Here's an irony I see often at cybersecurity SaaS companies.
Your product is excellent at blocking bad bots. Your own website uses it, or something like it. And somewhere in the rules, it's also blocking the crawlers that AI search platforms use to read your pages.
Meanwhile, marketing is asking why ChatGPT recommends three competitors for "endpoint detection for mid-sized Canadian companies" and never mentions you.
Kiyado's article on how LLMs choose which sources to cite lists six signals. The sixth is the simplest and the most often broken: access. Engines can't cite pages they can't reach.
If you're positioning against bigger vendors and looking for the best geo agency for cybersecurity saas, this is the first thing they should check. You can check it yourself today.
Start with positioning
Before touching configs, be clear on what you want AI engines to cite you for. In security, generic claims ("enterprise-grade protection") get ignored. Specific positioning gets repeated:
"Example Shield is managed detection and response for Canadian mid-market companies with 200–2,000 employees, with a SOC based in Toronto and data residency in Canada."
That sentence is your target. Every technical fix below exists so engines can read and repeat it.
Step 1: Check robots.txt
The article recommends allowing the crawlers AI platforms use, such as OpenAI's OAI-SearchBot.
curl -s https://www.example-security.ca/robots.txt
Look for blanket disallows or crawler-specific blocks:
User-agent: *
Disallow: /
or
User-agent: OAI-SearchBot
Disallow: /
A reasonable pattern is to allow search-oriented crawlers on public marketing and docs pages while keeping private paths blocked:
User-agent: OAI-SearchBot
Allow: /
Disallow: /app/
Disallow: /portal/
User-agent: *
Disallow: /app/
Disallow: /portal/
Check each AI platform's current documentation for crawler names and what each one does. Some crawlers are for search and citation; others serve different purposes. Decide per crawler, deliberately.
Step 2: Check the WAF and bot management
robots.txt is only a request. Your WAF or CDN decides who actually gets through. Security companies often have aggressive bot scoring that challenges or blocks anything non-human.
Test from outside your network:
curl -s -o /dev/null -w "%{http_code}\n" \
-A "Mozilla/5.0 (compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot)" \
https://www.example-security.ca/product/mdr/
A 403, 429 or a challenge page means the crawler is likely being blocked. Note that user-agent strings can be spoofed, so serious bot management verifies crawlers by published IP ranges or reverse DNS. Use the provider's verification method rather than allowing a user-agent string blindly.
Then add a narrowly scoped rule: verified AI search crawlers, allowed on public marketing and docs paths only. Nothing else changes.
Step 3: Get facts out of PDFs
Security vendors love PDFs: datasheets, compliance summaries, analyst excerpts, solution briefs. The article recommends checking whether key facts sit on HTML pages rather than only inside PDFs.
Find pages that link to PDFs but have little text of their own
curl -s https://www.example-security.ca/compliance/ | grep -o 'href="[^"]*.pdf"'
For each important PDF, put the key facts on the page itself: certifications (SOC 2 Type II, ISO 27001), data residency, supported platforms, response-time commitments. Link the PDF as supporting evidence.
Step 4: Fix consistency
The article's fifth signal: when sources conflict, engines hedge or skip the claim.
Security vendors are prone to this. The website says "24/7 SOC," a partner listing says "business-hours monitoring" (from an old plan), an analyst profile lists last year's product name. Build a facts file and render key pages from it:
product: "Example Shield MDR"
soc_location: "Toronto, Canada"
coverage: "24/7/365"
data_residency: "Canada"
certifications: ["SOC 2 Type II", "ISO 27001"]
target_customers: "Canadian companies with 200–2,000 employees"
Then update marketplace listings, partner pages and review profiles to match.
Step 5: Add verifiable evidence
The article reports that the research that named GEO found the biggest gains came from adding statistics, citations and credible quotes. In security, that means certifications with dates, measured response times (if you publish them), customer counts and named frameworks you align with. Avoid unverifiable superlatives.
Step 6: Measure
Run a fixed set of prompts across ChatGPT, Gemini and Perplexity:
- "Best MDR providers for mid-sized companies in Canada"
- "MDR services with Canadian data residency"
- "What is Example Shield?" Record named, cited and accurate, plus which sources were cited. After fixing access, it can take time for engines to recrawl. Measure monthly. The other signals Access gets you read. The rest gets you chosen: Rankings help less than you'd expect: only about 11% of AI assistant citations matched the top 10 Google or Bing results. Target the sub-questions. Brand mentions outweigh backlinks: 0.664 vs 0.218 correlation across 75,000 brands. Analyst notes, security press and conference talks count. YouTube mentions correlated most strongly of all. Freshness: cited content was 25.7% fresher on average. Keep threat and product pages current. Common objections from security teams "Allowing crawlers increases our attack surface." Scope the rule to verified crawlers, public paths and read-only requests. Your app, portal and API stay behind the same controls as before. "We don't want our content used for training." That's a legitimate choice. Many platforms publish separate crawlers for search and for training, so you can allow one and block the other. Read each provider's documentation and decide per crawler. "Marketing can just publish the facts somewhere else." They can, but your own site is the source you control. If it's unreachable, engines rely on third parties that may be out of date. The point You don't have to weaken your security posture to be visible. You need narrowly scoped, verified access for search crawlers on public pages, and facts that engines can read and trust. Kiyado offers a free audit, including an access check: SEO and GEO for Toronto businesses →
Top comments (0)