two-Month Decline

TunnelBear was the only significant mover in September, with coverage falling 6.2 points from 13.6% in July to 7.4%, including a 5.0-point drop from August's 12.4%. The decline is spread across multiple signals.

Presence fell sharply, down 8.2 points from 18.7% in July to 10.4%, and top-three rate dropped 2.2 points from 4.5% to 2.3%. Valid recommendation count fell to 52 out of 700 observations, down from 96 out of 707 in July and 88 out of 709 in August. Rank-one placements remain negligible at 0.1%, though sentiment held steady at 0.7.

The distinction to notice: TunnelBear is losing recommendation credit across the board, with the decline concentrated in reduced presence rather than a shift in placement quality. The small absolute counts mean each placement carries outsized weight in the percentage movement.

Highest-priority diagnostic: Which prompt categories stopped surfacing TunnelBear altogether, and which competitors now occupy the recommendations it previously held?

Private Internet Access: Steady Climb Continues

Private Internet Access was the strongest upward mover, rising 3.8 points from August to 33.3% coverage in September, up 3.7 points from 29.6% in July. The move stayed within normal month-to-month variation but represents a consistent upward trajectory across the series.

Presence rose 3.7 points from 38.8% in July to 42.4%, and top-three rate improved 2.5 points from 3.7% to 6.1%. Rank-one rate edged up 0.3 points to 1.0%. Valid recommendation count climbed to 233 out of 700 observations, up from 209 out of 707 in July.

The distinction to notice: Private Internet Access is gaining coverage through both broader presence and improved top-three placement, though its rank-one rate remains low at 1.0%, meaning the gains are coming from secondary and tertiary positions.

Highest-priority diagnostic: Which prompts newly include Private Internet Access in their recommendation sets, and what attributes are driving the improved top-three placement?

NordVPN and Surfshark: Parallel Softening

NordVPN and Surfshark followed nearly identical trajectories in September, each down 3.7 points from July (NordVPN to 76.4% from 80.1%; Surfshark to 73.4% from 77.1%). Both saw 0.7-point declines from August.

NordVPN's presence held essentially universal at 99.3%, and its top-three rate actually improved 1.3 points to 65.1% from 63.8% in July. Surfshark's presence rose 1.9 points to 95.0%, while its top-three rate slipped 1.5 points to 54.0%. NordVPN's rank-one rate improved 0.5 points to 47.7%, while Surfshark's fell 0.8 points to 5.7%.

The distinction to notice: Both brands are being mentioned in nearly every response, but the coverage decline reflects which prompts recommend them at all, not how often they appear. NordVPN's strength in first position remains the category's defining single-brand signal.

Highest-priority diagnostic: Which prompt types no longer produce a NordVPN or Surfshark recommendation even though the brand is mentioned?

Buyer-Intent Interpretation

All 700 qualified observations in September fell into the Brand Recommendation cluster, matching the pattern in July and August where all observations also landed there. The public benchmark therefore cannot yet answer questions about how pricing, value, or direct head-to-head comparisons influence which VPN brand AI systems recommend. The current evidence captures which brand is recommended, not why it wins on cost or comparison grounds.

Brand Opportunity Summary

The benchmark identifies where attention is warranted; a company-level analysis is needed to explain why these patterns are emerging.

Evidence Behind the Benchmark

The aggregate metrics are built from prompt-level observations (query, surface, recommendation outcome, rank, sentiment, and citations where exposed). Company-level analysis can go deeper into prompt, competitor, surface, and evidence patterns. Source presence is not automatically treated as proof of causation.

About This Benchmark

This report is part of the LLM Authority Index AI Market Discovery research program.

• AI Industry Market Discovery Methodology
• AI Industry Market Discovery Metrics
• AI Industry Market Discovery Standards

Report-Specific Interpretation Notes

• Only TunnelBear moved beyond normal month-to-month variation in September, marking the first significant movement recorded in this three-month series. The remaining nine brands were classified as stable.
• Brand-level percentages use the qualified benchmark set (700 observations in September), not the raw collection universe of 800 prompts.
• Directional analysis identifies movements worth investigating; it does not by itself establish the cause of those movements.
• Small absolute counts apply to lower-coverage brands such as TunnelBear (52 valid recommendations), IPVanish (66), and CyberGhost VPN (121). Interpret percentage movement for these brands with the counts in view.

Next Step

The Public Benchmark Shows Where a Brand Is Winning or Losing. A Company-Level Audit Shows Why.

The aggregate percentages raise questions that the benchmark alone cannot answer: which high-intent prompts is a brand winning or losing, which competitor takes the recommendation when a brand loses, what attributes do AI systems associate with each option, and which external sources shape those answers.

A company-specific AI visibility audit maps those prompt, surface, competitor, ranking, sentiment, and evidence-source patterns into a prioritized visibility strategy.

Request an AI visibility audit