Best cybersecurity providers in Canada, according to AI

What do AI answers say about Canadian cybersecurity providers?

No provider owns the category: CrowdStrike leads on 11.7 percent of provider mentions, and the two engines that name providers at all rank the leaders in almost opposite order.

1. No provider took more than 11.7 percent of 1,991 provider mentions in 405 Canadian cybersecurity answers, and 161 providers split 35.6 percent.

   Figure 1

2. ChatGPT and Perplexity invert the leading set: CrowdStrike takes 12.3 percent on ChatGPT and 6.9 on Perplexity, eSentire 5.3 and 9.5.

   Figure 2

3. ChatGPT produced 1,102 provider mentions across 111 providers; Google AI Overview produced 255 across 37.

   Figure 3

4. Eight of the fourteen most cited domains are provider-owned sites, led by paloaltonetworks.com at 20.6 percent of answers.

   Figure 4

5. microsoft.com needs 126 cited pages to reach 16.8 percent of answers; kaseya.com reaches 11.3 percent from nine.

   Figure 4

Which cybersecurity providers does AI name most in Canada?

CrowdStrike, on 11.7 percent of provider mentions, followed by Arctic Wolf at 8.7, Sophos at 8.6 and eSentire at 7.1.

Visibility concentrates in a small group and then disperses. The four leading providers take 36.1 percent of 1,991 mentions between them and the fifteen most named take 64.4 percent, while the remaining 161 providers split 35.6 percent without one of them reaching 1.4. The tenth provider takes 2.5 percent and the fifteenth 1.4.

Four of the fifteen are Canadian: eSentire, CDW Canada, CIRA MDR and EY Canada. They sit among the global platforms rather than in a bracket of their own, because the answers offer them as alternatives to one another.

Figure 1

The full ranking

No provider takes more than one mention in eight. A long tail takes one in three.

Canadian providerProvider based elsewhereEveryone below the top fifteen

1. 01CrowdStrike11.7%1st of 153.0 points ahead of Arctic WolfAnswers naming it24.2%Average position2.9Sentiment68 / 100
2. 02Arctic Wolf8.7%2nd of 153.0 points behind CrowdStrikeAnswers naming it18%Average position2.7Sentiment69 / 100
3. 03Sophos8.6%3rd of 153.1 points behind CrowdStrikeAnswers naming it17.8%Average position2.7Sentiment71 / 100
4. 04eSentire7.1%4th of 154.6 points behind CrowdStrikeAnswers naming it14.8%Average position2.3Sentiment76 / 100
5. 05Rapid74.2%5th of 157.5 points behind CrowdStrikeAnswers naming it8.6%Average position4.1Sentiment69 / 100
6. 06SentinelOne3.8%6th of 157.9 points behind CrowdStrikeAnswers naming it7.9%Average position3.5Sentiment61 / 100
7. 07Expel3.5%7th of 158.2 points behind CrowdStrikeAnswers naming it7.2%Average position3.0Sentiment72 / 100
8. 08Huntress3.0%8th of 158.7 points behind CrowdStrikeAnswers naming it6.2%Average position2.8Sentiment70 / 100
9. 09Red Canary2.6%9th of 159.1 points behind CrowdStrikeAnswers naming it5.4%Average position4.2Sentiment74 / 100
10. 10Palo Alto Networks2.5%10th of 159.2 points behind CrowdStrikeAnswers naming it5.2%Average position3.5Sentiment56 / 100
11. 11CDW Canada2.1%11th of 159.6 points behind CrowdStrikeAnswers naming it4.4%Average position3.3Sentiment59 / 100
12. 12CIRA MDR1.9%12th of 15, tied with 19.8 points behind CrowdStrikeAnswers naming it4%Average position3.6Sentiment74 / 100
13. 13EY Canada1.9%12th of 15, tied with 19.8 points behind CrowdStrikeAnswers naming it4%Average position7.0Sentiment70 / 100
14. 14ESET1.4%14th of 15, tied with 110.3 points behind CrowdStrikeAnswers naming it3%Average position2.7Sentiment81 / 100
15. 15Secureworks1.4%14th of 15, tied with 110.3 points behind CrowdStrikeAnswers naming it3%Average position5.5Sentiment61 / 100
16. 161 other providers35.6%

0%10%20%30%40%

Show all 16 companies ↓Show the top 15 ↑

Data behind Figure 116 rows · CSV · JSON · PNG

Share of provider mentions across the 405 answers to unbranded questions, pooled over three runs. The Prompt Group, 4 September 2026.

Providers are extracted automatically, so resellers and consultancies count alongside product vendors, because the answers offer them as alternatives to one another. A ring means the grouped remainder, or a site we could not confirm.

Name	Value	Answers naming it	Average position	Sentiment
CrowdStrike	11.7%	24.2%	2.9	68 / 100
Arctic Wolf	8.7%	18%	2.7	69 / 100
Sophos	8.6%	17.8%	2.7	71 / 100
eSentire	7.1%	14.8%	2.3	76 / 100
Rapid7	4.2%	8.6%	4.1	69 / 100
SentinelOne	3.8%	7.9%	3.5	61 / 100
Expel	3.5%	7.2%	3.0	72 / 100
Huntress	3.0%	6.2%	2.8	70 / 100
Red Canary	2.6%	5.4%	4.2	74 / 100
Palo Alto Networks	2.5%	5.2%	3.5	56 / 100
CDW Canada	2.1%	4.4%	3.3	59 / 100
CIRA MDR	1.9%	4%	3.6	74 / 100
EY Canada	1.9%	4%	7.0	70 / 100
ESET	1.4%	3%	2.7	81 / 100
Secureworks	1.4%	3%	5.5	61 / 100
161 other providers	35.6%	under 3% each

A field of 176 providers competing for one shortlist slot is unusually open, and 64.4 percent held by fifteen companies is low for a category with this many established vendors. A provider outside the top four is competing against a long tail rather than a dominant incumbent.

Providers are extracted automatically, so resellers and consultancies are counted alongside product vendors, because the answers present them as alternatives.

Does ChatGPT recommend the same cybersecurity providers as Perplexity?

No. The two engines name the same leading set and invert it: CrowdStrike takes 12.3 percent on ChatGPT and 6.9 on Perplexity.

The reversal runs through the set rather than one company. eSentire takes 5.3 percent on ChatGPT and 9.5 on Perplexity. Expel and SentinelOne are the clearest ChatGPT specialists at 5.5 and 5.0 against 1.6 and 2.6, and EY Canada runs the other way at 0.8 against 4.2, the largest proportional swing in the set at more than five to one.

These are shares of each engine's own 135 answers, so the two columns are comparable to each other and not to the pooled figure.

Figure 2

Engine by engine

The two engines that name providers disagree about who comes first.

ChatGPTPerplexity

0%4%8%12%

1. 01CrowdStrike12.3%6.9%78 percent more often on ChatGPTas on Perplexity, a gap of 5.4 pointsChatGPT1st of 8Perplexity3rd of 8
2. 02eSentire5.3%9.5%79 percent more often on Perplexityas on ChatGPT, a gap of 4.2 pointsChatGPT5th of 8Perplexity1st of 8
3. 03Arctic Wolf8.8%6.9%28 percent more often on ChatGPTas on Perplexity, a gap of 1.9 pointsChatGPT2nd of 8Perplexity3rd of 8
4. 04Sophos8.6%7.5%15 percent more often on ChatGPTas on Perplexity, a gap of 1.1 pointsChatGPT3rd of 8Perplexity2nd of 8
5. 05Expel5.5%1.6%Highest on ChatGPT3.9 points above PerplexityChatGPT4th of 8Perplexity8th of 8
6. 06SentinelOne5.0%2.6%Highest on ChatGPT2.4 points above PerplexityChatGPT6th of 8Perplexity7th of 8
7. 07Rapid74.0%2.9%Highest on ChatGPT1.1 points above PerplexityChatGPT7th of 8Perplexity6th of 8
8. 08EY Canada0.8%4.2%Highest on Perplexity3.4 points above ChatGPTChatGPT8th of 8Perplexity5th of 8

Data behind Figure 28 rows · CSV · JSON · PNG

Share of provider mentions within each engine's own 135 answers, for the eight providers reaching 4 percent in either. The Prompt Group, 4 September 2026.

Name	ChatGPT (135 answers)	Perplexity (135 answers)
CrowdStrike	12.3%	6.9%
eSentire	5.3%	9.5%
Arctic Wolf	8.8%	6.9%
Sophos	8.6%	7.5%
Expel	5.5%	1.6%
SentinelOne	5.0%	2.6%
Rapid7	4.0%	2.9%
EY Canada	0.8%	4.2%

The two engines read different material to get there. ChatGPT leans on vendor documentation and comparison pages, while Perplexity cites more resellers, consultancies and Canadian sites, which is where CDW Canada and EY Canada pick up their positions.

Work that lifts a provider on one engine will not necessarily move the other, so a single blended visibility score removes the variation a provider could act on.

Which AI engines name cybersecurity vendors at all?

ChatGPT most, with 1,102 provider mentions across 135 answers, against 634 for Perplexity and 255 for Google AI Overview.

The engines differ in breadth as well as volume. ChatGPT covered 111 distinct providers, Perplexity 96 and Google AI Overview 37, which works out at 8.2, 4.7 and 1.9 mentions per answer.

Google AI Overview is also the least stable of the three. It named almost nobody in the first two runs and named providers freely in the third, which is where most of its 255 mentions come from.

Figure 3

How much each engine names

Google AI Overview names roughly one provider for every four ChatGPT names.

04008001200

1. 1102ChatGPT55 percent of all 1,991Providers named111Answers90
2. 634Perplexity32 percent of all 1,991Providers named96Answers90
3. 255Google AI Overview13 percent of all 1,991Providers named37Answers90

Data behind Figure 33 rows · CSV · JSON · PNG

Provider mentions in each engine's own 135 answers, and how many distinct providers they covered. The Prompt Group, 4 September 2026.

Google AI Overview was near silent in the first two runs and far more forthcoming in the third, which is where most of its total comes from.

Name	Value	Providers named	Answers
ChatGPT	1102	111	90
Perplexity	634	96	90
Google AI Overview	255	37	90

ChatGPT is the engine where an absence costs most, because 110 other providers were named in its answers and a buyer reading it sees the widest field.

Google AI Overview quadrupled between runs on the same questions, so its level is not a stable target. We report it and would not set a goal against it until a later edition shows whether the third run or the first two is typical.

Which sources do AI answers cite about Canadian cybersecurity?

Provider-owned sites. Eight of the fourteen most cited domains belong to providers, led by paloaltonetworks.com at 20.6 percent of answers.

The 405 answers carried 4,742 citations across 876 domains. Eight of the fourteen most cited are provider sites, and the pages cited are topic guides, comparisons and ranked lists rather than campaign pages. Analyst, review and directory sources fill most of the rest: gartner.com at 13.5 percent, g2.com at 11.6, and mdrproviders.io, a directory nobody in the category owns, at 11.9.

These shares are the proportion of the 405 answers citing at least one page on the domain, so they overlap and do not sum.

Figure 4

Most cited domains

Eight of the fourteen most-cited domains belong to providers themselves.

A provider’s own siteCanadian resellerAnalyst, review, directory or platform

1. 01paloaltonetworks.comPROVIDER20.6%1st of 142.5 points ahead of expel.comCitations104Pages cited50
2. 02expel.comPROVIDER18.1%2nd of 142.5 points behind paloaltonetworks.comCitations109Pages cited49
3. 03microsoft.comPLATFORM16.8%3rd of 14, tied with 13.8 points behind paloaltonetworks.comCitations173Pages cited126
4. 04rapid7.comPROVIDER16.8%3rd of 14, tied with 13.8 points behind paloaltonetworks.comCitations100Pages cited49
5. 05sophos.comPROVIDER16.1%5th of 144.5 points behind paloaltonetworks.comCitations79Pages cited38
6. 06esentire.comPROVIDER14.2%6th of 146.4 points behind paloaltonetworks.comCitations81Pages cited47
7. 07gartner.comANALYST13.5%7th of 147.1 points behind paloaltonetworks.comCitations75Pages cited37
8. 08huntress.comPROVIDER13.2%8th of 147.4 points behind paloaltonetworks.comCitations66Pages cited23
9. 09underdefense.comPROVIDER12.9%9th of 147.7 points behind paloaltonetworks.comCitations58Pages cited30
10. 10cdw.caRESELLER12.6%10th of 148.0 points behind paloaltonetworks.comCitations49Pages cited19
11. 11expertinsights.comEDITORIAL11.9%11th of 14, tied with 18.7 points behind paloaltonetworks.comCitations49Pages cited13
12. 12mdrproviders.ioDIRECTORY11.9%11th of 14, tied with 18.7 points behind paloaltonetworks.comCitations68Pages cited40
13. 13g2.comREVIEW11.6%13th of 149.0 points behind paloaltonetworks.comCitations62Pages cited30
14. 14kaseya.comPROVIDER11.3%14th of 149.3 points behind paloaltonetworks.comCitations37Pages cited9

0%10%20%

Data behind Figure 414 rows · CSV · JSON · PNG

Share of the 405 answers citing at least one page on the domain. The Prompt Group, 4 September 2026.

Type is our own classification, and the measurement treats every provider site the same way, so all of them read as a provider site here.

Domain	Value	Citations	Pages cited
paloaltonetworks.com	20.6%	104	50
expel.com	18.1%	109	49
microsoft.com	16.8%	173	126
rapid7.com	16.8%	100	49
sophos.com	16.1%	79	38
esentire.com	14.2%	81	47
gartner.com	13.5%	75	37
huntress.com	13.2%	66	23
underdefense.com	12.9%	58	30
cdw.ca	12.6%	49	19
expertinsights.com	11.9%	49	13
mdrproviders.io	11.9%	68	40
g2.com	11.6%	62	30
kaseya.com	11.3%	37	9

Authority concentrates in pages rather than domains. microsoft.com needs 126 separate cited pages to reach 16.8 percent of answers, while kaseya.com reaches 11.3 percent from nine and expertinsights.com 11.9 from thirteen.

That suggests a small number of aimed pages can do the work of a documentation library, which is the opposite of how most content programmes in this category are budgeted.

What should a Canadian cybersecurity provider do about this?

Measure each engine separately, and put the buying question on a documentation page rather than a campaign page.

Measure each engine as a separate market. CrowdStrike takes 12.3 percent of mentions on ChatGPT and 6.9 on Perplexity, eSentire 5.3 and 9.5, EY Canada 0.8 and 4.2. A single blended score removes the only variation a provider can act on.

Answer the buying question in documentation. Eight of the fourteen most cited domains are provider sites, and the pages cited are topic guides, comparisons and ranked lists. Campaign pages do not appear in the cited set at all.

A small number of aimed pages beats a library. kaseya.com reaches 11.3 percent of the 405 answers from nine cited pages and expertinsights.com 11.9 percent from thirteen, while microsoft.com needs 126 pages to reach 16.8 percent.

The field is open rather than owned. 176 providers were named and the fifteen most named hold 64.4 percent of 1,991 mentions. A provider outside the top four is competing against a long tail rather than a dominant incumbent.

How was this cybersecurity AI visibility study measured?

45 questions that name no provider, put to ChatGPT, Perplexity and Google AI Overview once per engine per run over three runs on 4 and 5 September 2026, giving 405 answers.

Panel

50 tracked questions written to match what a Canadian security buyer types on the way to a shortlist. The 45 that name no company are the panel for this report; the other 5 are excluded.

What the panel covers

Eight topics, weighted towards detection and response: managed detection and response 24 questions, vendor evaluation 9, implementation and onboarding 7, incident response 7, threat hunting 6, security operations 5, compliance reporting 4, security assessment 4. Questions can carry more than one topic. The panel does not cover identity, cloud posture, email security or penetration testing pricing, so it describes the detection and response shortlist rather than every security budget line.

Unbranded filter

Every figure on this page is drawn from questions that name no provider. A question that names a company will name it back, so mixing branded and unbranded questions inflates whoever the questions mention. Applying the filter moves the numbers: esentire.com falls from the most-cited domain in the full panel to sixth here.

Collection

Three runs. Two on 4 September 2026 five minutes apart, and one on 5 September 2026. Each question asked once per engine per run from a Canadian location. 405 unbranded answers in total, 135 per engine.

Share of provider mentions

A provider’s mentions divided by all provider mentions in the set being reported. A provider named twice in one answer counts once. Sums to 100 percent within a set.

Answers naming a provider

Answers naming the provider at least once, divided by all 405 answers. Two providers can share a share of mentions and differ here.

Average position and sentiment

Position is where the provider appears in the list an answer gives, averaged across the answers naming it. Sentiment is scored from the language around each mention on a 0 to 100 scale, where 50 is neutral.

Answers citing a domain

Answers containing at least one citation to a page on the domain, divided by all 405 answers.

Entity extraction

Providers were identified by automated extraction from each answer. Resellers, consultancies and accounting firms appear alongside product vendors because the answers offer them as alternatives to one another.

Limitations

Three runs across two days, and two of those runs were five minutes apart, so this is closer to two collection moments than three. Answer engines vary run to run and this panel shows how much: Google AI Overview named almost nobody in the first two runs and named providers freely in the third, which is where most of its 255 mentions come from. Read the order of providers below 3 percent as unstable. The panel is 45 questions weighted towards detection and response, so it describes that shortlist rather than the whole security market. The unbranded classification is automated; we checked all 50 questions by hand against the flag and found no disagreement, but a larger panel might.

What do people ask about AI search and Canadian cybersecurity providers?

Which provider each AI engine names in Canada, which sources it cites, and how a provider should measure its visibility, all from the 4 and 5 September 2026 collection.

Written by

Anton Sopov

Founder, The Prompt Group

Anton Sopov is the founder of The Prompt Group, an AI brand strategy and agentic discovery firm. He works with brands on how they are ranked, cited and described in ChatGPT, Claude, Gemini and Perplexity answers, and is the author of The Delegation Curve.

LinkedInXAll reports