Month: September 2026

On September 24, 2026, Google began rolling out its September 2026 spam update. Spam updates usually finish in a couple of days, so most site owners are used to a short burst of volatility followed by a clear before and after. This one is different. Google says the rollout may take up to two weeks, which means that for a full fortnight, every ranking change you see is a reading from a moving target.

That changes how you should respond. This piece covers what Google has confirmed, what it has not said, what early volatility data does and does not show, and a practical plan for the days between now and the end of the rollout. It is written for anyone responsible for search engine optimization at their company, whether you run a small site or manage a large content library.

What is confirmed

The core facts come from Google’s Search Status Dashboard and are consistent across Search Engine Land, Search Engine Journal and Search Engine Roundtable.

The update began on September 24, 2026, at 9:15 a.m. Pacific time. It applies globally and to all languages. Google’s dashboard says the rollout may take “up to two weeks to complete”, which puts the latest possible finish around October 8. It is the fourth spam update of 2026, following releases in March, June and August.

The rollout window is what stands out. The dashboard lists the earlier 2026 spam updates at 19 hours and 30 minutes for March, 2 days and 1 hour for June, and 2 days and 16 hours for August. Two weeks is several times longer than any of them. One point of precision matters here: two weeks is the announced maximum, not a measured duration. The update could finish sooner, and until Google marks it complete, nobody outside Google knows how long it will really take.

What Google has not said

Google has not said what this update targets. According to PPC Land, Search Central described it only as a normal spam update, with no new policy, no named category and no figures on how many queries are affected. That gap matters, because much of the commentary this week has filled it with confident claims about which sites are being hit and why. Treat those claims as hypotheses. The only firm statement from Google is that sites which see a change should review its spam policies. Anything more specific is inference from other people’s data.

What early data shows, and what it does not

Search Engine Roundtable reported that a long list of volatility trackers showed significant movement across the first weekend, September 25 to 27. The tools it named include Semrush Sensor, AccuRanker, Mozcast, Sistrix, Algoroo and several others. When that many independent trackers move at once, it is a reasonable signal that something real is happening in the results.

Glenn Gabe, a well-known analyst of Google updates, reported big drops across a number of sites in multiple verticals and countries. He described AI-generated content sites and programmatic content farms as among those losing rankings. That is one experienced observer’s read of the sites he tracks, and it fits how Google’s spam policies treat scaled content, but it is not confirmed by Google and it is not a full picture of who is affected.

There are three reasons to be careful with early data.

First, volatility is not damaging. Trackers measure how much results moved, not who won or lost. A large reading can come from a few sites moving a long way.

Second, the update is not finished, so the pattern on day five may look different by day ten.

Third, you are reading a mix of signals. Seasonal demand, your own recent changes, other Google systems and ordinary news cycles all move traffic at the same time. Attributing a dip to the spam update before it ends is a guess.

What to do while it rolls out

The most useful thing to do during a long rollout is resist the urge to react. Here is a working plan.

Record a baseline. Before anything else, capture your current position. Export Search Console performance data for the last 90 days by page and by query, along with clicks, impressions, average position and the countries you care about. Note recent changes such as redesigns, migrations, new content batches and link campaigns.

Annotate the timeline. Mark September 24 in your analytics and reporting tools, and add a note when Google marks the rollout complete.

Compare like with like. Weekday traffic and weekend traffic behave differently for many sites. Compare the days since September 24 with the same weekdays in earlier weeks.

Segment before you conclude. A sitewide traffic drop is rarely uniform. Split the data by page type, by folder, by template and by query group. If the loss is concentrated in one section, such as a batch of AI-assisted pages or a subdirectory of third-party content, that tells you far more than a total.

Do not make sweeping changes. Deleting hundreds of pages, rewriting templates or disavowing links mid-rollout makes it impossible to tell what caused what. If you suspect a policy problem, plan the fix and stage it.

Fix what is clearly broken. If you find hacked content, injected links, broken redirects or a security issue, fix it immediately.

Hold your publishing rhythm. Search Engine Land’s coverage advises sites that are not affected to keep doing what they were doing.

Audit against Google’s spam policies now

Whether or not you see a drop, this is a good week to check yourself against the policies Google points to. Google’s documentation names categories including cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and links, keyword stuffing, link spam, scaled content abuse, scraping, site reputation abuse, sneaky redirects, thin affiliation and user-generated spam.

Three of these tend to matter most for modern content teams.

Scaled content abuse is about producing large volumes of low-value pages in order to manipulate rankings, whether the pages are written by people, generated by AI tools or scrapped. The test is value per page, not the tool used. A large batch of near-duplicate location pages or templated question pages with thin answers is the pattern to look for.

Site reputation abuse covers publishing third-party content on an established site mainly to borrow its ranking strength. Sponsored sections or partner content hubs on an established site are examples.

Link spam covers buying, exchanging or generating links mainly to manipulate rankings. If you have inherited a backlink profile from a past agency, this is the moment to review it critically, not defensively.

If you find something that fits, note what it is, how many pages it affects and what you would do about it. You need not act during the rollout, but be ready to.

What recovery looks like

If you are affected, it helps to set expectations early. Google’s spam update documentation says that fixing problems may help a site improve if its automated systems learn “over a period of months” that the site complies with its policies. It also warns that for link spam, changes may not bring an improvement, because ranking benefits from those links cannot be regained.

So recovery is not a matter of days, and it is not guaranteed. The right frame is a remediation plan measured in months, not a quick reaction to a bad week.

Spam updates also occasionally catch sites that were not breaking the rules. Search Engine Land notes that this should not typically happen but sometimes does. If you believe you were caught unfairly, audit yourself carefully, document your evidence and keep monitoring.

Why this matters beyond classic rankings

Most teams now think about visibility in more places than the ten blue links. Generative engine optimization and answer engine optimization are about being cited and recommended in AI answers, which draw on the wider web and on search results. No one has published data showing how this specific spam update affects citations in AI Overviews, ChatGPT or Perplexity, and it would be a mistake to claim otherwise.

What can be said is narrower and more practical. Pages that lose organic visibility in Google lose a route to being seen and cited, and the qualities that spam policies punish, such as thin, repetitive, mass-produced content, are also poor candidates for being quoted in an AI answer. Strong search engine optimization, generative engine optimization and answer engine optimization all tend to rest on the same base: original, useful pages that answer a real question well. If you are building visibility for AI search, the spam policies are a sensible floor.

If you track AI citations, set that baseline now too, and compare again after Google says the update is complete.

Where this leaves you

The confirmed facts are these. Google started the September 2026 spam update on September 24, it is global, and it may take up to two weeks. It is the fourth spam update this year and the longest announced window. Google has not said what it targets. Early volatility is real, and some analysts report losses among AI-generated and programmatic sites, but that is observation, not confirmation.

The practical response for any search engine optimization team is patience with discipline. Take a baseline, mark the dates, segment your data, audit your own site against the spam policies, fix genuine defects and hold back on big changes until the rollout ends. A two-week update rewards teams that measure carefully, not teams that react fastest.

Frequently Asked Questions

1. When did Google’s September 2026 spam update start, and when will it finish?
Answer: It began on September 24, 2026, at 9:15 a.m. Pacific time. Google says the rollout may take up to two weeks, so the latest expected finish is around October 8. It could end sooner.

2. Why is this spam update considered the longest of 2026?
Answer: Because the announced window of up to two weeks is far longer than the earlier 2026 spam updates, which the dashboard lists at 19 hours and 30 minutes, 2 days and 1 hour, and 2 days and 16 hours. Two weeks is a maximum, not a confirmed actual duration.

3. What does the September 2026 spam update target?
Answer: Google has not said. It applies worldwide to all languages. Some analysts report ranking losses among AI-generated content sites and programmatic content farms, but that is their observation, not a statement from Google.

4. Should I change my site while the update is rolling out?
Answer: Not in a sweeping way. Record a baseline, annotate the dates, and segment your data. Fix clear defects such as hacked content or broken redirects immediately, but avoid large deletions, rewrites or disavows until the rollout is complete.

5. How long does it take to recover from a spam update?
Answer: Google says recovery can take months, because its automated systems must learn over time that a site follows its spam policies. For link spam, ranking benefits from those links may not return at all, even after cleanup.

6. Does the spam update affect visibility in AI answers?
Answer: No data has been published on that yet. Pages that lose Google visibility lose one route to being cited, and low-value mass-produced content is a poor candidate for citation anyway. Measure AI citations before and after the rollout and compare, and do not draw conclusions from one week.

7. How can I check whether my site is at risk?
Answer: Audit against Google’s spam policies, especially scaled content abuse, site reputation abuse and link spam. Then compare your Search Console data by page type and query group against a 90-day baseline.

If you want to know where your brand appears, and where it is missing, across Google and AI answer engines, that is exactly what we look at in a free AI Visibility Audit.

Several agencies and software vendors now offer a free AI visibility audit, and they are not the same product. Some are self-serve tools that return a preview in seconds. Some are manual reviews run by a strategist. Some are checklists built around a local business. Foreignerds offers one too, and we describe it below. Because the offers differ so much in scope, speed, and who they suit, the most useful thing we can do is explain what a good audit should measure and how to compare the ones you find.

An AI visibility audit tests whether AI answer engines such as ChatGPT, Claude, Perplexity, Google AI Overviews, and Microsoft Copilot mention, cite, and describe your business accurately when someone asks a question you would want to answer. It is different from a traditional search engine optimization audit, which checks how you rank in a list of links. A site can rank well on Google and still be absent from the answers people read in an AI assistant.

What a free AI visibility audit is, and what it is not

An audit is a snapshot. It records how AI systems treat your business for a defined set of questions at a defined moment. It is useful for finding gaps, prioritizing work, and setting a baseline. It is not a ranking guarantee, and it is not a substitute for ongoing measurement.

Free audits are also a way for a provider to start a conversation. That is a fair exchange, provided you know what you are receiving. Before you request one, it helps to know what the findings should contain and whether you keep them regardless of whether you hire the provider.

One caution applies to any audit, free or paid. AI answers can differ from one run to the next and from one platform to the next. A single screenshot of one prompt is weak evidence. A credible audit uses a set of prompts, tests each platform separately, and reports patterns.

What a useful audit should measure

Whatever the provider, a useful audit covers a handful of things.

Citations and mentions. A citation is a link to your site inside an AI answer. A mention is your business name appearing without a link. They are different signals, and a business can have one without the other.

Share of voice against competitors. Knowing that you appear is less useful than knowing who appears instead of you for the same question.

Accuracy. AI systems sometimes state wrong facts about a business, such as outdated services, incorrect locations, or invented details. An audit should check what is being said, not only whether you are named.

Content structure. Pages that answer questions clearly, with direct answers, headings, and lists, are easier for AI systems to extract from. An audit should review the pages that matter most to revenue.

Structured data. Schema markup helps machines understand who you are and what you offer, so gaps here are worth listing.

Third-party footprint. Reviews, directories, press coverage, and community discussion shape what AI systems say about you. This is often the most overlooked part, and the research below explains why it matters.

Why each platform has to be tested separately

If one provider tells you that you are visible in AI search, ask which platforms they tested. The evidence suggests platforms behave differently enough that a single result does not transfer.

Averi’s benchmark report, citing a Profound analysis of 680 million citations collected between August 2024 and June 2025, states that only 11% of domains are cited by both ChatGPT and Perplexity. That is a domain-level figure across the whole citation landscape, not a statement about your own brand, and different studies define overlap differently. The direction is consistent, though: the two platforms draw on different sources.

Ahrefs found a similar divergence from another angle. In an analysis of 15,000 long-tail queries published on August 11, 2025, only 12% of URLs cited by ChatGPT, Gemini, and Copilot also ranked in Google’s top 10 for the same prompt. Perplexity was the exception, with 28.6% overlap. Ranking on Google is not the same as being cited in an AI answer.

Slate HQ’s 90-day study of six B2B software brands shows the same spread at brand level. For one email security client, brand-owned citation share ranged from 4.5% on ChatGPT to 10.2% on Google AI Mode. That is a single client’s result and not an average, but the gap between platforms for the same brand is the point.

The practical consequence is simple. An audit that tests only one platform, or blends all platforms into a single score, hides the variation you most need to see.

Why third-party sources belong in the audit

A research paper by Chen, Wang, Chen, and Koudas, submitted in September 2025, classified the sources AI systems cite as earned media, brand-owned, or social. In its consumer electronics tests, about 93.6% of ChatGPT’s citations and 93.7% of Claude’s came from earned media, meaning third-party sources. Perplexity and Gemini drew a smaller share from earned media and more from brand-owned and social sources. The paper is a preprint and covers consumer product queries, so it does not guarantee the same mix for a services business.

Slate HQ’s study adds context: it found that 76.3% of citations across its tracked brands went to domains that were neither the brand nor its direct competitors. Together, these findings mean an audit that reviews only your own website misses a large part of the picture. What others publish about you matters, which is why generative engine optimization work reaches beyond your own site, and an audit should say where you appear, where you do not, and which third-party sources AI systems already trust in your category.

Three kinds of free audit you will find

Descriptions below come from each provider’s own website at the time of writing. Offers change, so confirm the details before you request one.

Self-serve tools. Ahrefs offers a free AI visibility checker that needs no signup. It queries ChatGPT, Gemini, Perplexity, Copilot, and Google AI Overviews and returns total mentions, a platform breakdown, top associated topics, and top cited domains. The free version is a limited preview, with results capped at five items per section, and historical tracking and competitor benchmarking sit in a paid product. It is a quick way to see whether you register at all.

Manual agency audits. DerivateX runs a free audit by hand through a senior strategist, covering ChatGPT, Perplexity, Gemini, Claude, Google AI Overviews, and AI Mode. It says results arrive within 48 business hours of confirming fit, and that findings remain with you whether or not you hire the agency. It states the audit suits B2B software companies with roughly $5 million to $50 million in annual recurring revenue and is not suited to e-commerce, local, or consumer businesses.

Business-type checklists. LocalFi offers a free audit built around local search signals. It reviews website structure, service pages, location pages, Google Business Profile, content clarity, entity signals, reputation markers, and search presence across ChatGPT, Gemini, Perplexity, and Google AI Overviews. It describes timing as dependent on the website and scope.

These are different tools for different jobs. A quick self-serve check tells you whether to worry. A manual audit tells you what is being said and who is being recommended instead. A local checklist focuses on the signals local searchers rely on.

What the Foreignerds free AI Visibility Audit covers

Our free AI Visibility Audit tests five platforms individually: ChatGPT, Claude, Google AI Overviews and AI Mode, Perplexity, and Microsoft Copilot. It measures seven things: citation rate, brand mention rate, AI share of voice against named competitors, sentiment and accuracy of what AI says about you, content extractability, structured data coverage, and third-party brand footprint.

The deliverables are an overall visibility score benchmarked against three to five competitors, a custom test set of 20 to 30 buyer prompts, a platform-by-platform breakdown, a check for inaccurate statements, a schema and structured data gap report, a prioritized 90-day action plan ranked by revenue impact, and a live dashboard for tracking citation rate and share of voice over time.

It runs over four weeks. In week one we set the baseline and map the prompts. In week two we audit five to ten of your highest-priority revenue pages. In week three we review schema, entity consistency, and third-party footprint. In week four we deliver the report and a live walkthrough. It is free with no obligation.

The trade-off is time against depth. Four weeks is slower than a tool that answers in seconds or a review that returns in two days. It covers more dimensions than a quick preview, and it is built around your own buyer questions and competitors. Which fits depends on how much detail you need and how soon.

How to compare offers

Whichever provider you consider, these questions separate a useful audit from a sales form.

Who chooses the prompts? Strong prompts come from real buyer questions in your market, not generic ones.

How many platforms are tested, and are they reported separately? Blended scores hide the differences described above.

Are competitors benchmarked? Visibility is relative.

Does the audit check accuracy? Being mentioned incorrectly can be worse than not being mentioned.

Does it look beyond your website? Third-party footprint should be part of the review.

What do you keep? Confirm that you receive the findings without a commitment.

Who runs it, and how long does it take? Automated, manual, and hybrid audits differ in speed and judgment.

Is there a sample or a clear description of the report? If a provider cannot describe what you will receive, treat that as a warning.

Where this leaves you

A free AI visibility audit is a reasonable first step if you treat it as a baseline. Pick one that tests platforms separately, uses your own buyer questions, benchmarks competitors, checks accuracy, and looks past your own site. Then use the results to decide where to invest, whether that is content structure, third-party coverage, or wider generative engine optimization and answer engine optimization work. Repeat the check on a schedule, because the answers change.

Frequently Asked Questions

1. Which agencies offer a free AI visibility audit?
Answer: Several do, along with software vendors. They differ in scope: some are self-serve tools, some are manual reviews, and some are aimed at specific business types. Foreignerds offers a free AI Visibility Audit covering five platforms and seven measures over four weeks.

2. What does an AI visibility audit measure?
Answer: A useful audit measures citations, brand mentions, share of voice against competitors, accuracy of what AI says about you, content structure, structured data, and your third-party footprint.

3. How is it different from an SEO audit?
Answer: A traditional search engine optimization audit checks how you rank and perform in search results. An AI visibility audit checks whether AI systems mention, cite, and accurately describe you in their answers, which makes it a core input to answer engine optimization.

4. Why test each AI platform separately?
Answer: Platforms cite different sources. One study found only 11% of domains were cited by both ChatGPT and Perplexity, so a result on one platform does not predict another.

5. Is a free audit really free?
Answer: Offers vary, so confirm what you keep and whether there is any obligation. Foreignerds’ audit is free with no obligation.

6. How often should I repeat an audit?
Answer: AI answers change, so a periodic check against your original baseline is sensible. A quarterly review is a reasonable starting cadence, and a tracking dashboard can help between audits.

If you want to see how ChatGPT, Claude, Perplexity, and Google describe your business today, request your free AI Visibility Audit from Foreignerds.

PPC (pay-per-click) and paid media are the practice of buying visibility — on Google, Meta, LinkedIn, Amazon, or elsewhere — instead of waiting to earn it organically, paying only when someone clicks, views, or takes an action you define. Where SEO and content compound over months, paid media is the lever that produces leads and revenue on a schedule you control, starting the day a campaign goes live. That immediacy is also why it’s the easiest channel to waste money in: the platforms are built to spend your budget efficiently for the platform, not necessarily for your business, unless someone is actively managing the account. This guide covers what paid media actually costs and returns right now, the platform-by-platform decision, where budgets get wasted, and a practical framework for running it well.

What Counts as Paid Media

Paid media isn’t one channel — it’s a category, and each platform serves a different intent:

• Search ads (Google Ads, Microsoft Ads): capture people already searching for what you sell. Highest intent, highest cost per click.
• Paid social (Meta, Instagram): reach people based on interests and behavior before they’re actively searching. Lower cost per click, but requires a stronger creative hook since the audience isn’t already looking.
• LinkedIn ads: the only platform with reliable B2B firmographic and job-title targeting — expensive per click, but the only place to reach “VP of Operations at a 50-person accounting firm” directly.
• Amazon and marketplace ads: capture purchase-intent search traffic inside the marketplace itself, for businesses selling physical products.
• Display and programmatic: broad-reach retargeting and brand awareness, usually the smallest and last-added piece of a paid media mix, not the first.

Most businesses don’t need all five — they need the one or two that match where their buyer actually is, layered with retargeting once there’s enough traffic to retarget.

The Real Numbers (2026 Benchmarks)

Current Google Ads benchmark data, based on an analysis of over 13,000 campaigns across 23 industries, gives an honest baseline before anyone quotes you a number:

• Average click-through rate: 6.64% across industries
• Average cost per click: $5.42 (more than doubled from $2.32 in 2016, but stable year-over-year for the first time in five years)
• Average conversion rate: 8.18%, with 87% of industries seeing conversion rates improve year-over-year — the second straight year of gains
• Average cost per lead: $66.69 — and for the first time in five years, this actually went down rather than up
• Highest-cost vertical: Attorneys & Legal Services, at $9.87 CPC and $131.63 cost per lead — a useful reference point for professional-services budgeting

These are averages, not promises — a well-run HVAC campaign and a poorly-run law firm campaign can each land far from the mean. But they’re the right numbers to benchmark against before accepting any agency’s promised cost-per-lead.

Platform-by-Platform: What Fits Which Business

Business type	Primary platform	Why
Home services (HVAC, plumbing, roofing)	Google Search + Local Services Ads	Buyers search with emergency or near-term intent — “AC repair near me” — the exact moment search ads capture
Small B2B professional services (CPAs, law firms, consultants)	Google Search + LinkedIn	Search for active demand (deadline-driven searches), LinkedIn for outbound-style targeting by title/company size
E-commerce / physical products	Meta + Amazon Ads	Visual discovery drives impulse and considered purchases; Amazon captures in-marketplace purchase intent directly
Agencies/white-label	Whatever the end client’s buyers use	Platform choice inherits from the client’s ICP, not the agency’s preference

Foreignerds runs all of these as distinct services rather than one generic “paid ads” offering: AI-powered PPC for search, Meta ads management, LinkedIn ads management, and Amazon marketplace ads — because the skill set, bidding logic, and creative requirements genuinely differ platform to platform.

Where Paid Media Budgets Actually Get Wasted

• No conversion tracking, or broken tracking. A campaign optimizing toward the wrong goal (or no goal) will spend efficiently toward the wrong outcome. This is the single most common issue found in account audits.
• Sending paid traffic to a generic homepage instead of a matched landing page. A click that cost $5.42 landing on a page that doesn’t answer the exact search intent is a wasted click regardless of how good the ad was.
• Fragmenting budget across too many campaigns. Ad platforms need enough conversion volume per campaign to exit the learning phase and optimize properly — splitting a small budget across five campaigns means none of them ever learn.
• Ignoring negative keywords (search) or audience exclusions (social). Without them, budget leaks to searches and audiences that were never going to convert.
• No connection between paid media and CRO. Driving more traffic to a page that converts at half the rate it should is buying clicks to compensate for a fixable landing-page problem instead of fixing it.
• Treating campaign launch as the finish line. Accounts that aren’t reviewed weekly for search-term reports, bid adjustments, and creative fatigue decay in performance within a month or two.

A Practical Implementation Framework

1. Fix tracking before spending a dollar. Confirm conversion actions (form fills, calls, purchases) are firing correctly and connected to the ad platform, not just Google Analytics.
2. Start with one platform, matched to buyer intent — search for active-demand businesses, social for visual/considered purchases, LinkedIn for named-account B2B — rather than spreading a first budget across three platforms at once.
3. Build a landing page matched to the ad’s specific offer, not a link to the general site. This is where CRO work pays back the paid spend.
4. Let campaigns exit the learning phase before judging them. Most platforms need meaningful conversion volume in the first 1–2 weeks before performance stabilizes — judging a campaign at day 3 is judging noise.
5. Layer in retargeting once there’s enough traffic to build a meaningful audience — retargeting consistently converts cheaper than cold traffic, but needs volume to work.
6. Route qualified leads into marketing automation immediately so a paid lead gets an instant response rather than waiting for a rep to notice a form fill — the gap between click and follow-up is where paid spend gets wasted after the click, not before it.
7. Review weekly, restructure monthly. Search-term reports, audience performance, and creative fatigue all need a standing weekly check — not a “set it up once” mentality.

How to Measure Whether It’s Working

• Cost per qualified lead — not cost per lead. A cheap lead that never converts to revenue is not a win.
• Return on ad spend (ROAS) or cost per acquisition, tied to actual closed revenue, not platform-reported conversions alone.
• Conversion rate by landing page — benchmark against the 8.18% average conversion rate figure above to see if a specific page is underperforming.
• Search term quality — what people actually typed before your ad showed, reviewed monthly to catch wasted spend on irrelevant queries.
• Lead-to-close rate by channel — Google Search leads, Meta leads, and LinkedIn leads typically close at different rates and deserve separate tracking, not one blended number.

Paid Media by Business Type

• Home services: Google Search plus Local Services Ads for emergency and near-term intent, with tight geo-targeting and call tracking since phone calls, not form fills, are usually the primary conversion.
• Small B2B professional services: Google Search for deadline-driven and problem-aware searches (tax season, “need a lawyer for…”), LinkedIn for proactively targeting decision-makers who aren’t searching yet.
• Agencies and white-label partners: paid media is frequently the fastest-to-prove-value service to offer a new client, since results are visible within weeks rather than the months SEO takes — making it a common first engagement in a broader growth marketing relationship.

Key Takeaways

• 2026 Google Ads benchmarks: 6.64% average CTR, $5.42 average CPC, 8.18% average conversion rate, $66.69 average cost per lead — the first year-over-year decline in CPL in five years.
• Match the platform to buyer intent first: search for active-demand businesses (home services, deadline-driven B2B), social/LinkedIn for considered or named-account buying, Amazon for marketplace purchase intent.
• Broken conversion tracking and mismatched landing pages waste more budget than bad targeting does — fix those before touching bids.
• Judge campaigns after they exit the platform’s learning phase, not on day 3.
• Route every paid lead into an automated follow-up sequence immediately — the gap between click and response is where spend gets wasted after the click.

Marketing automation is the use of software to trigger, sequence, and personalize marketing actions — emails, SMS, ad audiences, lead scoring, CRM updates — based on a contact’s behavior, without a human manually sending each one. Done well, it turns a static list of leads into a system that nurtures every contact on its own schedule, hands sales only the leads worth calling, and keeps customers engaged after the sale closes. Done poorly, it’s an expensive email tool nobody customized past the default templates. This guide covers what marketing automation actually does, what it’s worth, where most implementations go wrong, and how to build one that pays for itself.

What Marketing Automation Actually Does

At its core, marketing automation replaces three manual jobs with rules: deciding who gets contacted, deciding when, and deciding what they see. A platform sits on top of your website, CRM, and ad accounts, watches for triggers — a form fill, a pricing-page visit, a cart abandonment, an inactive 90 days — and fires a pre-built sequence in response. The categories that matter for most businesses are:

• Lead nurturing: multi-step email/SMS sequences that move a new lead from “just downloaded a guide” to “booked a call,” without a rep touching it until it’s warm.
• Lead scoring and routing: assigning points for behavior (page visits, email opens, form fills) so sales only gets pinged when a lead crosses a real threshold, instead of every form submission.
• Lifecycle and retention marketing: onboarding sequences, renewal reminders, win-back campaigns for lapsed customers, review requests after a job completes.
• Ad audience automation: syncing your CRM segments (past customers, high-intent leads, churned accounts) into Meta and Google as living audiences instead of manually uploaded lists.
• Internal workflow automation: auto-creating CRM tasks, notifying a rep by Slack or SMS, updating a deal stage — the operational glue most people don’t think of as “marketing” but is where automation saves the most staff hours.

If you already have a lead generation engine bringing in volume, automation is what decides whether those leads convert or go cold in an inbox nobody’s watching.

What It’s Actually Worth: The Real Numbers

Marketing automation is one of the more evidence-backed categories in digital marketing — the data isn’t hype, and it doesn’t require guessing:

• Forrester Research has found that B2B organizations using marketing automation to nurture leads generate $5.44 to $6.10 in ROI for every $1 spent on the platform.
• Companies that nurture leads with automated sequences see a 451% increase in qualified leads compared to sending a single generic follow-up.
• Automated, behavior-triggered emails generate 320% more revenue than one-off broadcast emails sent to an entire list at once.

Those numbers hold up because automation fixes the specific failure mode most small and mid-sized businesses have: leads come in, get one follow-up email or call, and then nothing happens unless someone remembers to circle back. Automation removes the “remembering” step entirely.

The Platform Landscape

Marketing automation platforms fall into three tiers, and picking the wrong tier is the single most common expensive mistake:

Tier	Examples	Best fit	Typical monthly cost
All-in-one CRM + automation	HubSpot, GoHighLevel, ActiveCampaign	Home services, small B2B, agencies managing multiple clients	$50–$800+
E-commerce-focused	Klaviyo, Omnisend	DTC and e-commerce brands running abandoned-cart and post-purchase flows	$45–$1,000+ (scales with contacts)
Enterprise marketing clouds	Marketo, Salesforce Marketing Cloud, Pardot	Larger orgs with dedicated marketing ops staff	$1,000–$15,000+

Most home services businesses, CPAs, law firms, and consultants are correctly served by an all-in-one platform — they need automation bundled with a CRM and pipeline, not a standalone email tool that requires a separate system for everything else. Agencies managing several client accounts often standardize on one all-in-one platform (commonly GoHighLevel) specifically because it supports white-labeling and sub-account management.

The Mistakes That Waste the Investment

Most failed marketing automation projects don’t fail because of the software — they fail because of how it was implemented:

• Automating a broken process. If your sales follow-up is inconsistent, automation just makes the inconsistency happen faster and at scale. Fix the process, then automate it.
• No lead scoring, so sales drowns in noise. Every form fill hitting a rep’s phone trains them to ignore the automation entirely within a month.
• Set-and-forget sequences. A nurture sequence built once and never revisited decays as your offers, pricing, and messaging change. Automation still needs a quarterly review.
• Buying enterprise software for a five-person team. Marketo and Salesforce Marketing Cloud are built for dedicated marketing ops departments — a small business buying one usually uses 10% of the platform and pays for the other 90%.
• Treating automation as “set it and it replaces marketing.” Automation amplifies content and offers that already work. It does not generate demand on its own — that’s the job of content marketing, paid media, and SEO feeding the top of the funnel.

A Practical Implementation Framework

The businesses that get the Forrester-level returns follow roughly the same build order:

1. Map the actual customer journey first. Write down every stage a real lead goes through — first touch, quote/consultation, decision, onboarding, renewal or repeat purchase — before opening any software.
2. Start with the highest-leverage sequence, not the whole system. For most businesses that’s new-lead nurture (the gap between form-fill and first contact) or cart/quote abandonment. Build one sequence well, measure it, then expand.
3. Build lead scoring around actual buying signals — pricing page visits, demo requests, repeat site visits — not vanity engagement like email opens alone.
4. Connect the CRM and ad platforms so segments sync automatically. A “closed-won” list that updates your Meta and LinkedIn exclusion audiences in real time stops you from paying to re-target people who already bought.
5. Set a review cadence. Sequences, scoring thresholds, and copy get revisited quarterly — automation is infrastructure, not a one-time project.
6. Measure against revenue, not opens. Open rate and click rate are diagnostic metrics. The metric that matters is leads converted to booked calls/quotes and dollars closed per sequence.

Build, Buy, or Managed?

Three ways to get a marketing automation system running:

• DIY inside an existing tool. Works if you already have marketing staff with time to build and maintain sequences. Most small teams underestimate the ongoing maintenance and let it decay after month two.
• Buy and configure with an agency. An agency sets up the platform, builds the initial sequences and scoring model, and hands over a working system with documentation — the most common path for businesses without a dedicated marketing ops person.
• Fully managed. The agency owns ongoing sequence updates, A/B testing, and reporting as part of a retainer — best for businesses that want the ROI without building internal automation expertise. This is how Foreignerds runs marketing automation and growth marketing engagements: platform setup, sequence build, and ongoing optimization bundled together rather than sold as a one-time configuration.

How to Measure Whether It’s Working

Track these, in this order of importance:

• Lead-to-qualified-lead rate before and after implementing scoring — this is where the 451% figure shows up in practice.
• Sequence-attributed revenue — dollars closed from contacts who went through an automated nurture path versus those who didn’t.
• Response time to new leads — automation should cut the gap between form-fill and first meaningful contact from hours/days to minutes.
• Sequence completion and drop-off — where in a nurture flow people unsubscribe or stop engaging, which tells you where the messaging is off.
• Customer lifetime value for automated vs. manual onboarding/retention cohorts, once you have enough volume to compare.

These should tie back into the same reporting used for conversion rate optimization — automation and CRO are solving the same problem (more revenue from the same traffic) from different ends of the funnel.

Marketing Automation by Business Type

The right sequences differ meaningfully by vertical:

• Home services (HVAC, plumbing, roofing): the highest-value automation is missed-call and quote-follow-up sequences — a lead who doesn’t get a callback within minutes typically calls a competitor next. Seasonal maintenance reminders and review-request sequences after job completion are the next highest-leverage builds.
• Small B2B professional services (CPAs, law firms, consultants): automation centers on intake-to-consultation nurture, deadline-driven campaigns (tax season, renewal periods), and client onboarding sequences that reduce the manual admin load on a small team.
• Agencies and white-label partners: automation is the product as much as the marketing — a platform like GoHighLevel with sub-accounts lets an agency deliver automation as a packaged service to its own clients while managing dozens of accounts from one system.

Key Takeaways

• Marketing automation returns $5.44–$6.10 per $1 spent when built around real buying signals, per Forrester — but only when the underlying process being automated already works.
• Automated nurture sequences produce a 451% increase in qualified leads and automated triggered emails generate 320% more revenue than one-off broadcasts.
• Match the platform tier to team size: all-in-one CRM platforms fit most home services and small B2B businesses; enterprise marketing clouds are usually overkill below a dedicated marketing ops team.
• Start with one high-leverage sequence (new-lead nurture or abandonment recovery), measure it, then expand — building the whole system at once is how most implementations stall.
• Measure sequence-attributed revenue and lead-to-qualified-lead rate, not email opens, to know if it’s actually working.

For the last two years, enterprise AI has mostly been sold as a feature: a chatbot in the corner of a screen, a summarize button, an assistant that answers one question at a time. On September 11, 2026, Salesforce made a different kind of pitch. It introduced seven named Agentforce agents, each built for a specific job, and described one of them as able to pursue a goal across weeks instead of a single conversation.

The naming is not a cosmetic detail. It signals a shift in how vendors want buyers to think about AI: less as software you configure and more as labour you deploy. This piece follows on from our earlier look at MCP and A2A governance, and it covers what Salesforce announced, what its customer results do and do not show, and what a buyer should ask before treating an AI agent like an employee.

What Salesforce announced

According to Salesforce’s announcement and coverage from Unite.AI and Startup Fortune, the seven agents and their jobs are as follows.

Casey is a help agent for customer service, working across voice, SMS, WhatsApp, and web chat. Paige handles IT and HR requests for employees, including through Slack and employee portals. Carter is a shopper agent that helps with product discovery, comparison, and checkout. Marshall is a supply chain agent that orchestrates back-office processes with audit trails. Piper handles inbound lead generation, engaging and qualifying leads for B2B sales. Fin is a customer agent that resolves complex customer-experience workflows. Hunter is an outbound sales agent that manages a pipeline from research through outreach.

Availability differs. Six of the seven, Casey, Paige, Carter, Marshall, Piper, and Fin, are generally available now. Hunter is in pilot, with general availability planned for November 2026.

Hunter is also the agent that uses a new long-horizon runtime. Salesforce describes it as built on three capabilities: memory, which preserves context across sessions; durable execution, which keeps a plan running over time; and dynamic steering, which adapts behavior based on feedback from users. The point of the runtime is that an agent can work toward a goal across days and weeks, instead of finishing one task and forgetting it. Hunter is the first agent to run on it.

The announcement included other platform pieces. Multi-Agent Orchestration, which routes work across coordinated teams of agents, is generally available. Agentforce Coworker, an employee-facing agent with AI Skills, and Agent Optimizer, a tool for refining agents, are scheduled for general availability in October 2026. Salesforce also introduced Agent Script, an open-source language for defining agent behavior with deterministic rules, which matters because it gives builders a way to fix certain steps in place instead of leaving everything to the model. None of the coverage we reviewed gave pricing.

How long the memory lasts

Some headlines around this launch describe agents with months of memory. The sources we reviewed do not support that. Salesforce’s own description is days and weeks. That is still a meaningful change, but the difference matters when a buyer is estimating how long an agent can hold onto a plan.

The customer results, and why to read them carefully

Salesforce published six customer results with the launch. All of them are reported by Salesforce, and none of the coverage we reviewed included independent verification or a definition of how each metric was measured.

Engine reported that 50% of chat inquiries are fully resolved by its help agent, which it calls Eva. Perk reported that Hunter built 60% of its sales pipeline. Autism Queensland reported that Paige resolves 70% of administrative requests. Hibbett reported that an agent handles 90% of core shopper journeys, after going live in six weeks. Asana reported 4x conversation volume driven by Piper. Anthropic reported that Fin resolves 79% of conversations autonomously.

These are useful as directional evidence. They are not benchmarks, and four things are missing that any buyer should ask about.

The first is definitions. Resolved could mean that a customer got a correct answer, or it could mean that the conversation ended without escalation. Those are very different outcomes. The second is baselines. Fifty percent resolved means more or less depending on what was resolved before the agent arrived. The third is scope. A figure for one team, one region, or one channel may not transfer to your business. The fourth is selection. Vendors highlight their strongest results, so a set of six published numbers says little about the distribution of outcomes across all customers.

There is one specific point on Perk. Hunter is still in pilot, so that result necessarily comes from early use, not a generally available product. Startup Fortune’s coverage made the same overall point, describing the results as early evidence and not a guarantee.

The governance layer was announced separately

Coverage of this launch sometimes lumps the AI Control Plane in with the seven agents. It was announced separately, one day earlier, on September 10, alongside what Salesforce calls a Trusted Enterprise AI Harness.

According to AI Weekly, the control plane provides routing, lineage, and cost and observability across both Salesforce and third-party AI, and it is positioned as a governance layer over a multi-vendor agent landscape. An analyst blog covering Dreamforce described it as a central registry of agents, MCP servers, and APIs with automatic discovery and a single gateway for model, MCP, and agent calls, and said it is designed to cover agents beyond Salesforce’s own.

Two cautions apply. AI Weekly reported that most capabilities are live while the rest are scheduled for fiscal year 2028, so buyers should not assume everything described is available today. And the same analyst blog noted that the control plane was initially previewed in 2025, which suggests some of it is an evolution of earlier work and not new this month. Neither source gave a general availability date for the full set.

A registry of agents, MCP servers, and APIs is exactly the kind of inventory that AI governance requires. It is also a reminder that governance products from a platform vendor cover that vendor’s view of the world first, so a company running agents from several suppliers should test how well the third-party coverage actually works.

Why names and job titles matter

Giving an agent a name and a role is a marketing decision, and it is also a framing decision. A named agent with a job title invites the same expectations we place on a person in that role: that it owns an outcome, that someone is accountable for it, and that it can be evaluated like a hire.

That framing has real benefits. It gives buyers a clearer mental model than a generic assistant. It pushes vendors to tie agents to measurable jobs such as resolving support tickets or qualifying leads, which is what sensible AI automation projects do anyway. And it makes it easier for a business to ask what work is being replaced, augmented, or created.

It also creates a risk. Names encourage people to trust an agent in the way they would trust a colleague, and an agent is not a colleague. It has no professional judgment, no personal accountability, and no understanding of context beyond what it has been given. Startup Fortune raised the question directly: “which decisions stay with people, which ones the agent takes alone?” That question should be answered in writing before an agent goes live, not discovered after an error.

Why weeks-long agents change the risk

The long-horizon runtime deserves separate attention, because it changes what can go wrong. A chatbot that answers one question and forgets it produces contained errors. An agent that holds a plan for weeks, remembers past interactions, and adjusts its behavior can compound a mistake, act on stale information, or continue a course of action after circumstances have changed.

Memory also raises data questions. What does the agent retain, for how long, and who can see or delete it? Durable execution raises control questions. How do you pause or stop an agent that is mid-plan, and how do you review what it did while nobody was watching? Dynamic steering raises accountability questions. When feedback changes an agent’s behavior, who approved that change?

These are design questions for anyone working on AI agent development, and they are procurement questions for anyone buying agents. The sensible default for a weeks-long agent is tighter limits: narrow permissions, explicit approval for irreversible actions, clear stop conditions, and a complete log of what it decided and why.

What to ask before you deploy a job-ready agent

Whether you buy from Salesforce or another vendor, the same questions apply.

What exactly is the job, and how is success measured? Define the metric before the pilot, including what counts as resolved or qualified.

What does the agent decide alone, and what needs a person? Write the boundary down and test it.

What data does it read, retain, and write? Confirm retention periods and deletion.

How do you audit and stop it? This is the core of AI governance for agents. Ask to see the logs and the pause controls.

How does it behave when it is wrong? Test escalation paths and error handling with real edge cases.

What is the fallback? Keep a documented way to run the process without the agent.

How does it fit with the rest of your agents? If you run agents from more than one vendor, check whether the governance layer really covers them.

Where this leaves you

The confirmed facts are these. Salesforce launched seven named agents on September 11, 2026. Six are generally available and Hunter is in pilot until a planned November release. Hunter runs on a new runtime designed to pursue goals over days and weeks. A separate governance announcement the day before introduced an AI Control Plane, with parts still to roll out. All customer results are Salesforce-reported and lack published definitions.

The broader shift is real. Enterprise AI is increasingly sold as a defined piece of work with a name attached. That makes it easier to evaluate, provided you insist on definitions, baselines, and limits. Businesses exploring AI automation, AI agent development, or generative AI development can borrow the useful part of the framing, which is to scope each agent to a specific job, and skip the risky part, which is treating it like a person.

Frequently Asked Questions

1. What are the seven Agentforce agents?
Answer: Casey (customer service), Paige (IT and HR), Carter (shopping), Marshall (supply chain), Piper (inbound lead generation), Fin (customer experience workflows), and Hunter (outbound sales). Salesforce announced them on September 11, 2026.

2. Which agents are available now?
Answer: Casey, Paige, Carter, Marshall, Piper, and Fin are generally available. Hunter is in pilot, with general availability planned for November 2026.

3. What is the long-horizon runtime?
Answer: It is a new runtime that lets an agent pursue goals across days and weeks using memory, durable execution, and dynamic steering. Hunter is the first agent to use it.

4. Are Salesforce’s customer results independent?
Answer: No. All six results are reported by Salesforce, and the coverage reviewed did not define how metrics such as resolved were measured. Treat them as directional evidence, not benchmarks.

5. What is the AI Control Plane?
Answer: It is a governance layer announced separately on September 10, 2026 that provides routing, lineage, cost and observability across Salesforce and third-party AI. Some capabilities are live and the rest are scheduled for fiscal year 2028.

6. How should a business evaluate an AI agent before deploying it?
Answer: Define the job and success metric, set the boundary between agent and human decisions, confirm data retention, check audit logs and stop controls, and test failure handling.

If you want to know which of your workflows are ready for AI agents and where the risks sit, that is exactly what we look at in a free AI Readiness Audit.

Most companies have a policy on which software employees can install. Far fewer have one for AI agents, the programs that can read files, call tools, and take actions on a person’s behalf. That gap is now the subject of a commercial product category, and the clearest sign came on September 1, 2026, when CrowdStrike launched Falcon Guardian at its Fal.Con conference in Las Vegas.

The launch is worth reading closely, not because a single product settles anything, but because of what it assumes: that unapproved AI agents are already running on company machines and that the endpoint is where they need to be caught. Two statistics have been attached to the story, and they need careful handling. Here is what is confirmed, what the numbers actually show, and what the practical lesson is for AI security and AI governance teams.

What CrowdStrike announced

According to CrowdStrike’s press release and coverage from SiliconANGLE, Security Boulevard, and BizTech, Falcon Guardian does four things.

First, it discovers known and shadow AI agents across Windows and macOS endpoints. Second, it blocks agents that are not on an approved list from running on managed systems. Third, it ties agent behavior to endpoint telemetry, linking user prompts to identities, the tools an agent invoked, and the resulting system changes. Fourth, it detects attacks aimed at agents and agents that misbehave, and it estimates the blast radius when an incident occurs.

CrowdStrike also announced supporting pieces: an AI Gateway for centralized control of enterprise AI traffic, a managed service called Falcon Complete for Guardian, a threat hunting service called Falcon Adversary OverWatch for Guardian, and integration with its Next-Gen SIEM.

Availability is uneven, and that matters for anyone planning around it. SiliconANGLE reported that the core Guardian features and the managed threat hunting service are available now, while the AI Gateway is pre-beta and expected to reach general availability next quarter, and Falcon Complete for Guardian is due later this quarter. CrowdStrike’s press release did not list pricing.

CEO George Kurtz framed the pitch in one line: AI has not changed the attack, it has changed its speed. The company’s argument is that the endpoint, which it has long positioned as the control point for stopping attacks, is also the place where agents execute.

What the sources do not say is equally useful. They name Windows and macOS as the supported endpoints and say nothing about other environments. They do not list which agent tools or frameworks Guardian recognizes. And none of the coverage we reviewed includes an independent evaluation of how well it works. Treat this as a vendor announcement, not a tested result.

What shadow AI means in practice

The term is borrowed from shadow IT, where employees adopt tools without approval from the technology or security team. Shadow AI is the same pattern applied to AI: assistants, coding agents, browser extensions, and automation tools that staff install or connect on their own.

It happens for understandable reasons. The tools are free or cheap, they are useful on day one, and many can be installed in minutes without any request to IT. A developer adds a coding agent. A marketer connects an assistant to a shared drive. A finance analyst runs an automation that reads email. Each decision looks small. Together they create a set of programs with real access to company data that nobody has inventoried.

Agents raise the stakes over ordinary shadow IT because they act, not just store. A file-sharing app that nobody approved holds data. An agent that nobody approved can read that data, send it somewhere, and run commands, often with the permissions of the person who installed it.

The two numbers, and what they do and do not show

Two statistics have been attached to this story. They come from different sources and they measure different things.

The first is 89%. CrowdStrike’s 2026 Global Threat Report, published on February 24, 2026, states that AI-enabled adversaries increased their activity by 89%, measured year over year from 2024 to 2025. That is a statement about attackers using AI, not about employees installing unapproved agents. It is also about activity, which is broader than the attacks some summaries describe. The same report says adversaries exploited legitimate generative AI tools at more than 90 organizations by injecting malicious prompts to steal credentials and cryptocurrency. That second figure is closer to the shadow AI concern, because it shows AI tools themselves being used as an attack path.

The 89% is real, and it comes from the company selling the product. It supports the argument that the threat is accelerating. It does not show how many unapproved agents are running inside any given company.

The second number is 17,800. AIR Security, a startup that announced $50 million in funding on September 3, 2026, reported finding more than 17,800 public AI add-ons, with 6.7 million installations in total, that rely on untrusted external sources for their instructions. The company also reported finding AI skills that impersonate Anthropic and OpenAI and are designed to get past security reviews and run arbitrary code. Coverage describes add-ons as skills, plugins, and MCP servers, which are the extensions that give agents new abilities.

Two cautions apply. AIR Security sells a firewall for AI agents, so it has a commercial interest in the finding, and it is a separate company from CrowdStrike. The coverage we reviewed also did not include a published methodology or a link to a full report, so the count cannot be independently checked. That does not make it wrong. It means it should be read as a vendor’s research and used to understand the type of risk, not as a measured baseline.

Together the two figures make a reasonable case for taking the issue seriously. Attackers are using AI more, and the supply chain of extensions that agents rely on is largely unvetted. Neither figure tells you your own exposure.

Why this is a governance problem first

The most important detail in the product description is easy to miss. Guardian blocks agents that are not on an approved list. That means someone has to create the list.

A detection tool can tell you which agents are running. It cannot decide which ones should be. That decision is AI governance: defining which agents are allowed, for which tasks, with which permissions, approved by whom, and reviewed how often. Without it, a discovery tool produces an inventory and a set of alerts with no policy to measure them against.

Kurtz described the aim as turning policy into protection. The order of that phrase is the point. Policy comes first. Organizations that buy enforcement tooling before they write the policy tend to discover that the hardest questions were never technical. Who can approve a new agent? What counts as sensitive data an agent may not touch? Which extensions and MCP servers are acceptable? What happens when a team needs something that is not on the list?

What a practical response looks like

You do not need to buy a product to start. The same steps apply whether you use an endpoint platform, a gateway, or manual review.

Find out what is already running. Ask every team which AI assistants, agents, and extensions they use, and check managed devices where you have the tooling to do so. Expect the first answer to be incomplete.

Write an approved list and a request path. If the only answer to a new tool is no, people will route around you. Make it easy to ask, and give a fast answer.

Vet the extension supply chain. Skills, plugins, and MCP servers can pull in instructions from outside your control. Review where each one loads content from, what permissions it requests, and who publishes it. Be cautious with anything that carries a familiar brand name but comes from an unverified publisher.

Apply least privilege. This is basic AI security hygiene, and it applies to agents as much as to people. Give agents the narrowest access they need. An agent that only has to read one folder should not be able to reach the whole drive or run commands on the machine.

Log what agents do. Record which identity started an agent, which tools it invoked, and what it changed. If something goes wrong, that record is what lets you estimate the blast radius.

Plan the response. Decide in advance who can disable an agent, revoke its credentials, and notify affected teams.

Evaluate vendors on evidence. When assessing any agent security product, ask which agents and platforms it covers, how discovery works, what it does when it finds an unapproved agent, and what independent testing exists.

For companies that build agents for customers or for internal use, this also shapes design. Teams working on AI agent development should build in identity, scoped permissions, and audit logging from the beginning, so that the agents they ship are ones a security team can actually govern.

Where this leaves you

Falcon Guardian is a confirmed product launch with a defined feature set, some parts available now and others still to come. The 89% figure is CrowdStrike’s own finding about attacker activity. The 17,800 figure is a separate vendor’s research with no published methodology in the coverage we reviewed. None of these prove that your company has a shadow AI problem today.

What they do show is that the industry now treats unapproved agents as an AI security category worth building products for, and that the endpoint is one place to look. The durable part of the story is the AI governance work underneath: an inventory, an approved list, vetted extensions, limited permissions, and a record of what agents do. Companies that have those in place can evaluate any tool from a position of strength. Companies that do not will be buying software to solve a policy gap.

Frequently Asked Questions

1. What is Falcon Guardian?
Answer:Falcon Guardian is CrowdStrike’s AI agent security product, launched on September 1, 2026 at Fal.Con. It discovers known and shadow AI agents on Windows and macOS endpoints, blocks agents that are not approved, and links agent behavior to endpoint telemetry.

2. What is shadow AI?
Answer: Shadow AI refers to AI tools and agents that employees use or install without approval from IT or security. Because agents can read data and take actions, they carry more risk than ordinary unapproved apps.

3. Where does the 89% figure come from?
Answer: It comes from CrowdStrike’s 2026 Global Threat Report, published February 24, 2026, which says AI-enabled adversaries increased their activity by 89% year over year. It measures attacker activity, not unapproved agents inside companies.

4. Is the 17,800 add-ons figure from CrowdStrike?
Answer: No. It comes from AIR Security, a separate startup that sells an AI agent firewall. It reported more than 17,800 public add-ons with 6.7 million installations relying on untrusted instruction sources. The coverage reviewed did not include a published methodology.

5. Do I need a product like Falcon Guardian?
Answer: Not necessarily. Start with an inventory of the agents in use, an approved list, and a request process. A tool can enforce that policy, but it cannot write it for you.

6. What should an AI governance policy for agents include?
Answer: It should define who can approve agents, which data they may access, which extensions and MCP servers are acceptable, what permissions they receive, how their actions are logged, and who can shut them down.

If you want to know which AI agents and tools your teams are already relying on, and where the governance gaps are, that is exactly what we look at in a free AI Readiness Audit.

Our earlier piece on MCP and A2A governance looked at the open standards that decide how agents connect to tools and to each other. This one looks at the layer underneath those standards, which is the model itself, and at a recent event that shows how quickly access to that layer can change for reasons that have nothing to do with your product.

On August 28, 2026, OpenAI announced that it will end Cursor’s access to its models on November 12. The immediate story is about two companies and an acquisition. The lasting story is about every business that has built a workflow on top of someone else’s model. Here is what is confirmed, what is disputed, and what a sensible response looks like.

What is confirmed

The sequence is short. SpaceX acquired Anysphere, the company behind the Cursor coding editor, in an all-stock deal reported at $60 billion, which closed on August 14, 2026. Two weeks later, on August 28, OpenAI published a post explaining its decision to end Cursor’s access to OpenAI models, with November 12, 2026 as the date.

OpenAI’s stated reason is trust. It said it cannot be confident that SpaceX will use its technology within OpenAI’s terms of service, and it pointed to a history of contract disputes involving Elon Musk’s companies, including, in OpenAI’s account, xAI’s violation of OpenAI’s own service terms. OpenAI also said it was giving the maximum notice its agreement allowed, which works out to a little over ten weeks, and that its contract included a limited window to cancel after a change of control.

OpenAI’s help center article adds practical detail. It describes November 12 as the end of a transition period and says the formal termination date will be confirmed later. The affected features are the local Chat and Agent modes that currently offer OpenAI models. The unaffected features are Cursor Tab and autocomplete, Auto model selection, Cloud and Background Agents, Automations, the Cursor CLI, and the Cursor API and SDK, all of which continue to use models supplied by Cursor.

Users who want to keep using OpenAI models have three routes. They can bring their own OpenAI API key, which is billed separately from any Cursor or ChatGPT subscription. They can install OpenAI’s Codex extension and sign in with a ChatGPT plan or an API key. Or they can connect through an AI gateway their organization already manages, such as Amazon Bedrock or Azure. One detail matters for budgets: a ChatGPT subscription does not include API usage, so a team that switches routes may see a new line item.

Anthropic responded quickly. Co-founder and Chief Compute Officer Tom Brown said the company will keep increasing compute to support Claude models in Cursor.

What is disputed or still unclear

Several points are less settled than the headlines suggest, and they are worth separating from the confirmed facts.

Cursor CEO Michael Truell said OpenAI models account for only about 5% of Cursor’s traffic. That is Cursor’s own claim, not an independent measurement, and DevOps.com reported that it was widely questioned on social media. Treat it as Cursor’s position, not as an established number.

Truell also said Cursor was in talks with OpenAI to find a solution. Nothing in the sources reviewed shows that those talks have produced an outcome, and no response from SpaceX appears in the coverage we could verify. The November 12 date could still change, either through negotiation or through the formal notice OpenAI’s help article mentions.

The $60 billion price and the August 14 closing date come from reporting on the deal. The OpenAI post and the help article do not discuss the price. So the accurate framing is that the deal was reported at that value.

None of this changes the central lesson. Even if OpenAI models are a small share of Cursor’s traffic, the event shows how a change of ownership can turn a supplier into a gatekeeper overnight.

Why this is not really a Cursor story

Every company that builds on a third-party model has the same exposure Cursor just discovered. The contract you signed can be ended by the supplier under conditions you do not control, and an acquisition, on either side, is one of the most common triggers. In this case the acquired party was the customer. It could as easily be the supplier, whose new owner may reprice, restrict, or retire the product you rely on.

There is also a competitive dimension. Within hours of OpenAI’s announcement, a rival lab publicly reaffirmed its support for Cursor. That is good news for the customer in the short term, but it moves the dependency instead of removing it. A team that swaps one model vendor for another is still exposed to the same category of risk, only with a different counterparty.

Treat model access the way finance teams treat any critical supplier. Ask who owns the vendor, what happens if that changes, how much notice the contract requires, and what your fallback is. Most engineering roadmaps never ask these questions, because the model feels like infrastructure. It is closer to a contract that can be ended.

Switching models is not a configuration change

The technical half of the risk is easy to underestimate. Standards like MCP and A2A make it easier to connect an agent to tools and to other agents. They do not make one model behave like another.

Analysts quoted by CIO made this point directly. Manoj Chandra Jha of Nord-IQ Research said prompts and agent instructions that work well with OpenAI models can produce different results with another model, which forces enterprises to retune both prompts and evaluations. Abhishek Satapathy of Avasant listed where the differences show up in coding agents: repository-level work, debugging, refactoring, test generation, multi-file changes, and tasks where an agent must inspect a codebase, make changes, run tests, and correct its own errors.

That list should look familiar to anyone doing AI agent development. Agents chain many steps together, so a small difference in how a model interprets an instruction can compound across a workflow. A prompt that produced clean output on one model can drift on another, with tool calls made in a different order, formats interpreted differently, or errors handled in a different way.

CIO also quoted Pareekh Jain, who advised enterprises to support multiple models, test alternatives regularly, and “avoid making important workflows too dependent on one model.” The word regularly matters. A fallback model that has never been tested is only a hope.

What resilience looks like

Cursor itself offers a useful example of preparation. Most of its product does not depend on OpenAI’s models at all. Tab completion, Auto selection, cloud agents, automations, the CLI, and the API all continue on Cursor-supplied models. A Forbes analysis argued that this reflects deliberate investment in its own coding model, Composer 2.5, built on open-source checkpoints, which lets Cursor treat frontier model access as something it can substitute. That is an analyst’s interpretation rather than a confirmed account of Cursor’s strategy, but the product structure supports the point. The features most exposed are the ones where users chose an OpenAI model by name.

Very few companies can train their own model. The principle still applies at smaller scale: keep the part of your product that users experience separate from the part that depends on a single supplier. For teams working on AI agent development, that usually means keeping business logic, tool definitions, and evaluation data in your own repository, and treating the model as a component you can replace. Prompts written for one model should be documented as model-specific, so nobody assumes they will transfer.

A practical checklist for model dependency

Whether you are building internal tools, customer-facing agents, or a full product, the same steps reduce the risk. This is the kind of work that belongs in any serious AI development plan from the start.

Inventory every model dependency. List each workflow, which model it calls, through which route, and under which contract. Include shadow usage, such as teams running personal API keys.

Put an abstraction layer between your application and the model. Route calls through one internal interface so that changing the model is a change in one place, not a rewrite.

Build an evaluation suite before you need it. A set of representative tasks with expected outcomes lets you compare a replacement model on evidence instead of impressions. This is the piece Jha’s comment points to, and it is the one teams most often skip.

Test a fallback model on a schedule. Run the evaluation suite against at least one alternative every quarter, and keep prompts tuned for it, not only for your primary.

Read the contracts. Look for change-of-control clauses, notice periods, usage restrictions, and pricing terms. Note who can end the agreement and under what conditions.

Understand the billing routes. As the Cursor case shows, subscriptions and API access are often billed separately. Know which one each workflow actually uses.

Assign an owner. Model dependency is a business risk, so it needs an owner outside the engineering team who reviews it alongside other supplier risks.

Where this leaves you

OpenAI’s decision on Cursor is confirmed, with November 12 as the announced end date, though the formal termination date and the outcome of talks remain open. The claim that OpenAI models are 5% of Cursor’s traffic is Cursor’s own. The wider point does not depend on either detail. Access to a model is a supplier relationship, and supplier relationships change when ownership changes.

For teams investing in generative AI development and agent workflows, the response is measured, not alarmed. Inventory the dependencies, build the evaluation suite, test the fallback, and review the contracts. The cost is a few weeks of engineering time. The alternative is discovering your dependency on a Tuesday afternoon with a ten week clock running.

Frequently Asked Questions

1. When does OpenAI stop providing models to Cursor?
Answer: OpenAI announced on August 28, 2026 that access ends on November 12, 2026. Its help center describes that date as the end of a transition period and says the formal termination date will be confirmed later.

2. Why did OpenAI end the agreement?
Answer: OpenAI said it cannot be confident SpaceX will use its technology within its terms of service, following SpaceX’s acquisition of Cursor’s parent company. It cited a history of contract disputes involving Elon Musk’s companies.

3. What still works in Cursor after the cutoff?
Answer: Cursor Tab, Auto model selection, Cloud and Background Agents, Automations, the CLI, and the API and SDK continue on Cursor-supplied models. The affected features are local Chat and Agent modes that offer OpenAI models.

4. Can developers keep using OpenAI models in Cursor?
Answer: Through other routes, yes. OpenAI lists bringing your own API key, using the Codex extension, or connecting through an AI gateway such as Amazon Bedrock or Azure. API usage is billed separately from a ChatGPT subscription.

5. Is it true that OpenAI models are only 5% of Cursor’s traffic?
Answer: That is what Cursor CEO Michael Truell said, but it is Cursor’s own figure and was questioned publicly. It has not been independently verified.

6. How can my business reduce model dependency risk?
Answer: Inventory every model dependency, put an abstraction layer between your application and the model, build an evaluation suite, test a fallback model regularly, and review supplier contracts for change-of-control terms.

If you want to know how exposed your own workflows are to a single vendor, that is exactly what we look at in a free AI Readiness Audit.

If your entire AI visibility plan is to publish better pages on your own site, the research says you are working on the smaller half of the problem. Two academic studies and one large industry analysis, each looking at a different slice of AI search, land on the same practical conclusion: what other people publish about you carries far more weight in AI answers than what you publish about yourself.

That is a strong claim, and it is also one that gets stretched in the retelling. The headline figure of 93% applies to specific engines in a specific kind of query, not to every AI platform in every situation. Here is what each source actually measured, where the numbers hold, where they do not, and what it means for how you spend a marketing budget.

Study one: a small group of outlets dominates news citations

The first paper is “News Source Citing Patterns in AI Search Systems” by Kai-Cheng Yang, posted to arXiv on July 7, 2025. It analyzed 366,087 citations across 12 AI search models from three providers: OpenAI, Perplexity, and Google. The data was collected over seven weeks between March and May 2025 from the AI Search Arena dataset.

A little over 9% of those citations, 32,865 in total, pointed to news outlets. That is worth stating up front, because it means the paper is not claiming that AI engines mostly cite journalism. It is examining the news slice of citations and finding that the slice is extremely concentrated.

The concentration differs sharply by provider. The paper reports that the 20 most frequently cited news sources account for 67.3% of citations for OpenAI models, compared with 31.9% for Google and 28.5% for Perplexity. Reuters and the Associated Press alone were cited at rates of 22.8% and 12.2% for OpenAI models. In other words, when ChatGPT-style models reach for a news source, they reach for a very short list.

One caution applies. The paper is a preprint posted on arXiv, so read it as a well-documented research finding rather than settled consensus, and note that it covers models tested in 2025.

The takeaway for marketers is narrower than the headline suggests. If you want news-based visibility in OpenAI-powered answers, the door is small, and the outlets standing in it are wire services and major national publishers. That does not make earned media pointless. It tells you that not all earned media is equal.

Study two: earned media versus your own site

The second paper is “Generative Engine Optimization: How to Dominate AI Search” by Mahe Chen, Xiaoxuan Wang, Kaiwen Chen, and Nick Koudas, submitted on September 10, 2025. The authors ran controlled experiments across ten consumer product verticals, with 100 queries each, and classified every cited source as earned media, brand-owned, or social content. Their abstract describes a systematic and overwhelming bias toward earned media, meaning third-party authoritative sources, over brand-owned and social content.

The numbers vary by engine, and the variation matters. In the consumer electronics vertical, Claude drew about 93.7% of its citations from earned media and ChatGPT about 93.6%. Perplexity was far lower at 53.3% earned, with 31.6% from brand-owned sites and 15.1% from social platforms.

Across the paper’s broader brand tests, the pattern held. For well-known brands, ChatGPT cited earned media 93.5% of the time and brand-owned pages 6.5%. Claude sat at 87.3% earned and 6.8% brand-owned. Perplexity came in at 67.4% earned and 8.8% brand-owned, with 23.8% from social. Gemini showed 63.4% earned and 25.1% brand-owned. For niche brands, ChatGPT reached 95.1% earned and 4.9% brand-owned, and Claude 86.3% earned and 10.6% brand-owned.

So the tidy line that AI engines cite earned media 93% of the time is accurate for ChatGPT and, in one vertical, for Claude. It is not accurate for Perplexity, and it clearly overstates the case for Gemini, which gave brand-owned pages a quarter of its citations in the well-known brand test. Your own website is close to invisible for ChatGPT on product queries. It is a real contributor to Gemini.

Note also that this is a preprint, and the queries are consumer product comparisons. A B2B services buyer asking about agencies or software may see different source mixes. Treat the paper as strong evidence about direction, not a guarantee for your category.

The third source: most citations do not come from Google’s first page

Ahrefs added two findings that support the same conclusion from a different angle.

In an analysis of 15,000 long-tail queries published on August 11, 2025, Ahrefs found that only 12% of URLs cited by ChatGPT, Gemini, and Copilot also appeared in Google’s top 10 for the same prompt. Put the other way, roughly 88% did not. Perplexity was the exception, with 28.6% overlap. This is why ranking well on Google, while still valuable, does not guarantee a citation. The AI engines are retrieved from a different set of pages.

The second finding is more useful for anyone planning outreach. Ahrefs examined the 1,000 pages ChatGPT cited most in September 2025 and concluded that roughly two-thirds of them are effectively off-limits to traditional outreach. The breakdown was Wikipedia at 29.7%, homepages and landing pages at 23.8%, educational pages at 19.4%, app stores at 6.6%, reviews at 5.8%, news and media at 5.2%, language and grammar sites at 4.0%, dictionary and reference at 2.2%, blog articles at 1.9%, community forums at 0.9%, and corporate pages at 0.5%.

Ahrefs counted only four categories as influenceable: educational pages, reviews, news and media, and blog articles. Together they make up 32.3% of the top 1,000.

This corrects a common retelling. Several summaries describe the off-limits share as Wikipedia, government sites, education, and major news. That is not what Ahrefs found. In the Ahrefs breakdown, educational pages and news were on the influenceable side, and the off-limits side was mostly Wikipedia, other organizations’ homepages, and reference-style sites. The opportunity is in educational content, reviews, news mentions, and articles.

What this does and does not prove

It proves that publishing on your own domain is not enough to earn citations from ChatGPT or Claude on product research queries. It supports the case that third-party mentions matter, and that they matter more on some engines than others.

It does not prove that your own website is irrelevant. Brand-owned content still accounts for 5% to 25% of citations in the Chen study depending on the engine, and pages that AI systems retrieve from your site are part of what makes third-party coverage credible. Your site is where a cited claim gets verified.

It also does not prove that any earned mention helps. The Yang paper shows that the citation pool for news is narrow, and the Ahrefs data shows that news is only 5.2% of ChatGPT’s most cited pages. A mention in a low-authority outlet is unlikely to move the needle.

What this means for link building and digital PR

The strongest business case in this research is for redefining what link building and digital PR are for. For years, the goal was a link that passed ranking signals. The goal now includes being named, described, and reviewed in the places AI engines already trust.

That changes priorities in four ways.

Prioritize the sources engines already cite. Before pitching anyone, check which publications, review platforms, and educational sites appear in AI answers for your category. Build the target list from that, not from domain authority alone.

Pursue reviews and comparisons, not just news. Reviews and educational pages are a much larger share of ChatGPT’s influenceable citations than news. Accurate, current listings on review platforms and inclusion in independent comparison content deserve more of the budget than they usually get.

Create material that other people want to cite. Original data, clear definitions, and expert commentary give journalists and educators a reason to reference you. This is the foundation of effective digital PR, and it also gives educational and blog sources something to link to.

Keep your own site accurate and consistent. When an outlet mentions you, engines and users will check your site. Consistent naming, clear service descriptions, and current facts make the third-party mention easier to trust.

Treat Wikipedia as a consequence, not a target. At 29.7% of ChatGPT’s top 1,000 cited pages, it is the single largest source, and Ahrefs places it outside the reach of outreach. Trying to force an entry is the wrong response. The sustainable route is to earn the independent coverage that makes a company notable in the first place, which is exactly what a disciplined digital PR program produces over time.

Expect a slow payoff. Third-party coverage takes weeks to publish and longer to be picked up by AI engines, so judge a campaign over quarters, not days. Pair the outreach with a monthly citation check so you can see which placements actually change what the engines say.

Set a baseline before you begin. Record which prompts cite your brand today, on which platforms, and from which sources. Repeat monthly. Without that, you cannot separate the effect of an outreach campaign from ordinary platform variability.

Where this leaves you

Optimizing your own site remains necessary. Sound search engine optimization fundamentals still determine whether you are found and understood. But the evidence now points to a second requirement that sits outside your domain. On ChatGPT and Claude, earned media supplies roughly nine in ten citations for product research. On Perplexity and Gemini the share is lower but still a majority. That is the reason generative engine optimization and answer engine optimization now include off-site work, and why link building teams are being asked to think about mentions, reviews, and reference sources, not just links.

Frequently Asked Questions

1. Do AI engines really cite earned media 93% of the time?
Answer: For ChatGPT and Claude in the consumer electronics vertical of the Chen study, yes: about 93.6% and 93.7%. Perplexity was near 53% and Gemini near 63% to 66% in other tests, so the figure does not apply to every engine.

2. What counts as earned media in these studies?
Answer: Third-party authoritative sources such as independent reviews, journalism, and expert publications. Brand-owned pages and social content are classified separately.

3. Does this mean my website does not matter for AI visibility?
Answer: No. Brand-owned pages still receive about 5% to 25% of citations depending on the engine, and your site is where third-party claims get checked. It is necessary but not sufficient, which is why answer engine optimization now includes off-site work.

4. Is it true that two-thirds of ChatGPT’s top citations cannot be influenced?
Answer: Ahrefs reported that roughly 67% of ChatGPT’s top 1,000 cited pages fell outside traditional outreach. Educational pages, reviews, news, and blog articles, about 32.3%, were the influenceable share.

5. Which earned media should I prioritize?
Answer: Start with sources AI engines already cite in your category: review platforms, educational content, and a short list of authoritative publications. Wire services and major national outlets dominate news citations for OpenAI models.

6. How do I measure whether digital PR is improving my AI citations?
Answer: Track a fixed set of buyer prompts on ChatGPT, Claude, Perplexity, and Gemini each month, and record whether your brand is cited and from which source.

If you want to see which third-party sources are shaping AI answers about your brand today, that is exactly what we cover in a free AI Visibility Audit.

This is the third piece in our series on how AI platforms decide who gets cited. The first looked at how much AI referral traffic ChatGPT controls. The second looked at how selective it is about which sources it trusts. This one asks the practical follow-up: if two of the biggest AI platforms disagree this much about sources, what does that do to the way you measure visibility?

The headline number is that only about 11% of domains are cited by both ChatGPT and Perplexity. It has been repeated in dozens of articles this year, usually with a sentence claiming that single-platform tracking leaves 89% of your visibility invisible. That last part goes further than the data supports. The 11% figure is real and worth acting on, but it is also easy to misread, and several of the studies stacked underneath it measure different things. Here is what each one actually found, and what it means for how you track your brand.

Where the 11% comes from

The figure appears in three related but distinct places, and they are not the same study repeated three times.

The first is a dataset of 680 million citations covering August 2024 to June 2025, analyzed by Profound and cited in Averi’s B2B SaaS benchmark report. Averi’s report states that only 11% of domains are cited by both ChatGPT and Perplexity. Worth noting: the 680 million analysis is Profound’s work, and Averi uses it as a supporting reference rather than presenting original research of its own. Several articles online attribute the analysis to Averi directly, which is a small but real attribution error.

The second is a Qwairy analysis of 118,000 AI responses collected between January and March 2026 across ChatGPT, Perplexity, Google AI Mode, and Claude, which Whitehat SEO cites in its own comparison. It found that only 11% of cited domains appeared across multiple platforms. That is a slightly different measurement from the first one. It looks across four platforms at once instead of comparing ChatGPT and Perplexity as a pair, so the matching 11% is a coincidence of two different methods, not one result confirmed twice.

The third is a Wellows study of 22.7 million citations across 1.15 million questions, covering January to June 2026. It approaches the same question from the opposite direction and reports that 89% of websites ChatGPT cited on a given question were never cited by Perplexity on that same question. That is essentially the mirror image of the 11% figure, measured at the website level, on identical questions.

So three datasets, three time windows, and two different definitions of overlap all point the same way: the two platforms draw on substantially different sets of sources. That agreement is the meaningful finding. The exact percentage matters less than the direction.

What the 11% does and does not mean

Now for the overreach. A low overlap between two platforms’ cited domains does not mean 89% of your potential visibility is hidden from you. Authority Tech, which curates and compares these studies, states explicitly that the figure does not imply that. There are three reasons.

First, the overlap is measured across all domains cited, not across your domain. Your brand could appear consistently on both platforms while the rest of the web fragments around you. The 11% describes the whole citation landscape, and your own footprint inside it is a separate question.

Second, Wellows itself is careful about this. Its authors describe the gap as a different candidate pool rather than a more unpredictable engine, and they point out that the number measures which sources answer a particular question, not which websites are permanently available to each platform.

Third, overlap depends heavily on how strictly you match. Wellows reports different results at website level, page level, and with different levels of address cleanup. A percentage that moves that much with the matching rule should be read as a range, not a fixed law.

The accurate version of the claim is narrower and still useful: if you only measure one platform, you are measuring a different slice of the web than the one your buyers see on the other. That alone is reason enough to change how you track.

A different 12% that gets mixed in

Ahrefs published a widely quoted 12% figure that often gets bundled into this conversation, and it deserves separating out. Ahrefs analyzed 15,000 long-tail queries in a study published on August 11, 2025, and found that only 12% of URLs cited by ChatGPT, Gemini, and Copilot also ranked in Google’s top 10 for the same prompt. The measurement compares AI citations with Google rankings. It does not compare one AI platform with another.

The Ahrefs data does contain a useful platform-level detail, though. Perplexity’s overlap with Google’s top 10 was 28.6%, far higher than ChatGPT at around 8%. So Perplexity leans on pages that also rank well in traditional search, while ChatGPT draws more heavily from pages that do not. Placed next to the 11% cross-platform figure, that goes a long way toward explaining why the two platforms disagree. They are retrieving from different places.

For anyone doing search engine optimization alongside AI visibility work, this is the important takeaway. Ranking well in Google helps you with Perplexity noticeably more than it helps you with ChatGPT. Treating them as one channel with one strategy will over-serve one and under-serve the other.

The same brand, very different results

Two more datasets show what this looks like at the brand level, and both are better evidence for multi-platform tracking than the 11% headline.

Superlines analyzed 34,234 AI responses across 10 platforms between January 14 and February 13, 2026, and reported a 615x gap in citation volume between the highest-citing platform, Grok at a 27.01% citation rate, and the lowest, Claude, at close to zero. The number is striking, but it needs context. It reflects how differently each platform handles linking out to commercial brand sites, which is partly a product design difference and not purely a measure of how much each platform likes any given brand.

Slate HQ published a 90-day study on March 30, 2026, tracking six B2B SaaS brands across ChatGPT, Perplexity, Gemini, Claude, Google AI Overview, and Google AI Mode, with more than 300,000 citation data points. Its central finding is that 76.3% of all citations went to domains that were neither the brand nor its direct competitors. Most of the visibility lives on third-party sources.

The per-platform breakdown Slate published for one email security client illustrates the spread. Brand-owned citation share was 10.2% on Google AI Mode, 10.0% on Google AI Overview, 9.1% on Claude, 6.9% on Gemini, 6.8% on Perplexity, and 4.5% on ChatGPT. Those are the numbers for one client, not an average across all six brands, and it would be wrong to say ChatGPT was the weakest platform for every company studied. But the spread within that single brand, more than double between the highest and lowest platform, makes the point clear. The same company can look strong on one platform and weak on another during the same 90 days.

Slate also found that Claude had the narrowest external source pool at 54% unidentified sources, while Perplexity cast the widest net at 67.7%. Different platforms are not just citing different pages. They are behaving differently in how broadly they search.

What to do with this

The practical response is not to panic about an invisible 89%. It is to stop treating AI visibility as a single number.

Track each platform separately. A blended score hides exactly the variation the studies above describe. At a minimum, report ChatGPT, Perplexity, Google AI Overviews, and Claude as separate lines, and watch each for movement independently. This is the foundation of any serious generative engine optimization program.

Identify which sources each platform trusts in your category. Since most citations go to third-party domains, your visibility depends on where you are mentioned as much as on what you publish. Check which review sites, directories, and community platforms each engine leans on for your topics, then look at whether you are present there.

Match your optimization to the platform. Because Perplexity correlates more strongly with Google rankings, traditional ranking work supports it. ChatGPT draws from a broader mix, so entity clarity, third-party mentions, and presence on the sources it favors carry more weight. This is where generative engine optimization and answer engine optimization diverge in practice, even though they are often discussed as one thing.

Set a baseline before changing anything. Record your citation presence per platform for a fixed set of prompts this week, then repeat monthly. Without a starting point, you cannot tell whether a change came from your work or from platform variability.

Treat every overlap statistic as a range. Different matching rules produce different percentages, and the sample sizes, time windows, and definitions vary. Use the studies to understand direction, then validate against your own prompts.

Where this leaves you

Only 11% of domains being cited by both platforms is a real signal, backed by three independent datasets using different methods. It does not mean 89% of your visibility is lost, and it is not the same as the Ahrefs 12% figure, which compares AI citations with Google rankings. What it does show is that ChatGPT and Perplexity behave like separate channels with separate source preferences, and that measurement built around one will miss what the other is doing. Track them separately, benchmark against a baseline, and treat the percentages as direction, not precision. That is the discipline answer engine optimization now demands.

Frequently Asked Questions

1. Is it true that only 11% of domains are cited by both ChatGPT and Perplexity?
Answer: Yes, that figure appears in several studies, including a 680 million citation dataset analyzed by Profound and a Qwairy analysis of 118,000 responses. Definitions differ slightly between studies, so treat 11% as an approximate indicator of low overlap, not an exact constant.

2. Does this mean 89% of my AI visibility is hidden if I only track one platform?
Answer: Not exactly. The 11% describes overlap across all cited domains, not your own brand. It does show that each platform draws on a different pool of sources, so single-platform tracking gives you an incomplete picture.

3. Is the Ahrefs 12% the same statistic?
Answer: No. Ahrefs found that only 12% of URLs cited by ChatGPT, Gemini, and Copilot also rank in Google’s top 10 for the same prompt. That compares AI citations with Google rankings, not one AI platform with another.

4. Which platform gives brands the highest citation share?
Answer: It depends on the brand and category. In Slate HQ’s example for one email security client, Google AI Mode and AI Overview were highest and ChatGPT was lowest. That is a single-client result and should not be generalized to every company.

5. What does the 615x citation gap mean?
Answer: Superlines found a 615x difference in citation volume between the highest platform, Grok, and the lowest, Claude, across 34,234 responses. It reflects how differently platforms link to commercial sites, so it shows platform behavior more than brand preference.

6. What should I track first?
Answer: Start with a fixed list of prompts your buyers actually ask, then record whether your brand is cited on ChatGPT, Perplexity, Google AI Overviews, and Claude separately. Repeat monthly and compare against that baseline.

If you want to see where your brand stands on each platform, not just one, that is exactly what we cover in a free AI Visibility Audit.

On August 26, a Google spokesperson confirmed what SEOs had already been spotting in the wild since late June. Search result links are being rewritten to route through google.com/goto before landing on the actual destination page. Google’s stated reason was procedural: it said it regularly deploys technical measures to protect its services and users from evolving abuse. This sits alongside a separate legal fight, Google’s suit against SerpAPI, first filed in July and amended in August, over how that company accesses Google’s search results.

That much is confirmed. What happens after that point, in coverage of this story, splits into two very different camps, and it is worth being precise about which claims are actually settled and which ones are not before you act on either.

What actually changed, mechanically

Instead of a result linking straight to a destination page, the link now points to google.com/goto, with the destination URL encoded using Protocol Buffers, Google’s own binary data format. A server-side redirect on Google’s end then forwards the visitor to the real page. For a person clicking a result, nothing looks different. They click, they land where they expected. What changed sits entirely underneath that click, in a URL structure that any tool reading destination links now has to parse differently than before.

Third-party tools that read destination URLs directly took the first hit, and here the evidence is solid because the vendors themselves reported it. SerpAPI confirmed impact across several of its products. Ahrefs confirmed what it called a temporary inconsistency in its data. One rank-tracking vendor documented a real six-day window, August 26 through September 2, where its Share of Voice reporting misattributed clicks because its parser was not reading the new format correctly. That has since been fixed, with the affected data being backfilled for customers.

Not every tool broke the same way, and this is worth sitting with for a moment. SE Ranking and Semrush both confirmed no impact on their own position tracking data at all. So the blanket claim that the /goto redirect broke SEO tools is not quite accurate. Some tools broke. Others, reading the exact same search results pages, did not, which suggests the difference has more to do with how each vendor’s parser was originally built than with the redirect itself being universally disruptive.

Where the coverage actually splits

Here is where a real divide appears. Several sources treat GA4 organic-to-direct misattribution as an established, active problem, describing what one piece called “massive organic attribution data loss” and sudden, unexplained spikes in Direct traffic. That framing has spread fast, because it is the scariest possible read of a genuinely technical, genuinely unresolved situation, and alarming framing tends to travel faster online than careful, hedged framing ever does.

Now look at what the more carefully sourced coverage actually says. As of late August, one detailed technical write-up stated plainly that nobody had reported confirmed organic undercounting inside GA4. A separate analysis went further and ran an actual test across ten device and browser combinations, checking whether referrer data survived the redirect chain. It found the referrer stayed intact in every case, and GA4 correctly classified those sessions as Organic Search each time. Multiple outlets, working independently of each other, land on the same conclusion. Google has not confirmed a GA4 attribution impact, and the direct evidence gathered so far does not show one either.

None of that means the concern is baseless. The mechanism Google’s own documentation describes makes an attribution gap plausible in principle. If a redirect chain ever strips referrer data before it reaches your site, GA4’s fallback logic would file that session as Direct rather than Organic Search, silently, with no alert generated anywhere in your dashboard. That is a real risk worth watching closely. It is not the same thing as a confirmed, ongoing problem, and treating it as something that has already happened is exactly the kind of overstatement that risks needing a correction once more data actually comes in, one way or the other.

Why the distinction actually matters

It would be easy to read the last two sections and conclude the difference between disputed and confirmed is mostly semantic. It is not, and the practical stakes are worth spelling out.

If a team reacts to this as a confirmed GA4 problem, the natural response is to start second-guessing every organic traffic number reported for the past month, which burns real time reconciling data against a theory that current testing does not support. Budget conversations get harder to have with confidence when the underlying numbers are being treated as suspect without evidence. Reporting to a client or a leadership team gets shakier too, since telling a room that your organic numbers might be wrong because of a redirect Google has not confirmed affects attribution is not a comfortable thing to say out loud in a review meeting.

If a team instead treats this as a plausible, unconfirmed risk worth monitoring, the response looks completely different. You set a baseline, you watch two specific ratios over the following weeks, and you keep operating normally in the meantime rather than freezing decisions around a risk that has not actually materialized in the testing done so far. That is the more defensible position given what is currently known, and it is also simply less exhausting to maintain.

A second, less-discussed layer

There is a second angle here that is easy to miss if you are only thinking about traditional search engine optimization reporting. Reports say /goto-wrapped URLs are starting to show up as cited sources inside ChatGPT, Perplexity, and Claude, wherever those systems pull from Google’s search results as part of answering a query. If a citation-tracking tool has the same blind spot rank trackers had in late August, before their parsers caught up, the same kind of silent misattribution could in theory apply to AI citation counts, not only to GA4 sessions.

Nobody has published confirmed data on this specifically yet either. It follows the same underlying mechanism, and the same caution about calling something confirmed before the evidence is actually in applies here just as much. This is precisely the kind of gap that generative engine optimization and answer engine optimization work now has to account for. Visibility inside an AI answer is only useful if you can actually measure it, and a measurement tool with an unpatched blind spot will quietly undercount exposure it should be reporting, in exactly the way several rank trackers briefly did in late August.

Setting a baseline instead of guessing

The sensible response to a disputed, plausible-but-unconfirmed risk is not to panic and it is not to ignore it. It is to set a baseline now, so that if this ever does show up in your own data, you catch it immediately instead of noticing it months later as an unexplained trend with no starting point to compare against.

Record this week’s ratio of Search Console clicks to GA4 organic sessions for your key properties, and write the number down somewhere you will actually revisit. Do the same for your current organic-to-direct traffic split. These two figures are your tripwire. If either one moves meaningfully in the weeks ahead with nothing else in your setup changing, that is your signal to look closer, rather than reacting to someone else’s alarmed blog post as though it were your own data.

Reconcile Search Console against GA4 weekly for the next month, instead of your usual monthly cadence. A real attribution gap, if one exists, would show up as a widening divergence between the two figures over time, not as a single dramatic jump you would notice immediately anyway.

Check your GA4 referral exclusion list for any new entries appearing as google.com/goto. If Google’s own redirect domain starts showing up there as a distinct referral source, rather than resolving cleanly through to Organic Search, add it to your exclusions so it does not fragment your organic channel into two separate, harder-to-reconcile pieces.

Hold off on reacting to a rank-tracker alert this week unless you have confirmed that specific tool already adjusted its parser to read the new /goto format correctly. Given that SE Ranking and Semrush reported no impact while SerpAPI and Ahrefs did, an alert from a tool that has not caught up yet is more likely a parsing problem on their end than an actual ranking change on your site.

And if you are already doing any AI visibility tracking, apply the same caution to what you see there. A cited source appearing as a raw /goto link rather than a resolved domain in your reporting is a sign your tool needs to catch up, not evidence that your underlying citation count has actually changed.

Where this leaves you

Google confirmed the redirect itself on August 26. It has not been confirmed, and the direct testing done so far does not support a GA4 attribution problem. Some SEO tools broke, others did not, and the ones that did have mostly already fixed their parsers by now. The plausible risk to your own analytics is real enough to baseline and monitor closely. It is not, as of this writing, a confirmed, active problem serious enough to justify the level of alarm some coverage is giving it, and treating an unconfirmed risk as settled fact is its own kind of mistake, one that tends to send teams chasing a problem that is not actually there yet while a genuinely useful baselining exercise gets skipped entirely.

Frequently Asked Questions

1. Is Google’s /goto redirect confirmed?
Answer: Yes. A Google spokesperson confirmed the rollout on August 26 and described it as a technical measure to protect Google’s services and users from evolving abuse. The rollout itself is not in dispute anywhere in the coverage. What remains unsettled is how far its effects reach.

2. Is my GA4 organic traffic being misattributed because of it?
Answer: Not as far as anyone has confirmed. Google has not acknowledged a GA4 attribution impact, and one technical test across ten device and browser combinations found referrer data stayed intact, with sessions classified as Organic Search. The risk is plausible in principle, so it is worth monitoring, but it is not a confirmed problem.

3. Why is my rank tracker showing odd data?
Answer: It depends on the tool. SerpAPI and Ahrefs confirmed some impact, with Ahrefs calling it a temporary inconsistency, while SE Ranking and Semrush confirmed none. Check whether your vendor has published a statement or a fix before assuming your rankings actually moved.

4. Does this affect AI citation tracking?
Answer: Possibly, but nothing is confirmed. /goto-wrapped links are reportedly appearing as cited sources in ChatGPT, Perplexity, and Claude. A tool that cannot parse them could undercount your citations. Treat any sudden citation drop as a possible tracking issue first, and verify it manually.

5. What should I check first?
Answer: Record this week’s ratio of Search Console clicks to GA4 organic sessions, plus your organic-to-direct traffic split. These two numbers are your baseline. If either shifts meaningfully with nothing else changing, investigate then.

6. How often should I reconcile Search Console and GA4?
Answer: Weekly for the next month, instead of monthly. A genuine attribution gap would show up as a widening divergence between the two over several weeks, not as a single sudden jump.

7. Should I change my SEO strategy because of this?
Answer: No. Nothing about the redirect changes how rankings are earned. Keep your strategy as it is, baseline your data, and update only if a confirmed impact emerges.

If you want a second set of eyes on whether your own reporting, or your AI visibility specifically, is being affected, that is exactly what we check in a free AI Visibility Audit.