Fewer than three in ten AI and search citations for UK cyber compliance queries go to a firm small enough to hire directly.

The headline finding

Across every citation we recorded for these queries, fewer than three in ten (27.5%) go to a firm small enough to be in this study's boutique consultancy population. Another 30.1% go to firms the study looked at and excluded, on size, ownership or non-UK jurisdiction grounds. The remaining 42.4%, the largest single share, goes to names that were never candidates: enterprise players like Evalian, Bridewell and NCC Group, plus government bodies, certification bodies, review platforms and directory sites.

Those shares cover all four platforms, Google's organic results included. Count only the three AI platforms and the boutique share drops to 26.6%.

So a buyer asking an AI assistant who to hire for NIS2 or Cyber Essentials work sees a boutique firm in roughly one citation in four. Most of what they see is a large firm, an excluded firm, or a source that isn't a consultancy at all.

Why do large firms dominate?

Evalian, the most-cited firm in this study, appears in six of the study's seven queries (counting both the citation records and the citation URL log), with distinct, precisely-targeted content for nearly every query variant. Bridewell and URM Consulting show a similar pattern. This breadth compounds: covering more of the topic cluster means more chances to be the answer, in more contexts.

Third-party sites, not just size

Third-party sites make up a large share of how the biggest firms win citations. Evalian's citations trace to Trustpilot as well as its own site. Bridewell's citations trace to a compliance directory and a competitor's own roundup article, not just bridewell.com. This is not incidental: third-party validation and third-party listings are doing real, measurable work.

Most of these sites are not closed to smaller firms. Award programmes such as the Cyber Security Awards and SME News' IT Awards judge on submitted evidence, not company size, and several are free to enter. Trustpilot, LinkedIn, and Crunchbase are open to any business, at no cost. The UK Government's own procurement platform, the Digital Marketplace, is open to any firm that applies through the framework, and in this study, a single small firm's listing there was cited across three separate AI systems using an identical URL, something none of the large firms in the study matched.

A few categories are genuinely harder to reach. Trade show exhibitor directories require paying for a stand, often running into thousands of pounds. Full CREST accreditation and the NCSC's assured consultancy scheme both require real, assessed technical capability, not just an application. These are worth working toward, but they are not something a firm adds to its profile this month.

Small firms do break through

24.8% of the study's boutique and independent firms (37 of 149) secured at least one citation on ChatGPT, Perplexity or Google AI Overviews across the seven queries. Include Google's organic results and it's 29.5% (44 firms). Not universal, but far from rare.

Eight of those firms were cited on two or more platforms rather than once, so the win can be repeated.

Two playbooks emerge

Case studies

The SEO story vs. the platform-independent story

Credentialed, but barely visible to AI

These two firms are the clearest illustration of the AI Visibility Gap inside this study's own data: real-world credibility that never reaches the AI layer.

Methodology

Each of seven buyer queries was tested across four platforms in August 2026: ChatGPT, Perplexity, Google AI Overviews, and Google Search organic results. Every named entity in every response was logged, not only the firms already known to the study, so that citation patterns could be measured comprehensively rather than against a pre-selected shortlist.

Firms were excluded from the boutique study population on three grounds: more than approximately 50 direct employees, private equity or venture capital ownership regardless of headcount, or non-UK jurisdiction. Because large enterprise players were excluded from the prospect population by design, their own AI citation dominance, while visible in the raw data, was never systematically measured in the way this study measured the boutique population.

Known gap. All four platforms were run for Q3 ("Most trustworthy cyber security consultants for NIS2 compliance UK"), but only the Perplexity and Google AI Overview answers survive. They were rebuilt from the separate log of cited URLs. The ChatGPT and Google Search results for Q3 were not kept, so Q3 counts cover two of its four platforms. Q8, an MSSP query run later, is published separately and isn't in any figure on this page.

Data and version history

The full dataset is free to use under CC BY 4.0: the query list, the 212 firms assessed with their inclusion status, all 229 citation records, the citation URL log and the supplementary Q8 records. Download the dataset (.xlsx).

DOI: 10.5281/zenodo.23453134. Also listed in the AI Visibility Gap Research community on Zenodo.

18 October 2026. Figures recalculated from the published dataset. The 16 surviving Q3 records were added (213 to 229 records). The population count was corrected from 143 to 149: one duplicate removed and two included firms added that had been left off the sourcing list. Shares now use a documented rule, so the earlier 21.6% / 24.4% / 54.0% split became 27.5% / 30.1% / 42.4%. C3IA's single source citation was added, and the multi-platform table now has eight firms.

Need to know whether AI platforms recommend your firm?

We produce category-level and company-level AI visibility reports showing where your brand appears, where competitors appear, and which third-party sources influence AI recommendations in your category.

Summary

The mechanics behind large-firm dominance are not a mystery, and they are not exclusively theirs. Awards, reviews, and government directories are largely open to firms of any size. A handful of routes are gated by cost or genuine professional accreditation. Knowing which is which determines where a smaller firm should spend its time first.