How we score which cybersecurity firms AI engines actually name
Eight days out from the public launch of the Australian Cyber AI Visibility Index, the question we get most from the first readers of our methodology is a reasonable one. “Is my firm cited by Perplexity today or not” sounds like a yes-or-no answer. In our measurement work it is a four-state answer, and the fourth state is the one most agencies will not tell you about because they do not score it.
The Index goes live at radar.payloadfoundry.com/leaderboard on Tuesday 3 November 2026 at 09:00 AEDT. The full methodology is already published at radar.payloadfoundry.com/methodology. This piece walks through the scoring system in plain language, so that when the first refresh lands you read it against the design rather than guess at it.
Why a yes-no answer hides more than it shows
If you ask Perplexity “Best MDR providers in Australia” and your firm appears as a candidate the buyer should consider, you were cited. If your firm is not in the answer at all, you were absent. Most AI visibility reports stop there, roll the first case up as “visible” and the second as “invisible,” and compress the result into one percentage per engine.
That rollup collapses three distinctions worth keeping.
The first collapse is between CITED and MENTIONED. A firm the engine named as a candidate the buyer should consider is in a different position than a firm whose name appears in the answer but not as a pick, for example as a benchmark the pick was being compared against, or in a passing reference. Both put your name in front of the buyer. Only one puts you on the shortlist. Treating them as the same “visible” bucket hides which one you earned.
The second collapse is between ADJACENT and ABSENT. ADJACENT means the engine named other indexed firms instead of you: it has a view of this prompt and that view did not include your firm. ABSENT means no indexed firm appears in the answer at all: the engine has no live view of this prompt against this cohort. Both score zero, and the Index treats them that way deliberately. But the first is a competitive position you can respond to and the second is a prompt-fit signal. Treating them as the same “invisible” bucket wastes the diagnostic.
The third collapse is across engine mechanics. Perplexity retrieves pages at query time and composes the answer from what it finds. ChatGPT and Claude do not retrieve on buyer-intent prompts and surface firms from training-data recall. These are two mechanisms with two very different time horizons for intervention. A binary “cited yes/no” cannot distinguish them, and if you cannot distinguish them you cannot pick the right intervention.
The Index scores every answer into one of the four states, which gives us forty scored outcomes per firm per refresh (ten prompts across four engines). That is a measurement surface, not a leaderboard rank alone.
The four states, in order
CITED carries a weight of 1.0. The engine named your firm as a candidate the buyer should consider for the query. This is the strongest positive outcome, and the one the headline score is anchored on.
MENTIONED carries a weight of 0.5. Your firm’s name, brand or domain appears in the answer, but not as a candidate the buyer should pick. You might appear as a comparison vendor the real pick was benchmarked against, as a passing reference, or as part of a broader list the engine then narrowed. MENTIONED is worth half of CITED because the buyer still sees your name, but it does not land you on the shortlist.
ADJACENT carries a weight of 0. Your firm is not in the answer, but other indexed firms are. ADJACENT scores zero because it does not put your firm in front of the buyer, but it is a useful diagnostic because it tells you the engine has an opinion on this prompt and that opinion did not include you. The lift from ADJACENT to MENTIONED or CITED usually comes from sharpening on-page entity signal: your firm’s name needs to sit alongside the service term and the region on a page the engine will retrieve or recall.
ABSENT carries a weight of 0. No indexed firm appears in the answer at all. ABSENT also scores zero, but it says something different than ADJACENT. The engine has no live view of this prompt against the Index cohort. That is a prompt-fit or market-reach signal, not a firm-specific one.
The weights (1.0, 0.5, 0, 0) and the rollup are published at radar.payloadfoundry.com/methodology. Both ADJACENT and ABSENT score zero in the headline number, and the per-prompt breakdown is where you read the difference between them.
What the ten prompts look like
The ten prompts the Index scores against are short, specific and category-shaped. Each one pairs a service term or product name with Australia. Three examples from the current list: “Best MDR providers in Australia.” “Managed EDR providers Australia.” “Microsoft Sentinel MSSPs in Australia.”
One invariant across the list: no prompt uses “cybersecurity” as a bare keyword. Real buyers who are already in shortlist mode almost always ask with a specific service term, a product name or a named capability, not the broad category. The list is biased toward the service categories where a vendor shortlist is actionable, not toward exploratory “best cybersecurity company” variants.
The full prompt list is published at radar.payloadfoundry.com/methodology. If your firm serves a segment the ten do not currently cover, we are collecting candidate prompts for the Q1 2027 refresh when the firm cohort expands to twenty-five. Write to Hello@payloadfoundry.com with the segment and we will add it to the review set.
Why four engines, and why not more
The Index measures Claude, ChatGPT, Gemini and Perplexity. These are the four generative AI engines Australian technical buyers are putting their shortlist queries into in late 2026.
We piloted Google AI Overviews in two early cycles and dropped it from the Index on 8 October. Overviews remains measurable through standard SEO tooling, and firms that want to understand their Overviews coverage can read it there.
We also left out the long tail of smaller engines, the ones with vertical specialisations, and the ones that proxy through larger engines. Adding them would widen the measurement surface but would not change the shortlist buyers see in a procurement cycle. The purpose of the Index is to measure the engines that actually produce buyer shortlists, not every engine that exists.
The engine list stays at four until at least the Q1 2027 refresh. The November, December and January refreshes compare apples to apples, so that firms reading month two can distinguish real movement from methodology drift.
What the first refresh on 3 November will show, and what it will not
On launch day, radar.payloadfoundry.com/leaderboard will publish the overall score for every firm in the Index and the per-prompt, per-engine four-state breakdown behind that score. The methodology page at radar.payloadfoundry.com/methodology continues to carry the full prompt list and the per-state weights so every outcome is auditable against a published rubric.
The first refresh is not a trend. It is one scored run on 3 November against the ten prompts, and firms sitting in interesting positions should wait for the December refresh before concluding whether their position is durable. The December refresh is the one that gives you the first month-over-month delta, and that delta is the first signal that an intervention is or is not moving the needle for a given firm.
What the first refresh will tell a firm is which prompts are worth the time and which are not. If your firm scores CITED on a prompt, that prompt is already working and the next question is whether you have adjacent prompts worth adding to your own tracking. If you score MENTIONED, the engine is already reaching for your name but not treating you as a candidate, which is a specific editorial gap. If you score ADJACENT across the board, the engines have a view of your category and did not include you, and the question is which of your competitors did make the list and why. If you score ABSENT on most prompts, the first conversation is not about tactics. It is about whether the ten prompts match the segments you actually serve, and whether a different cohort would be a better fit when the Index expands.
The scoring design is built so that each state tells you a different thing to do next. If you are planning Q4 and Q1 marketing against the Index results that land on 3 November, this is the piece to re-read when the first scores are live.
If you want to be considered for the December cohort of ten firms, write to Hello@payloadfoundry.com with your firm’s name, Australian delivery footprint and the service lines you most want measured. The Q1 2027 refresh takes the set to twenty-five.