{"report":{"title":"Which cybersecurity provider does AI recommend in Canada?","url":"https://thepromptgroup.com/research/canadian-cybersecurity-ai-visibility-2026","publisher":"The Prompt Group","author":"Anton Sopov","reportType":"Category benchmark","vertical":"Cybersecurity","market":"Canada, English prompts","collectedOn":"2026-09-04","collectionNote":"three runs, 4 and 5 September 2026","datePublished":"2026-09-05","dateModified":"2026-09-05","engines":[{"engine":"chatgpt","responses":135,"note":"1,102 provider mentions, 111 providers"},{"engine":"perplexity","responses":135,"note":"634 provider mentions, 96 providers"},{"engine":"googleAiOverview","responses":135,"note":"255 provider mentions, 37 providers"}],"licence":"https://creativecommons.org/licenses/by/4.0/","citeAs":"Anton Sopov (2026). Which cybersecurity provider does AI recommend in Canada?. The Prompt Group Research. https://thepromptgroup.com/research/canadian-cybersecurity-ai-visibility-2026","limitations":"Three runs across two days, and two of those runs were five minutes apart, so this is closer to two collection moments than three. Answer engines vary run to run and this panel shows how much: Google AI Overview named almost nobody in the first two runs and named providers freely in the third, which is where most of its 255 mentions come from. Read the order of providers below 3 percent as unstable. The panel is 45 questions weighted towards detection and response, so it describes that shortlist rather than the whole security market. The unbranded classification is automated; we checked all 50 questions by hand against the flag and found no disagreement, but a larger panel might.","methodology":[{"detail":"50 tracked questions written to match what a Canadian security buyer types on the way to a shortlist. The 45 that name no company are the panel for this report; the other 5 are excluded.","term":"Panel"},{"detail":"Eight topics, weighted towards detection and response: managed detection and response 24 questions, vendor evaluation 9, implementation and onboarding 7, incident response 7, threat hunting 6, security operations 5, compliance reporting 4, security assessment 4. Questions can carry more than one topic. The panel does not cover identity, cloud posture, email security or penetration testing pricing, so it describes the detection and response shortlist rather than every security budget line.","term":"What the panel covers"},{"detail":"Every figure on this page is drawn from questions that name no provider. A question that names a company will name it back, so mixing branded and unbranded questions inflates whoever the questions mention. Applying the filter moves the numbers: esentire.com falls from the most-cited domain in the full panel to sixth here.","term":"Unbranded filter"},{"detail":"Three runs. Two on 4 September 2026 five minutes apart, and one on 5 September 2026. Each question asked once per engine per run from a Canadian location. 405 unbranded answers in total, 135 per engine.","term":"Collection"},{"detail":"A provider’s mentions divided by all provider mentions in the set being reported. A provider named twice in one answer counts once. Sums to 100 percent within a set.","term":"Share of provider mentions"},{"detail":"Answers naming the provider at least once, divided by all 405 answers. Two providers can share a share of mentions and differ here.","term":"Answers naming a provider"},{"detail":"Position is where the provider appears in the list an answer gives, averaged across the answers naming it. Sentiment is scored from the language around each mention on a 0 to 100 scale, where 50 is neutral.","term":"Average position and sentiment"},{"detail":"Answers containing at least one citation to a page on the domain, divided by all 405 answers.","term":"Answers citing a domain"},{"detail":"Providers were identified by automated extraction from each answer. Resellers, consultancies and accounting firms appear alongside product vendors because the answers offer them as alternatives to one another.","term":"Entity extraction"},{"detail":"A provider shows its favicon only where we confirmed the site belongs to it by opening the site. A cited page is never treated as a provider’s website.","term":"Provider marks"}],"downloads":{"json":"https://thepromptgroup.com/research/canadian-cybersecurity-ai-visibility-2026/data.json","csv":"https://thepromptgroup.com/research/canadian-cybersecurity-ai-visibility-2026/data.csv"}},"figures":[{"number":1,"id":"fig-share","title":"No provider takes more than one mention in eight. A long tail takes one in three.","scope":"All 45 questions, 3 engines","caption":"Share of provider mentions across 405 answers to unbranded questions, pooled over three collection runs. Entities extracted automatically from each answer; resellers and consultancies are counted alongside product vendors, because the answers treat them as alternatives.","unit":"%","series":["value"],"rows":[{"label":"CrowdStrike","kind":"brand","site":"crowdstrike.com","value":11.7,"Answers naming it":"24.2%","Average position":"2.9","Sentiment":"68 / 100"},{"label":"Arctic Wolf","kind":"brand","site":"arcticwolf.com","value":8.7,"Answers naming it":"18%","Average position":"2.7","Sentiment":"69 / 100"},{"label":"Sophos","kind":"brand","site":"sophos.com","value":8.6,"Answers naming it":"17.8%","Average position":"2.7","Sentiment":"71 / 100"},{"label":"eSentire","kind":"brand","site":"esentire.com","value":7.1,"Answers naming it":"14.8%","Average position":"2.3","Sentiment":"76 / 100"},{"label":"Rapid7","kind":"brand","site":"rapid7.com","value":4.2,"Answers naming it":"8.6%","Average position":"4.1","Sentiment":"69 / 100"},{"label":"SentinelOne","kind":"brand","site":"sentinelone.com","value":3.8,"Answers naming it":"7.9%","Average position":"3.5","Sentiment":"61 / 100"},{"label":"Expel","kind":"brand","site":"expel.com","value":3.5,"Answers naming it":"7.2%","Average position":"3.0","Sentiment":"72 / 100"},{"label":"Huntress","kind":"brand","site":"huntress.com","value":3,"Answers naming it":"6.2%","Average position":"2.8","Sentiment":"70 / 100"},{"label":"Red Canary","kind":"brand","site":"redcanary.com","value":2.6,"Answers naming it":"5.4%","Average position":"4.2","Sentiment":"74 / 100"},{"label":"Palo Alto Networks","kind":"brand","site":"paloaltonetworks.com","value":2.5,"Answers naming it":"5.2%","Average position":"3.5","Sentiment":"56 / 100"},{"label":"CDW Canada","kind":"brand","site":"cdw.ca","value":2.1,"Answers naming it":"4.4%","Average position":"3.3","Sentiment":"59 / 100"},{"label":"CIRA MDR","kind":"brand","site":"cira.ca","value":1.9,"Answers naming it":"4%","Average position":"3.6","Sentiment":"74 / 100"},{"label":"EY Canada","kind":"brand","site":"ey.com","value":1.9,"Answers naming it":"4%","Average position":"7.0","Sentiment":"70 / 100"},{"label":"ESET","kind":"brand","site":"eset.com","value":1.4,"Answers naming it":"3%","Average position":"2.7","Sentiment":"81 / 100"},{"label":"Secureworks","kind":"brand","site":"secureworks.com","value":1.4,"Answers naming it":"3%","Average position":"5.5","Sentiment":"61 / 100"},{"label":"161 other providers","kind":"other","value":35.6,"Answers naming it":"under 3% each"}]},{"number":2,"id":"fig-engine","title":"The two engines that name providers disagree about who comes first.","scope":"Same 45 questions, per engine","caption":"Share of provider mentions within each engine’s own 135 answers. The eight providers shown are those reaching at least 4 percent in either engine.","unit":"%","series":["ChatGPT (135 answers)","Perplexity (135 answers)"],"rows":[{"label":"CrowdStrike","kind":"brand","site":"crowdstrike.com","value":12.3,"value2":6.9,"change":-5.4},{"label":"eSentire","kind":"brand","site":"esentire.com","value":5.3,"value2":9.5,"change":4.2},{"label":"Arctic Wolf","kind":"brand","site":"arcticwolf.com","value":8.8,"value2":6.9,"change":-1.9},{"label":"Sophos","kind":"brand","site":"sophos.com","value":8.6,"value2":7.5,"change":-1.1},{"label":"Expel","kind":"brand","site":"expel.com","value":5.5,"value2":1.6,"change":-3.9},{"label":"SentinelOne","kind":"brand","site":"sentinelone.com","value":5,"value2":2.6,"change":-2.4},{"label":"Rapid7","kind":"brand","site":"rapid7.com","value":4,"value2":2.9,"change":-1.1},{"label":"EY Canada","kind":"brand","site":"ey.com","value":0.8,"value2":4.2,"change":3.4}]},{"number":3,"id":"fig-volume","title":"Google AI Overview names roughly one provider for every four ChatGPT names.","scope":"135 answers per engine","caption":"Provider mentions produced in each engine’s own 135 answers, and how many distinct providers those mentions covered. Google AI Overview was near silent in the first two runs and far more forthcoming in the third, which is most of its total here.","unit":"count","series":["value"],"rows":[{"label":"ChatGPT","kind":"brand","value":1102,"Providers named":"111","Answers":"90"},{"label":"Perplexity","kind":"brand","value":634,"Providers named":"96","Answers":"90"},{"label":"Google AI Overview","kind":"brand","value":255,"Providers named":"37","Answers":"90"}]},{"number":4,"id":"fig-sources","title":"Eight of the fourteen most-cited domains belong to providers themselves.","scope":"405 answers, 3 engines","caption":"Share of the 405 answers citing at least one page on the domain. Type is our own classification; the measurement treats every provider’s site the same way, so all of them read as a provider site here.","unit":"%","series":["value"],"rows":[{"label":"paloaltonetworks.com","kind":"domain","site":"paloaltonetworks.com","type":"Provider","value":20.6,"Citations":"104","Pages cited":"50"},{"label":"expel.com","kind":"domain","site":"expel.com","type":"Provider","value":18.1,"Citations":"109","Pages cited":"49"},{"label":"microsoft.com","kind":"domain","site":"microsoft.com","type":"Platform","value":16.8,"Citations":"173","Pages cited":"126"},{"label":"rapid7.com","kind":"domain","site":"rapid7.com","type":"Provider","value":16.8,"Citations":"100","Pages cited":"49"},{"label":"sophos.com","kind":"domain","site":"sophos.com","type":"Provider","value":16.1,"Citations":"79","Pages cited":"38"},{"label":"esentire.com","kind":"domain","site":"esentire.com","type":"Provider","value":14.2,"Citations":"81","Pages cited":"47"},{"label":"gartner.com","kind":"domain","site":"gartner.com","type":"Analyst","value":13.5,"Citations":"75","Pages cited":"37"},{"label":"huntress.com","kind":"domain","site":"huntress.com","type":"Provider","value":13.2,"Citations":"66","Pages cited":"23"},{"label":"underdefense.com","kind":"domain","site":"underdefense.com","type":"Provider","value":12.9,"Citations":"58","Pages cited":"30"},{"label":"cdw.ca","kind":"domain","site":"cdw.ca","type":"Reseller","value":12.6,"Citations":"49","Pages cited":"19"},{"label":"expertinsights.com","kind":"domain","site":"expertinsights.com","type":"Editorial","value":11.9,"Citations":"49","Pages cited":"13"},{"label":"mdrproviders.io","kind":"domain","site":"mdrproviders.io","type":"Directory","value":11.9,"Citations":"68","Pages cited":"40"},{"label":"g2.com","kind":"domain","site":"g2.com","type":"Review","value":11.6,"Citations":"62","Pages cited":"30"},{"label":"kaseya.com","kind":"domain","site":"kaseya.com","type":"Provider","value":11.3,"Citations":"37","Pages cited":"9"}]}]}