Endpoint protection: what AI recommends, Citewake Edition 2 (collected 29–30 Oct 2026)

2Where the AIs disagree

Among the top 15, the brands with the largest gap between the AI that recommended them most and the AI that recommended them least.

3How each AI answers

Gemini answered 21 of 60 questions without running any web search. That is the model Citewake asked, gemini-3.1-flash-lite, through its API with search available. Across all four AIs, 698 searches were run; 31.2% of them included a year. Every page Gemini reported was one it cited, so its pages found and cited match.

5Agreement

On 40 of the 60 questions all four AIs recommended a brand first; they named the same brand first on 5.

6Method in brief

• Questions. 60 scored questions in three tiers (head, mid, tail), written as a buyer would ask them and never naming a brand: 41 decision questions and 18 informational. See the list. A further 15 validation questions are kept private.
• Asking. Each question was asked once of each AI through its official API, with its own web search on and no location sent. Models: ChatGPT: gpt-6-luna; Claude: claude-haiku-5-5; Gemini: gemini-3.1-flash-lite; Perplexity: perplexity/sonar.
• Collection. 29 October 2026, 13:57 – 30 October 2026, 04:18 UTC. 240 valid answers of 240 planned: 200 named at least one brand, 40 named none.
• Reading. One grand master model (Claude Opus 5.5) read the four answers to each question side by side and marked each brand as recommended, mentioned or negative. A brand counts only if its name appears word for word in the answer.
• Measure. Recommendation rate is the share of decision answers in which the AI recommended the brand. The overall rate weights each AI and each tier equally, so it can differ slightly from a raw count. Intervals are 90%, from a cluster bootstrap that resamples whole questions. Here the base is 164 decision answers (41 decision questions, 41 answers from each AI). One popularity question (which brand is most used, not which to choose) is reported apart and never counted in the recommendation rate.
• Method. v0.9, benchmark v1, scoring run 20261030T055048314Z. The full method: citewake.com/methodology.

7Limitations

• One run. Each question was asked once of each AI, in one window of 14 hours 21 minutes. AI answers vary from run to run; the intervals cover variation across questions, not repeat runs.
• English, no market. Questions were in English and no location was sent, so the results describe no particular country.
• Spellings merged. orcasecurity was counted as Orca Security.
• Benchmark figures, not market share. These are benchmark visibility figures across a fixed bank of questions with equal weight per tier, not estimates of market share.
• Top picks are rare. Most answers do not name a single best choice. Even Microsoft Defender for Endpoint was the top pick in only 1.2% of decision answers, so this report ranks by recommendation rate.

8Disclosure

Citewake is operated by the team that also builds aipozi, Biotree and livedot. Biotree and livedot appear in these categories. They were measured by the same method as every other brand, with no adjustment. None of them was named in this category.

9The questions

Each question links to its page, with the four answers in full, the brands read from them and the pages they cited.

10Data

• Every answer: all 240 in full, with the searches each AI ran, the sites it found and cited, and the brands readCSVJSON
• All 281 brands, every measureCSVJSON
• The reportPDF

Licence: CC BY 4.0. Use and share with credit to Citewake.

11How to cite

Citewake. (2026). Endpoint protection: what AI recommends, Citewake Edition 2 (collected 29–30 Oct 2026) (Edition 2) [Data set]. https://doi.org/10.5281/zenodo.23792163

@techreport{citewake-ed2-endpoint-protection,
  author      = {{Citewake}},
  title       = {{Endpoint protection: what AI recommends, Citewake Edition 2 (collected 29–30 Oct 2026)}},
  institution = {Citewake},
  type        = {Edition 2, data set},
  year        = {2026},
  month       = oct,
  version     = {1},
  doi         = {10.5281/zenodo.23792163},
  url         = {https://citewake.com/editions/2/endpoint-protection},
  note        = {Licensed CC BY 4.0}
}