The Citation Mirage.

Three dispatches said the same thing: citation is the new ground truth.

The Expel Pattern argued that AI citation is becoming the leading demand signal — the buyer asks the engine, not the search bar. The CNAPP Inversion found the gap between search and citation and named the most exposed quadrant. AI Security Acquired watched the cited vendors get bought before the engines could forget them. Each piece treated citation as the new ground truth: where the buyer now looks, the vendor must now appear.

This one tests that ground at scale. We swept the whole board — 18 Kumite divisions, 127 graded vendors — and asked each engine the only question a buyer actually asks: who are the best vendors in this category? The answer should have been a leaderboard. It was a mirage.

Four vendors out of 127 are cited by both engines inside their own division.

And all four earned it the same cheap way: by publishing the page the engine reads. SentinelOne's cybersecurity-101 hub. CrowdStrike's press desk. BitSight's buyer guides. KnowBe4's own product page. The citation isn't a verdict on the vendor — it's a receipt for the content budget.

The best vendors in the hardest categories don't appear at all.

In MDR, the most scrutinized service category on the board, not one graded leader appears — not Arctic Wolf, not Red Canary, not Expel, not ReliaQuest; the "best MDR" lists are owned outright by SEO blogs no practitioner has heard of. In SOAR, Torq, Tines, and Swimlane — the three names anyone in the field would give you — are gone from the results entirely; the category is dissolving into "AI SOC" as you read this. In PAM, CyberArk, the most dominant vendor in any division we grade, surfaces only as acquisition news: Palo Alto buying it. The leader appears not as a leader but as a transaction.

The engines aren't failing. They're reading a content-marketing arms race and repeating it.

This isn't the engines failing to find the leaders. It's the engines doing exactly what they were built to do — read the open web and repeat its consensus — in a category where the open web is a content-marketing arms race. The vendors who win citation are the ones who treated the engine as a distribution channel and fed it. The vendors who win the market are often too busy winning it to bother. The two populations barely touch.

So the frame holds and inverts in the same motion. AI citation is becoming the demand surface — the brand-search erosion in the CNAPP Inversion proved the migration is real. But the surface is gameable, it is being gamed, and the result is a leaderboard that measures content spend and files it under authority. Cited is not the same as credible.

Citation stays in the Index — read as a content signal, never a leadership one.

For the desk, the consequence is concrete. AI citation stays in the GTM Exposure Index — it is real signal — but it reads as a content-marketing signal, never a leadership one. A leader with zero citation has an SEO gap, not a weakness. A vendor with universal citation has a content engine, which may or may not sit on a real business underneath. The number tells you who showed up to feed the machine. It cannot tell you who is good.

The engines will learn to tell the difference. The vendors gaming them are betting it won't happen fast enough — and for now, the bet is paying.