Highlights
- The dataset: We analyzed over 110,000 AI source citations from industry-specific prompts across 5 AI models and 12 countries in Q3 2026.
- microsoft.com makes up 8% of ChatGPT's citations, the largest share for a single domain in that model's list.
- 59% of Gemini's citations are from commercial domains, its leading source category.
- France has a 50% local-domain citation rate in non-English prompts, using country-domain endings as the measure.
- About 17% average top-domain overlap: the models draw on different combinations of sources, measured by Jaccard similarity.
Which sources should you target to get cited as a cybersecurity software brand?
Microsoft's main site, ESET, and Microsoft Learn lead ChatGPT's list. Gemini begins with SentinelOne and DeepStrike. Microsoft Copilot puts thectoclub.com first, while YouTube leads both Google AI Mode and Google AI Overview.
| Model | Top five sources | Leading source's share |
|---|---|---|
| ChatGPT | microsoft.com, eset.com, learn.microsoft.com, techradar.com, reddit.com | 8% |
| Microsoft Copilot | thectoclub.com, worldmetrics.org, zipdo.co, tech-insider.org, wifitalents.com | 13% |
| Google AI Overview | youtube.com, google.com, fortinet.com, microsoft.com, sentinelone.com | 6% |
| Google AI Mode | youtube.com, sentinelone.com, fortinet.com, tech-insider.org, immune.institute | 5% |
| Gemini | sentinelone.com, deepstrike.io, immune.institute, pcmag.com, thectoclub.com | 5% |
A cybersecurity vendor should inspect technical documentation, product reviews, and video comparisons separately. Check whether each accurately describes the product's scope and deployment requirements.
How have AI source rankings changed over time in the cybersecurity software industry?
av-comparatives.org rose from #86 to #12, while elpais.com fell from #17 to #784. These are ChatGPT's domain ranks in the first and second halves of Q3 2026.
The change is suggestive rather than proof of a lasting shift. Follow your priority sources in the live industry rankings, checking the period shown before comparing results.
What type of content do AI models cite for cybersecurity software?
Microsoft Copilot has the largest editorial share, at 41% of citations, compared with 16% for Google AI Overview.
The commercial share also differs: 59% for Gemini, compared with 38% for Microsoft Copilot. UGC includes community and review content; Other retains unclassified sources.
Do AI models cite local-language content for cybersecurity software?
France has the highest local-domain citation rate among this study's non-English markets, at 50%. Mexico has the lowest, at 16%. We count domains with an ending that matches the prompt's country.
The country ending is a proxy for local sourcing, not a measurement of language. Locally relevant pages on .com domains are outside this count.
Which AI model relies most on local sources for cybersecurity software?
Google AI Overview has the highest overall local-domain share, at 38% of citations in the reportable non-English market cells. Google AI Mode has the lowest, at 26%.
France shows why the country-level comparison matters: Microsoft Copilot cites local domains at 60%, compared with 40% for Google AI Mode. Compare models within your target country; overall rates also reflect the mix of countries each model covers.
Should cybersecurity software optimize for each AI model separately?
Yes. Their top-source lists overlap by 17% on average, measured as shared domains divided by all distinct domains across each pair's lists (Jaccard similarity). No domain appears in all five models' top 20. Start with the models your audience uses, then compare the sources they cite.
Google AI Mode and Google AI Overview have the highest observed overlap, at 60%; Microsoft Copilot and ChatGPT have the lowest, at 3%. Both figures compare domain sets; they do not measure brand visibility.
How many sources does each AI model cite per answer?
Google AI Overview cites the most sources per answer, averaging 7.4 among answers with at least one citation. Google AI Mode averages 2.8, the lowest of the five.
ChatGPT follows at 5.8 sources per citing answer. Several cited pages can belong to the same website; the chart counts cited source records rather than distinct websites.
Context
We used Temso's AI visibility monitoring data to examine industry-specific prompts across 12 countries during Q3 2026. The study includes ChatGPT, Microsoft Copilot, Google AI Overview, Google AI Mode and Gemini. It covers citations in observed answers, not traffic, conversions, brand recommendation rates, or the quality of the organizations mentioned.
The findings describe the monitored prompts and markets and may not generalize to every buyer question. The industry rankings are a separate view; check their displayed period before comparing them with this quarterly study.
Methodology
How we measured this
The observation window is July 1 through September 30, 2026, using UTC dates and an exclusive October 1 cutoff. We recorded 26,376 responses and 116,550 cited source records across 91 of 92 calendar days. July 9 has no observations. The country set is Argentina, Australia, Canada, Germany, Spain, France, United Kingdom, Italy, Mexico, Netherlands, Sweden, United States.
We rank domains by cited source count, with alphabetical ordering to break ties. Shares use each model's cited sources as the denominator. Category labels come from the domain registry and describe domains rather than individual page formats; unclassified citations remain in Other. The overlap figure is the unweighted average across 10 model pairs, each comparing its top-20 domain sets.
For movement, we split the window on August 16 and rank all cited domains separately in each half for ChatGPT. The chart selects the six largest absolute rank changes among domains present in both halves and in the top 20 of at least one half. Labels show true ranks; line spacing shows relative order among the selected domains. Model coverage varied across the observation window, so the movement finding is read as suggestive rather than proven re-ranking. Prompt and country mix may also affect ranks.
Local-source rates count citations whose domain ending matches the prompt's country, excluding English-language prompts. Country and prompt language remain separate cells; markets that share a language are not merged. Cells require at least 30 citing responses and 50 citations; missing cells are not zero. Overall model rates weight eligible country cells by citation count. The proxy cannot determine content language or capture all locally relevant .com sites.
| Model | Observed days | Answers with citations | Mean cited sources | Nominal 95% CI |
|---|---|---|---|---|
| ChatGPT | 91 | 4,995 | 5.84 | 5.58–6.11 |
| Microsoft Copilot | 91 | 5,374 | 4.21 | 4.16–4.26 |
| Google AI Overview | 91 | 5,153 | 7.43 | 7.33–7.53 |
| Google AI Mode | 83 | 4,153 | 2.80 | 2.78–2.81 |
| Gemini | 88 | 4,140 | 3.58 | 3.53–3.63 |
Source-breadth means exclude answers with no citations. Their intervals use the response as the unit of observation. Repeated prompts and citations within responses are correlated, so these nominal intervals may understate uncertainty. We make no causal or statistical-significance claims. Rounded chart labels are for readability; the underlying calculations retain precision.
Frequently asked questions
Do AI models cite different sources for cybersecurity software?
Yes. Their top-20 lists have an average Jaccard similarity of 17%. Google AI Mode and Google AI Overview are the closest pair at 60%. These percentages compare sets of domains, rather than the proportion of citations shared.
Which AI model cites the most sources per answer for cybersecurity software?
Google AI Overview, averaging 7.4 cited source records per answer with at least one citation, compared with 2.8 for Google AI Mode.
What kinds of websites do AI models cite for cybersecurity software?
Microsoft Copilot has the largest editorial share, at 41% of citations, compared with 16% for Google AI Overview. The commercial share also differs: 59% for Gemini, compared with 38% for Microsoft Copilot.
Does local-language content matter for cybersecurity software in AI search?
Our data measures country-domain endings, so it cannot establish the effect of publishing in a particular language. France has a 50% local-domain rate and Mexico has a 16% rate. Inspect the cited pages themselves when planning language-specific content.
Which AI model relies most on local sources for cybersecurity software?
Google AI Overview has the highest pooled share, at 38% across reportable non-English market cells. The ordering can differ by country; use the market-by-model table for a local comparison.
Did AI source rankings change during the quarter?
av-comparatives.org rose from #86 to #12, while elpais.com fell from #17 to #784. That comparison is within ChatGPT between July 1–August 15 and August 16–September 30. It describes the observed change, rather than predicting what happens next.
Is one AI ranking enough to plan for cybersecurity software?
No. Average top-20 overlap is 17% across model pairs. No domain appears in all five models' top 20. Start with the models your audience uses, then compare the sources they cite.
