What Australian cybersecurity buyers see when they ask AI engines about your firm

The question CISOs, mid-market CTOs and procurement leads now put to Claude, ChatGPT, Gemini and Perplexity is some version of “who should I use for managed detection and response in Australia,” and most Australian cybersecurity firms do not know the answer those engines currently give. Our weekly tracking has shown, run after run, that the gap between a firm’s actual market position and its AI visibility is wide, uneven across engines, and changing fast enough that measuring it once is not enough.

That is why we are publishing the Australian Cyber AI Visibility Index. It goes live at radar.payloadfoundry.com/leaderboard on Tuesday 3 November 2026 at 09:00 AEDT, and refreshes on the third of each month after that.

What the Index actually measures

Five named Australian cybersecurity firms. Four generative AI engines. Ten real buyer prompts.

The firms in the first release are CyberCX, The Missing Link, Triskele Labs, Privasec and Macquarie Cloud Services. We picked them deliberately. They span pure-play consulting, cloud-adjacent managed services, mid-market managed detection and response, and specialist penetration testing, and each has enough public footprint that an AI engine has something to work with. If they are invisible in AI answers, the smaller end of the market has no chance.

The engines are Claude, ChatGPT, Gemini and Perplexity. These are what Australian technical buyers are actually using to shortlist vendors in late 2026. We left Google AI Overviews out of the Index because its answer quality across refreshes has been inconsistent enough that including it would add noise rather than signal, and its retrieval behaviour is already measurable through standard SEO tooling. The four we chose are the engines where visibility is not yet instrumented anywhere else in the Australian market.

The prompts are drawn from real buyer intent, not keyword lists. Questions like “which Australian firms run managed detection and response for mid-market law firms,” “who provides CREST-approved penetration testing in Sydney,” “best MSSP for an ASX-listed company under 500 seats.” Each prompt is run against each engine and the result is scored.

Why these five and not others

We will expand the firm list over the next two refreshes. The December refresh widens the cohort to 10 firms. The Q1 2027 refresh takes it to 25. The starting five are a deliberately small set so the first refresh is defensible rather than noisy.

The criteria for the initial five: Australian-headquartered or with a substantial Australian delivery team, publicly disclosed service lines across managed security, consulting or penetration testing, and enough market presence that at least one engine was likely to name them at baseline.

We ran the baseline on 9 October 2026. The first scheduled refresh is 3 November, and that is the one that sets the first month-over-month comparison. The baseline is a control. It is not yet directional data.

The methodology we are committing to

A monthly cadence, published on the third of each month. The same ten prompts across refreshes. The scoring rubric held constant across engines. The source for each citation recorded so the finding is auditable.

The full methodology is published at radar.payloadfoundry.com/methodology. What matters for now is that we are measuring something that has not been measured publicly in the Australian market, we are measuring it on a schedule rather than as a one-off report, and we are publishing the raw outcomes rather than a derived score we control. If the engines reshuffle in a way that favours or penalises any specific firm, the Index will show it, including when the Index itself gets cited.

Three design decisions worth stating up front. The prompts do not include “cybersecurity” as a bare keyword, because real buyers do not ask that way. The firm scoring is based on named-entity extraction, not sentiment, so a firm named in a cautious or caveated way still counts as visible. And the engine list stays at four until the Q1 2027 refresh so the first two refreshes compare apples to apples.

What the first month of baseline work has already surfaced

Three findings held across the baseline run, and they are worth stating now because they will shape how you read the first live refresh in three weeks.

The gap between the most-cited firm and the least-cited firm is wider than any gap we have measured for Australian marketing agency visibility. The engines are concentrating attention on a very small number of names, and the names that do not make the first-page composition in an engine stay invisible to that engine’s buyers.

The variance between engines on the same firm is larger than the variance between firms on the same engine. In practice this means a firm that leads on one engine can be entirely absent on another, and both outcomes are driven by signals the firm itself has limited control over. Measuring without seeing the per-engine breakdown gives you an average that hides the real picture.

Cloud-adjacent service lines show a lift that pure cybersecurity service lines do not. We will give the mechanism behind that in next month’s refresh notes once the first delta is in. If you run a cybersecurity firm with a cloud or MSP adjacency, this is where you are likely to find your largest visibility asymmetry.

The specific numbers are embargoed until 3 November. We are naming the shape of the result now so that launch-day commentary is read against evidence rather than expectation.

Who the Index is for

Three audiences get something concrete from this.

Marketing leads at Australian cybersecurity firms get a comparator for how their own visibility stacks up against the public cohort, published on a monthly schedule they can plan around. If your firm is not yet in the five, you can run your own current state against our free scan at payloadfoundry.com/scan.

Procurement teams and CISOs doing vendor evaluation get a reality check on what AI engines currently return when their internal stakeholders start with an AI query. If three of your five shortlisted MDR providers are invisible to ChatGPT and Perplexity, that is a procurement intelligence signal, not a vendor quality signal, and you will want to adjust for it.

Journalists and analysts covering the Australian cybersecurity market get a repeatable, time-stamped data source for the “which firms are visible” question, with the methodology and raw prompts documented alongside the scores.

What you can do before 3 November

If you want to see your own firm’s current AI visibility before the public Index refreshes next month, the free scan at payloadfoundry.com/scan runs ten buyer prompts that Radar generates from your firm’s service category, against the same engines the Index uses. Three scans per calendar week during normal operation, with the counter resetting every Monday at 00:00 Sydney time. The launch week of 2 to 8 November has the counter lifted to ten scans so firms can run against the Index on day one. If the week is full, you join a waitlist and get an email on Monday when slots reopen.

If you want to be considered for inclusion in the December cohort of 10 firms, write to Hello@payloadfoundry.com with your firm’s name, Australian delivery footprint and the service lines you most want measured. The December refresh adds 5 named firms. The Q1 2027 refresh takes the set to 25. We will prioritise firms whose service mix lets the Index cover more of the buyer-intent surface, not firms who want a flattering score.

The Index itself goes live at radar.payloadfoundry.com/leaderboard on Tuesday 3 November 2026 at 09:00 AEDT.

See also: How we score which cybersecurity firms AI engines actually name, the methodology deep-dive behind the Index’s four-state scoring.