Mental vs machine availability: winning the battle for the CISO’s mindshare and the LLM’s answer

If a buyer recalls your brand before they start looking for a solution, you’re already ahead of the game. B2B marketers have subscribed to this principle, known as the ‘Rule of Three’, for decades. When a buyer has a problem to solve, their first search is often in their own head. They’ll typically think of just one to three brands that might be able to help.

In a congested cybersecurity market where every vendor promises zero trust, AI-powered XDR, or the next big thing in threat detection, keeping pace with the noise is a full-time job. For CISOs, when a new threat emerges, their first instinct is still to consult their mental shortlist of trusted security brands.

So is this the be-all and end-all for B2B sales? Not in cyber. Not anymore.

CISOs and security leaders are changing how they research vendors. It’s no longer just about whether your brand comes to mind. It’s also about whether it comes up when a buyer asks AI for advice.

‍

The rise of machine availability

According to Forrester, 94% of enterprise purchases now involve AI tools during vendor evaluation, and our latest study, The Mental Av-AI-lability Index, suggests AI is already deeply affecting which vendors B2B tech buyers consider. Of those who ultimately chose a vendor they hadn’t previously considered, almost a third (32%) discovered that vendor through an AI tool.

That’s significant and shows AI is becoming another way for emerging cyber brands to get onto the shortlist, alongside analyst reports from Gartner and Forrester, industry events such as Black Hat and RSA, and the usual search channels.

Mental availability still matters. In fact, the Index found that 87% of buyers ultimately choose a vendor they already know. So, you need to be one of the brands a CISO thinks of when a problem needs solving to be in with the best shot of winning new business. But, familiarity alone isn't going to fight the battle for you on all fronts: does AI know who you are, what you do and when to recommend you?

That’s machine availability. And if an LLM can’t find enough credible information about your brand, you could miss out before you even get the chance to make your case.

‍

Rethinking visibility

The Index groups brands into four categories: ‘The Titans’, which have strong human recall and high AI recommendation; ‘The Sleeping Giants’, which are well known to CISOs but largely invisible to AI; ‘The Algorithmic Disruptors’, which have lower brand awareness among people but show up strongly in AI-generated answers; and ‘The Untapped’, which have an opportunity to build both.

Until recently, visibility largely meant boosting brand awareness through earned media, ranking in search, getting noticed by analysts and making sure buyers could find you when they were ready to look. These things still count, but they’re no longer the whole story.

Brands need to show up when people search for answers themselves and when they turn to AI to find them. That has a few practical implications.

‍

Bring SEO and GEO together

SEO isn’t going away, but it can no longer do all the heavy lifting. Generative Engine Optimisation (GEO) matters, arguably more so than anything else, as buyers increasingly use AI to research vendors and make sense of the overwhelming scale of choice available to them.

CISOs rarely ask broad questions like “Which cybersecurity platform is best?” They’re more likely to have a specific problem to solve. They might ask an AI tool to recommend lightweight agent solutions for container security in AWS or identify posture management tools that support SOC 2 compliance out of the box.

Research suggests that 86% of B2B buyers would use AI tools during the purchasing process. Rather than simply returning a list of links, generative tools draw on information from different sources to answer questions and help buyers compare their options.

For cybersecurity marketers, the challenge is ensuring their brand appears in those answers. That means creating useful content around the problems buyers are actually trying to solve, from specific threat vectors and compliance requirements to integrations with existing security architectures.

It also means thinking beyond the keywords you want to rank for. What questions are buyers asking? What information do they need to make a decision? And is your expertise visible when they go looking for it?

‍

Create content that works for people and machines

Mental availability is built over time. It comes from having a clear position, knowing what you want to be known for and communicating it consistently. Another study commissioned by Babel found that as many as 68% of B2B technology buyers value consistency in messaging, branding, and ownership across all channels when making a purchase decision.

But a strong message isn't enough if people can’t find the evidence behind it. The same goes for AI tools, arguably even more so given the volume of data rapidly consumed and filtered by LLMs in search of answers.

Cybersecurity companies often put their most valuable content behind lead-generation forms. Whitepapers, threat intelligence reports and detailed CVE analysis can all be gated to capture contact details. That can help generate leads, but it can also limit how easily that expertise reaches a wider audience.

AI tools generally can’t get through forms and sign-up walls. So if your research into a new ransomware strain is locked away, a competitor publishing similar findings openly is more likely to feature in an AI-generated answer.

t’s worth thinking carefully about what you make freely available. Publish useful research, explain complex issues clearly and make your expertise accessible. Give buyers a reason to engage with your content, rather than making them hand over their details before they’ve seen its value.

The aim isn’t to write for machines instead of people. It’s to make your expertise easy for both to find, understand and use.

‍

Build authority beyond your own website

Your credibility isn’t built by marketing claims alone. What others say about you matters, too.

The Index highlights differences in how AI platforms source information. Microsoft Copilot, for example, draws heavily on its own ecosystem, while Perplexity places considerable weight on user-generated content, including Reddit discussions and recent technology media.

That makes your presence beyond your own website increasingly important. Industry commentary, independent research, expert contributions and coverage in respected publications all help build a broader picture of what your business knows and stands for.

There are practical ways to do this. Get your CISO, CTO and security researchers involved in relevant industry discussions. Share research that offers something genuinely new. Comment on emerging threats and give journalists useful insight when a story breaks. Contribute to the conversations security professionals are already having.

These activities help build relationships with the people who influence buying decisions. They also give AI tools more independent sources to draw on when answering questions about your brand and its expertise.

You can’t control exactly which sources an AI tool uses or guarantee that it will recommend your business. But you can give it, and the people using it, more credible information to work with.

‍

Be found, trusted and recommended

Brand building hasn’t become less important. If anything, it’s becoming more important as the ways people discover and evaluate vendors keep changing, especially as LLMs grow more sophisticated and begin to mimic and attach value in the same way that human buyers do.

For cybersecurity marketers, that means looking beyond lead volumes and website traffic. It’s about building a reputation that helps the right buyers find you, understand what makes you different and trust you enough to take the next step.

The brands that stand out won’t necessarily be the ones making the biggest promises. They’ll be the ones with a clear position in the market, a useful point of view and the evidence to back up what they say.

And they’ll need to think about how that reputation translates into AI-generated answers, as well as human conversations.

Start by deciding what you want your business to be known for. Then make sure that message comes through consistently, that your expertise is easy to access and that credible voices beyond your own organisation are helping to tell the story.

The principle remains the same: be easy to find, easy to trust and easy to recommend.

Whether the recommendation comes from a fellow security leader or an AI tool, you need to be in the conversation.

‍