Skip to content

GEO as Attack Surface: When Your AI Visibility Becomes an Adversary's Foothold

By Sa'd Yaghi13 min read

Generative Engine Optimisation (GEO) is how your firm becomes visible to buyers using ChatGPT, Perplexity, Claude and Gemini. The same mechanism is now a live attack surface: academic research published in September 2026 shows attackers can achieve a roughly 50% success rate at making generative search engines misrepresent competitors, and off-the-shelf safety guardrails catch almost none of it. For cybersecurity firms, this is a threat-modelling problem, not a marketing one.

Last updated: 30 September 2026.

1. Why this matters now

Buyer behaviour has moved faster than most security marketing teams have. G2’s 2026 Buyer Behavior Report found that 51% of B2B software buyers now start their research with an AI chatbot more often than with Google, and 71% rely on an AI chatbot for research (up from 60% seven months earlier). A separate 6sense study puts the figure at 94% of B2B buyers using LLMs during their buying process. In cybersecurity specifically, GrackerAI’s 2026 State of AI Search Visibility benchmark found that 73% of tested vendors received zero ChatGPT citations when buyers asked for vendor recommendations.

That last number is the one most agencies quote back. It is not the interesting one. What matters more is what happens once your firm starts being cited. Every citation is a passage of text that a language model has decided is worth surfacing to a buyer. The mechanism by which that citation was earned - content quality, entity signals, third-party mentions, schema - is the same mechanism an adversary can now weaponise against you.

This piece is about that second question. Almost nothing has been written about it from a defender’s perspective. The academic literature exists but sits in ML security conferences, not in security marketing publications. The gap is the point.

2. What “GEO poisoning” actually is

Three papers set the current state of the art. If you are going to talk to a technical buyer about this, know them by name.

Nestaas, Debenedetti and Tramèr (arXiv 2406.18382, June 2024) introduced the term Preference Manipulation Attacks. They demonstrated, on live production systems including Bing, Perplexity, GPT-4 and Claude, that carefully crafted website content or plugin documentation can trick a language model into promoting an attacker’s products and discrediting a competitor’s. Their framing is game-theoretic: once one vendor in a category launches these attacks, every other vendor is incentivised to reply, and the aggregate effect degrades the model’s output for the buyer. This is a prisoner’s dilemma in the marketing layer of the LLM stack.

Zheng, Zhao and Yang (arXiv 2609.02316, September 2026) published Counter-GEO-Bench, the first defence benchmark in this space. Their result is uncomfortable: three off-the-shelf LLM safety filters (Granite Guardian, Llama Guard 3 and NeMo Self-Check Fact-Checking) reduce the attack success rate by at most 5.7% relative, and Granite Guardian’s reduction is not statistically significant. Their explanation is worth reading twice. Safety taxonomies target policy violations, and GEO misinformation passes through them as fluent informational content, because that is exactly what it is.

Li et al. (arXiv 2609.02964, September 2026) measured baseline attack success rate at 50.32% across seven attack methods on two closed-source and three open-source LLMs. Their proposed defence, GEO Defender, brings it down to 6.20%. That is the current best defence in the literature and it exists nowhere in production.

Put those three together and the threat is clear. An attacker who wants to shape how a language model describes a target - a competitor, a category, a specific vendor - can publish ordinary-looking documents that get retrieved and cited. The distortion is fluent, factually adjacent to the source, and invisible to the safety layer. Roughly one in two attempts succeeds.

This is not theoretical. It is the current state of the art of a research field.

3. Three attack scenarios for an Australian MSSP

Abstract threat modelling is not useful. These three scenarios are constructed from the attack patterns in the papers above, mapped to how Australian MSSPs and security consultancies actually get evaluated by buyers.

Scenario one: competitor citation hijacking. An Australian MSSP running a mid-market SOC-as-a-service publishes a comparison blog post: “MDR provider selection for ASX-listed firms.” The post is well-written, cites real frameworks (ACSC Essential Eight, ASD-recognised assessors), and appears legitimate. It is optimised for prompts like “best MDR provider Australia” and “how do I choose an MDR for a listed company.” What it actually contains is a subtle mischaracterisation of the target competitor’s SLA structure and a specific claim about incident-response times that is technically almost-true but structurally misleading. Perplexity and ChatGPT retrieve it and quote from it. The target competitor now has to defend a claim they never made against a buyer they never met.

Scenario two: authority-signal impersonation. An attacker registers a domain that mimics the naming pattern of AISA member firms and publishes a “State of Australian Cyber Insurance 2027” report. The report cites the target vendor’s own case studies verbatim but distorts the reported outcome numbers by 30% each way. The document gets picked up by AI Overviews when buyers ask about vendor track records. The target vendor’s own case studies are now used against them as evidence of a claim they explicitly did not make.

Scenario three: entity-graph confusion. A vendor’s Google Business Profile, LinkedIn Company Page and website all describe the firm slightly differently: different tagline, different service list, different location wording. An attacker exploits the drift by publishing “corrections” and “updated profiles” on third-party directories that AI engines trust. When a buyer asks “what does [vendor] specialise in”, the AI merges the attacker’s version with the legitimate version. The vendor now looks like they contradict themselves across sources, and the AI’s answer picks the wrong specialisation.

None of these scenarios require novel attack techniques. Every one of them is a straightforward application of the published research plus knowledge of the Australian cyber marketing landscape.

4. Why your existing defences do not catch this

A cybersecurity firm reading the above will reach reflexively for the tools it already has. Almost none of them work.

Defence layer What it protects Why it misses GEO poisoning
Web application firewall Site infrastructure Attacks live on the attacker’s site, not yours
Brand-mention monitoring (Brand24, Mention, Meltwater) Media and social Cited passages in AI answers are not indexed as mentions
Standard SEO monitoring (Ahrefs, Semrush) Search rankings Rankings can be fine while AI citations describe you wrongly
LLM safety filters (Guardian, Llama Guard, NeMo) Policy violations, harmful content Distortion is fluent, factually adjacent, passes as normal content
Trademark and legal enforcement Explicit brand misuse Attackers do not misuse your marks; they misrepresent your claims
Perplexity / ChatGPT abuse reports Egregious violations Vendor response cycles are measured in weeks, not hours

The Counter-GEO-Bench result - three production safety layers combined reduce attack success by less than 6% - is the specific evidence that these tools do not compose to a defence. This is a monitoring, detection and response problem that requires its own layer.

5. A defensive framework for cybersecurity firms

A working defence looks like this. It is deliberately structured to map to controls a security team already understands.

  1. Detect. Weekly manual testing of a defined set of buyer-intent prompts across ChatGPT, Perplexity, Claude and Gemini. For each prompt, log the citation, quoted passage, source URL, and any mention of the firm or competitors. This is the equivalent of a light SIEM feed for the AI-answer layer. Twenty prompts per week is enough to detect meaningful drift.

  2. Baseline. Every quoted passage across the four engines forms the baseline of “how the AI describes us today.” Deviation from that baseline is your detection signal. Screenshot every citation. Screenshots are evidentiary when a vendor has to be engaged.

  3. Harden the entity. Consistent naming, description and category tagging across the website, LinkedIn Company Page, LinkedIn founder profile, Google Business Profile, Crunchbase, Clutch AU, G2 AU, ABN Lookup, and any industry directory that appears in AI citations for your category. Entity drift is the vector Scenario Three depends on. Closing it is a one-day project.

  4. Own your own passages. If an AI is going to cite something about your firm, better that it cites a page you control than a page an attacker controls. That means direct-answer paragraphs after every H1 in the exact 40 to 60-word definition-plus-reason-plus-implication pattern the retrieval layer prefers, FAQPage schema on every service page with buyer-prompt-shaped questions, and structured comparison tables where every value is cited to primary sources you can defend.

  5. Third-party citation footprint. The pages that mention you - podcast show notes, guest articles, association directories, media coverage, Reddit answers - are what AI engines cite about you when your own site does not answer the query. A thin third-party footprint means the AI’s next-best source is often a competitor’s page or an aggregator page you have no control over. Building this footprint is slow (six to twelve months), but it is the compounding defence.

  6. Incident response. When a poisoning event is detected: capture the AI response in full, capture the source URL the AI cited, capture the passage that was quoted, and file the abuse report through the specific vendor’s process. Then publish a corrective response on your own site optimised for the exact query that produced the poisoning. This is the layer with the longest cycle time. Plan for it before you need it.

None of this is exotic. All of it is discipline.

6. What to do this week

Five actions, in order of decreasing leverage per hour of work.

  1. Run 20 buyer-intent prompts across the four AI engines once, and record the result. This is your baseline. Every future test measures deviation. If you have never done this, the first hour will surface at least one thing that surprises you.
  2. Audit robots.txt for AI crawler access. GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, ClaudeBot-User, PerplexityBot, Perplexity-User, Google-Extended and CCBot should be explicitly allowed unless there is a specific reason not to. Cybersecurity firms accidentally block these by default. It is the same reflex that blocks any bot.
  3. Add FAQPage schema to your services pages with questions phrased as literal buyer prompts. The passage inside the schema is what an AI engine will lift and cite in an answer. If you own that passage, an attacker cannot displace it easily.
  4. Audit entity consistency across your public surfaces. Website homepage, LinkedIn Company Page, LinkedIn founder profile, Google Business Profile, any directory listings. One authoritative version of trading name, description and service tagline, applied everywhere.
  5. Publish an llms.txt at your domain root listing your pillar pages. This is not enforced by anyone yet, but it is the low-cost equivalent of a signed intent statement and it costs 15 minutes.

Anything beyond this is a program, not a task.

7. Where PayloadFoundry fits

PayloadFoundry runs GEO Baseline Sprints and continuous GEO monitoring for cybersecurity and MSSP firms in Australia. The baseline deliverable includes a 30-prompt measurement across four AI engines (ChatGPT, Perplexity, Gemini, Claude) with three runs per engine, a named competitive benchmark, an AI-crawler accessibility review, schema and entity hardening, and schema deployed on up to 10 existing pages. It is built by a security engineer, on the assumption that the buyer is one too. Details at payloadfoundry.com/services, or book a 30-minute call at cal.com/payloadfoundry/discovery-call.

FAQ

What is GEO poisoning? GEO poisoning is a class of attack in which an adversary publishes web content specifically designed to be retrieved and cited by generative search engines (ChatGPT, Perplexity, Claude and Gemini), so that the resulting AI answers misrepresent a target vendor or category. It was formally studied by Nestaas et al. (2024) as “Preference Manipulation Attacks” and further characterised by Zheng et al. and Li et al. in September 2026.

Is this actually happening in the wild, or is it academic? The Nestaas paper (2024) demonstrated working attacks on production systems including Bing, Perplexity, GPT-4 and Claude. The September 2026 papers measure baseline attack success rates around 50%. Detecting a specific in-the-wild attack requires the monitoring routine described in this piece, and almost no firm has that routine in place, so absence of reports is not evidence of absence of attacks.

Can Australian cybersecurity firms be specifically targeted? Yes. The attack economics favour smaller, higher-consideration purchases with named category queries. That describes the Australian MSSP and cyber consulting market precisely. A category with 30 named vendors and average deal sizes of AUD $100k+ per engagement is exactly where preference manipulation attacks are most rational to launch.

Do standard cybersecurity tools protect against this? Not directly. Web application firewalls, brand-mention monitoring, standard SEO tools, LLM safety filters, and legal enforcement mechanisms all miss GEO poisoning for the reasons detailed in Section 4 above. The Counter-GEO-Bench benchmark (Zheng et al., 2026) measured off-the-shelf safety layers reducing attack success by at most 5.7% relative.

What is the difference between GEO poisoning and search engine poisoning (SEP)? Search engine poisoning historically targeted ranking in ten blue links, where a buyer sees the source domain before clicking. GEO poisoning targets the passage-extraction and citation layer of an LLM, where the buyer sees a synthesised answer with a source attribution they may or may not read. The signal-to-buyer is different, and so is the defence surface.

Do I need to block AI crawlers to defend against this? No, that is the opposite of what to do. Blocking AI crawlers prevents your firm from being cited legitimately, but does not prevent attackers on other sites from being cited when a buyer asks about you. Defence works by making your own site the highest-authority citable source for prompts about you, not by removing yourself from the index.

What is llms.txt and should I have one? llms.txt is a proposed convention (analogous to robots.txt) that publishers use to signal preferred structured content locations to LLM crawlers. It is not enforced by any engine yet, but it costs almost nothing to publish and provides a machine-readable index of your pillar pages. Recommended.

How often should I monitor for GEO drift? Weekly at minimum. A defined set of 20 buyer-intent prompts run across ChatGPT, Perplexity, Claude and Gemini takes about 30 minutes if done manually. Monthly reviews compare the current week’s citations to the prior baseline.

Sources

Ready to grow?

Book a 30-minute discovery call. No pitch deck, no account manager - you talk directly to the engineer doing the work.

Book a discovery call