Loading
Seven AI engines answered 100 buyer questions a day for a week. On the 90 that leave Cogent's name out, 199 of 4,062 answers cite its site and 8 write its name. On the 16 buying questions it appears in 0 of 722.
Scores are the share of answers, out of 100, that write Cogent's name or cite cogent.com. Most of them are the second, which is the finding of this study.
| Stage | Questions | Names the company | Share of answers naming or citing it |
|---|---|---|---|
| Learning | 34 | No | 7.7 |
| Comparing | 38 | No | 4.9 |
| Buying | 16 | No | 0.0 |
| Running it | 2 | No | 0.0 |
| By name | 10 | Yes | 99.6 |
Of the 100 questions we track, 34 are asked while a buyer is learning the category, 38 while comparing, 16 while buying and 2 once a program is running. None of those 90 carries Cogent's name. It appears in 7.7% of the learning answers and 4.9% of the comparing ones. In 722 answers to buying questions it does not appear once.
The other ten do carry its name, and there the engines can describe Cogent: 446 of 452 answers name it.
“What is this, and how does it work?”
“It's a well-established, mature category with entrenched tooling (Qualys, Tenable, Rapid7, etc.).”
“What should we look at?”
“ServiceNow aggregates findings from external scanners (like Tenable, Qualys, or Rapid7) into a single system of record.”
“Which one, and at what price?”
“The strongest Kenna Security alternatives today are Tenable Vulnerability Management, Rapid7 InsightVM, Qualys VMDR, Nucleus, and XM Cyber.”
“How do we run this day to day?”
“Tenable One, Qualys VMDR, and Rapid7 InsightVM can push prioritized findings directly into ServiceNow and Jira.”
“Is Cogent right for us?”
“Cogent Security (Cogent) takes a risk-based approach to vulnerability management that departs fundamentally from traditional CVSS (Common Vulnerability Scoring System).”
Each column is one tracked question, and its height is the share of answers to it that name or cite Cogent, across the seven engines and the seven days. A question that scores zero is drawn as a short stub so it can still be counted.
| Question | Names Cogent | Share of answers naming or citing it |
|---|---|---|
| What is Cogent Security and what does it do? | Yes | 100.00 |
| Cogent Security vs Vicarius for automated vulnerability remediation | Yes | 100.00 |
| How does Cogent Security prioritize vulnerabilities differently from CVSS? | Yes | 100.00 |
| What did Cogent Security's Detection Gap report find? | Yes | 100.00 |
| Cogent Security vs Maze (mazehq.com): which AI-native vulnerability management platform is better? | Yes | 100.00 |
| Does Cogent Security integrate with Tenable, Qualys, Rapid7 and ServiceNow? | Yes | 100.00 |
| How much does Cogent Security cost? | Yes | 100.00 |
| Cogent Security vs Nucleus Security | Yes | 100.00 |
| Is Cogent Security's AI vulnerability management platform any good? | Yes | 97.78 |
| Cogent Security vs Zafran vs ArmorCode for AI-driven exposure management | Yes | 97.78 |
| What are reasonable remediation SLAs for critical, high and medium vulnerabilities? | No | 38.30 |
| Why do vulnerability scanners miss exploitable vulnerabilities, and how big is the detection gap? | No | 33.33 |
| What is the difference between the internal and external attack surface? | No | 31.11 |
| What is the difference between vulnerability management and exposure management? | No | 28.26 |
| Which metrics should a security team track to show vulnerability management is working? | No | 24.44 |
| How do I reduce a vulnerability backlog of thousands of findings? | No | 24.44 |
| What is VulnOps and why are remediation backlogs growing? | No | 22.22 |
| Is exposure management replacing vulnerability management as a category? | No | 21.74 |
| How do I manage vulnerabilities in environments with legacy systems that can't be patched? | No | 19.57 |
| What is continuous threat exposure management (CTEM)? | No | 15.91 |
| What is mean time to remediate for vulnerabilities, and what is a good benchmark for critical findings? | No | 15.56 |
| What are the steps in a vulnerability management process? | No | 15.56 |
| What are the PCI vulnerability scanning requirements and how do I pass them? | No | 15.22 |
| What is AI CTEM and how does it work in practice? | No | 13.64 |
| What is an EPSS score and how should I use it with CVSS? | No | 13.04 |
| How do I get engineering teams to fix vulnerabilities on time? | No | 13.04 |
| What is agentic AI for vulnerability management, and how is it different from automation scripts? | No | 11.11 |
| What is a cyber reasoning model and how does it find vulnerabilities? | No | 9.09 |
| How many critical CVEs have exploits circulating in the wild? | No | 8.89 |
| How is AI used in vulnerability management today? | No | 8.89 |
| How do SOC 2 and ISO 27001 audits treat vulnerability remediation? | No | 8.89 |
| What is vulnerability management and how does a modern program work end to end? | No | 6.67 |
| How do compensating controls change a vulnerability's real risk score? | No | 6.67 |
| What features should vulnerability management software have in 2026? | No | 6.67 |
| How do I handle scanner false positives without wasting analyst time? | No | 6.52 |
| Can AI detect exploitable vulnerabilities before scanner signatures exist? | No | 6.52 |
| Will AI-driven attackers outpace defenders at finding vulnerabilities? | No | 4.44 |
| Can AI agents fix vulnerabilities automatically, and how do I keep humans in control? | No | 4.35 |
| How do exposure management platforms differ from security validation tools? | No | 4.35 |
| How do I calculate the ROI of automating vulnerability management? | No | 2.22 |
| How do I convince leadership to fund vulnerability management automation? | No | 2.22 |
| How should I weigh a well-funded AI security startup against an established vulnerability vendor? | No | 2.22 |
| How do I build a vulnerability management program from scratch for a mid-size company? | No | 0.00 |
| What should a vulnerability management policy include, such as scope, SLAs and exceptions? | No | 0.00 |
| What is the difference between vulnerability management and patch management? | No | 0.00 |
| What is the difference between a vulnerability scanner and a vulnerability management platform? | No | 0.00 |
| How do I prioritize vulnerabilities beyond CVSS scores? | No | 0.00 |
| How do NIST's 2026 NVD changes affect vulnerability prioritization? | No | 0.00 |
| What is the CISA KEV catalog and how should I use it to prioritize patching? | No | 0.00 |
| What is risk-based vulnerability management and how does it differ from traditional scanning? | No | 0.00 |
| How do I factor business impact and asset criticality into vulnerability prioritization? | No | 0.00 |
| What are the best vulnerability prioritization tools? | No | 0.00 |
| How do I triage duplicate findings from multiple vulnerability scanners? | No | 0.00 |
| How do I track vulnerability remediation across ServiceNow and Jira tickets? | No | 0.00 |
| How can I automate vulnerability remediation safely? | No | 0.00 |
| How do I verify that a vulnerability fix actually worked? | No | 0.00 |
| What are the best patch management tools for enterprises? | No | 0.00 |
| How should a security team respond to a zero-day in the first 24 hours? | No | 0.00 |
| What are the best AI vulnerability remediation tools? | No | 0.00 |
| Are AI vulnerability agents safe to run in production environments? | No | 0.00 |
| How are frontier AI models like Mythos changing vulnerability management? | No | 0.00 |
| How do cloud and container vulnerabilities fit into exposure management? | No | 0.00 |
| What are the best exposure management platforms? | No | 0.00 |
| How do I implement a CTEM program step by step? | No | 0.00 |
| How does attack surface management fit with vulnerability management? | No | 0.00 |
| What is attack path analysis and when do I need it? | No | 0.00 |
| What is an exposure window for critical vulnerabilities and how do I shorten it? | No | 0.00 |
| What are the best vulnerability management tools? | No | 0.00 |
| Which vulnerability management tools get the best user reviews on G2 and PeerSpot? | No | 0.00 |
| What is the best vulnerability management software for enterprises? | No | 0.00 |
| What is the best vulnerability scanner? | No | 0.00 |
| Is vulnerability management as a service better than running it in-house? | No | 0.00 |
| How much does vulnerability management software cost? | No | 0.00 |
| Which vulnerability management platforms integrate with Tenable, Qualys and Rapid7 scanners? | No | 0.00 |
| What is the best vulnerability management approach for a small security team with overlapping scanners? | No | 0.00 |
| What is the best vulnerability management software for a hybrid cloud and on-prem environment? | No | 0.00 |
| What are the best Tenable alternatives for vulnerability management? | No | 0.00 |
| Tenable VPR vs EPSS vs contextual rescoring: which prioritization method is best? | No | 0.00 |
| What are the best Qualys alternatives? | No | 0.00 |
| What are the best Rapid7 InsightVM alternatives? | No | 0.00 |
| Nucleus Security vs Seemplicity: which is better for vulnerability orchestration? | No | 0.00 |
| Zafran vs Brinqa for exposure management | No | 0.00 |
| What are the best alternatives to Vulcan Cyber? | No | 0.00 |
| ServiceNow Vulnerability Response vs a dedicated vulnerability prioritization tool | No | 0.00 |
| Qualys vs Rapid7 vs Tenable: which is best for a mid-size enterprise? | No | 0.00 |
| What are the best Kenna Security alternatives? | No | 0.00 |
| How should a cloud-first startup set up vulnerability management without a big team? | No | 0.00 |
| How can a university IT team manage vulnerabilities with limited staff? | No | 0.00 |
| What vulnerability challenges do retail and automotive service chains face? | No | 0.00 |
| How do multi-location hospitality brands handle vulnerability remediation across properties? | No | 0.00 |
| What evidence do auditors want to see for vulnerability remediation? | No | 0.00 |
| What is a good vulnerability management approach for healthcare organizations? | No | 0.00 |
| How does CISA BOD 26-04 change vulnerability remediation expectations? | No | 0.00 |
| What are the risks of consolidating multiple scanners into one platform? | No | 0.00 |
| What should I ask vendors when evaluating AI vulnerability remediation platforms? | No | 0.00 |
| How long does it take to onboard a vulnerability management platform? | No | 0.00 |
| Which ticketing and CMDB integrations matter for vulnerability management? | No | 0.00 |
| What approval workflows and audit trails should an autonomous remediation tool have? | No | 0.00 |
| How can I free analysts from manual vulnerability triage? | No | 0.00 |
| Can I get a free vulnerability risk assessment before committing to a platform? | No | 0.00 |
The set is 100 questions, sent to every engine every day. Perplexity returned only 1 and 30 answers on 7 and 8 October and a few other runs came back short, so the totals run a little short of a full week. Ninety leave Cogent's name out, because a shortlist forms before a buyer knows the vendor. The ten that carry it are there to watch how Cogent is described once it is found.
The 90 fall into nine topics, from prioritization to tool selection. Twelve of them name a competitor, as alternatives and head-to-head questions do. 40 of the 100 are marked as the ones to go after first.
Ten of ChatGPT's answers also replied to a second question that our tool merged in. They stay in the totals, because the tool counted them, but one that reviewed Cogent by name under an unrelated question is left out of the 8. And on 3 October the set also ran on Claude Code, on top of the day's Claude run: its answers count in the totals and not in the engine table.
90 leave Cogent's name out, in grey. 10 carry it, in colour.
61 of the 90 have evidence behind them that buyers ask. They hold 157 of the 202 appearances.
29 are ones we expect a buyer to ask and could not show that one has. They hold 45 of the 202, so read that split with care.
16 ask which tool to buy, what it costs or how to switch. They hold none of the 202.
12 name a competitor. 0 answers to them name or cite Cogent.
| Stage | Questions | Carries Cogent's name |
|---|---|---|
| Learning | 34 | No |
| Comparing | 38 | No |
| Buying | 16 | No |
| Running it | 2 | No |
| By name | 10 | Yes |
Across the 3,521 answers to questions that name no vendor, Tenable is named in 23.8%, Qualys in 21.6% and Rapid7 in 17.1%. Cogent is named in 0.2%, tenth of the eleven brands we track.
Cogent does appear in 202 answers, which is 5.0% of them and close to Nucleus Security's 6.7%, but 194 of those are a link in the sources. Of the 8 that write the name, 5 list it as one example and 3 credit its research, and none recommends it.
“Would you like me to create a comparison table of leading 2026 tools (like Tenable, Qualys, Rapid7, Wiz, Maze, Cogent) showing which features they excel at?”
4,062 answers on the 90 questions without its name, by stage. Cells run question by question, the busiest first.
| Stage | Answers | Writes Cogent's name | Cites cogent.com, no name |
|---|---|---|---|
| Learning | 1531 | 5 | 113 |
| Comparing | 1720 | 3 | 81 |
| Buying | 722 | 0 | 0 |
| Running it | 89 | 0 | 0 |
Share of answers naming or citing Cogent, against the tracked rival named most on that kind of question. A rival counts only when named, which flatters Cogent if anything.
| Kind of question | Questions | Answers | Cogent, % | Rival named most | Rival, % |
|---|---|---|---|---|---|
| Exposure management | 10 | 451 | 8.4 | Tenable | 23.7 |
| AI and agents | 11 | 497 | 5.2 | Tenable | 11.3 |
| Remediation | 9 | 409 | 4.2 | Tenable | 16.6 |
| Prioritization | 10 | 453 | 2 | Tenable | 40.4 |
| "Best X" shortlists | 8 | 359 | 0 | Tenable | 79.9 |
| Alternatives to a rival | 5 | 226 | 0 | Tenable | 94.7 |
| Head-to-head | 5 | 226 | 0 | Tenable | 68.6 |
| Pricing | 2 | 91 | 0 | Qualys | 56 |
How strongly the engines recommend a brand, from 0 to 100. Every answer is graded the way a buyer reads it, from 1.0 for a top pick down to 0.05 for a bare source link.
| Brand | Salienz Score | Share of answers it appears in | Average grade |
|---|---|---|---|
| Tenable | 13.8 | 35.8% | 0.39 |
| Nucleus Security | 3.0 | 6.7% | 0.45 |
| Cogent | 0.3 | 5% | 0.06 |
3 of the 8 answers that write Cogent's name do so to credit its research on scanner detection gaps, all on one question about why scanners miss exploitable vulnerabilities.
“It was published by Cogent Security, a cybersecurity vendor, so its findings should be considered alongside independent evaluations.”
Asked for "the best AI vulnerability remediation tools", the phrase closest to what Cogent sells, the engines answer with code-fixing tools. Snyk is in 38 of 46 answers and Semgrep in 21. Cogent is in none.
“Best overall for application vulnerability fixes: Snyk”
ChatGPT names or cites Cogent in 15.6% of its answers on these questions, Copilot in 10.6% and Perplexity in 6.3%. Gemini, Google AI Mode and Google AI Overviews are each under 2%, and Claude neither names nor cites it in 630 answers.
The table below counts names alone, the same way for every brand, and there no engine reaches 1% for Cogent. Claude is where the incumbents are strongest: it names Tenable in 48.5% of answers to questions that name no vendor, Qualys in 44.9% and Rapid7 in 42.3%.
Darker cells are higher shares. Names only: a citation without the name does not count here, for anyone.
CPL Microsoft Copilot · GPT ChatGPT · PPX Perplexity · AIO Google AI Overviews · GEM Gemini · AIM Google AI Mode · CLD Claude
| Engine | Cogent | Tenable | Qualys | Rapid7 | ServiceNow | Nucleus Security | Zafran | Maze |
|---|---|---|---|---|---|---|---|---|
| Microsoft Copilot | 0.92 | 21.79 | 21.06 | 15.75 | 6.96 | 1.65 | 0.00 | 0.55 |
| ChatGPT | 0.37 | 19.96 | 17.95 | 16.67 | 11.90 | 0.73 | 0.00 | 0.00 |
| Perplexity | 0.30 | 6.71 | 6.40 | 5.18 | 3.96 | 0.61 | 0.30 | 0.00 |
| Google AI Overviews | 0.00 | 19.52 | 16.27 | 9.33 | 10.63 | 1.30 | 0.00 | 0.00 |
| Gemini | 0.00 | 20.33 | 19.05 | 11.36 | 21.43 | 0.37 | 0.55 | 0.18 |
| Google AI Mode | 0.00 | 21.70 | 17.45 | 11.49 | 13.62 | 1.28 | 0.64 | 0.00 |
| Claude | 0.00 | 48.53 | 44.87 | 42.31 | 14.10 | 6.96 | 0.00 | 0.00 |
“Tenable One / Tenable.io — Probably the most widely deployed enterprise vulnerability management platform.”
On the 90 questions that leave Cogent's name out, the engines cited a source 27,564 times. cogent.com took 225 of those citations, and it is the 12th most-cited site of 2,887 by answers, ahead of qualys.com and the site of every AI-native rival we track.
171 of the 225 go to the Academy, articles on remediation SLAs, vulnerability backlogs and metrics. Its platform pages take 3. Engines use Cogent for how vulnerability management works and cite almost nothing about what it sells.
The lists they lean on when a buyer asks what to buy leave it out. 582 of the round-ups, comparisons and reviews they cited name a tracked rival and not Cogent.
Split by who owns the page cited.
| Owner | Citations | Share |
|---|---|---|
| cogent.com | 225 | 0.8% |
| Rival sites | 3,228 | 11.7% |
| Everyone else | 24,111 | 87.5% |
How often each is cited, and how early in the answer it lands.
| Page | Citations | Average position |
|---|---|---|
| /academy/vulnerability-remediation-slas-how-to-set-them | 27 | 4.4 |
| /academy/the-vulnerability-backlog-problem | 21 | 6.5 |
| /academy/vulnerability-management-metrics-that-matter | 20 | 3.7 |
| /academy/vulnerability-management-vs-exposure-management | 19 | 3.5 |
| /blog/2026-q2-detection-gap-report-findings | 16 | 5.4 |
| /academy/internal-vs-external-attack-surface | 13 | 3.0 |
| /academy/what-is-continuous-threat-exposure-management-ctem | 12 | 8.7 |
| /academy/vulnerability-management-lifecycle | 10 | 2.8 |
Of these, 2 sell security software themselves.
| Site | Kind | Citations |
|---|---|---|
| nist.gov | Docs | 982 |
| cisa.gov | Docs | 773 |
| gartner.com | Analyst | 750 |
| nhimg.org | Directory | 735 |
| microsoft.com | Vendor | 379 |
| linkedin.com | Platform | 358 |
| safeguard.sh | Vendor | 343 |
| youtube.com | Platform | 342 |
Pages cited in the week that name tracked rivals and not Cogent.
| Page | Rivals named | Cited |
|---|---|---|
| orca.securityBest Vulnerability Management Tools in 2026 | Orca Security | Qualys, Rapid7, ServiceNow, Tenable | 86 |
| ciopages.comBuyer's Guide: Vulnerability Management Platforms | CIOPages Buyer Guide | ArmorCode, Nucleus Security, Qualys, Rapid7, ServiceNow, Tenable | 74 |
| technologymatch.comTenable vs Qualys vs Rapid7: The IT Leader's Definitive Vulnerability Management Guide | Qualys, Rapid7, ServiceNow, Tenable | 58 |
| pdq.com10 best vulnerability management tools 2026: Top platforms | PDQ | Qualys, Rapid7, Tenable | 56 |
| safeguard.shBest Vulnerability Management Tools in 2026 | Qualys, Rapid7, Tenable | 55 |
| evulnable.comQualys vs Tenable vs Rapid7 — Vulnerability Management | Qualys, Rapid7, ServiceNow, Tenable | 54 |
“Whats the best Vulnerability management system on the market?”
“Cogent Security Secures $42 Million to Transform ...”
Cogent appeared in 24 to 35 answers a day and was named in 0 to 3. One answer more or fewer moves the second line a long way, so the shape means little.
The last day ran short: on 9 October three engines returned few or no answers, so it rests on 365 answers against 541 to 720 on the others. Its higher share comes from which engines stayed in. Seven days gives a baseline. A direction takes a month of readings.
One scale per panel. The shaded day ran on fewer answers.
| Day | Answers naming or citing Cogent | Answers writing its name | Answers collected |
|---|---|---|---|
| 3 Oct | 4.44% | 0.00% | 720 |
| 4 Oct | 4.31% | 0.16% | 627 |
| 5 Oct | 4.65% | 0.48% | 623 |
| 6 Oct | 5.61% | 0.32% | 624 |
| 7 Oct | 4.44% | 0.18% | 541 |
| 8 Oct | 4.98% | 0.00% | 562 |
| 9 Oct | 7.40% | 0.27% | 365 |
Each of these opens once the site is connected to our tool.
No work has started, and this is the shape it would take: twelve weeks that put Cogent on the pages engines read when a buyer is choosing, and put its name into the pages they already cite.
Two facts wait on Cogent. On what the company is, more than half of the 45 answers bring in a different business with a similar name, and on what it costs they repeat a figure from a marketplace listing. Until Cogent confirms both, this page repeats neither.
In the order it ships. Week twelve re-runs the whole set.
Each answer stands on its own, with the numbers and the dates it rests on, so it can be quoted without the charts. Every figure comes from the same read as the rest of the page.
Between 3 and 9 October 2026, seven AI engines answered 90 vulnerability management questions that leave Cogent's name out. Cogent appeared in 202 of 4,062 answers. 194 of those cite cogent.com without the name, and 8 write the name. On the 16 buying questions it appeared in 0 of 722.
On questions that name no vendor, Tenable was named in 23.8% of answers, Qualys in 21.6% and Rapid7 in 17.1%. ServiceNow followed at 12.3% and Nucleus Security at 2.1%. Cogent was named in 0.2%.
171 of the 225 citations to cogent.com on these questions go to its Academy, a library of articles on remediation SLAs, backlogs and metrics. Engines use those pages as references on educational questions. Of the 8 answers that write the name, 5 list it as one example and 3 credit its research. None recommends it.
ChatGPT named or cited Cogent in 15.6% of its answers on these questions, Microsoft Copilot in 10.6% and Perplexity in 6.3%. Gemini, Google AI Mode and Google AI Overviews were each under 2%, and Claude never named or cited it in 630 answers.
0.3 out of 100, with a 95% range of 0.2 to 0.4. The Salienz Score grades every answer the way a buyer reads it, from 1.0 for a top pick down to 0.05 for a bare source link. On the same scale Tenable scored 13.8 and Nucleus Security 3.0.
With our tracking tool, which asked 100 buyer questions every day for seven days on ChatGPT, Claude, Gemini, Perplexity, Google AI Overviews, Google AI Mode and Microsoft Copilot, against ten fixed rivals. It read 4,514 answers and traced 31,297 citations. An answer counts as naming a brand only when it says the name in its own sentences.
Start your own
An audit measures where you actually stand and names the work that would move it. Nothing moves on its own: the reading changes when the fixes ship. You get the baseline either way, whether or not it flatters anyone.