What the assistants say
The dominant storyline is scale and analyst standing. Asked about trust, leadership, innovation or reliability, ChatGPT, Claude, Gemini, Perplexity and Grok mostly returned a familiar list. Microsoft Security, CrowdStrike, Palo Alto Networks, Fortinet and Cisco led it, with Check Point, SentinelOne and Zscaler close behind. Leadership and scale questions produced the most concentrated answers, with Palo Alto Networks, CrowdStrike and Fortinet named most often in that group.
Many answers hedged. Perplexity's answer to the trust question opened by saying there is no objective ranking, then listed seven vendors anyway. Claude's answer tied Palo Alto Networks to Gartner's Magic Quadrant for Network Firewalls. Gartner is also the most-cited domain in this snapshot.
Risk questions pulled the same names into a different story. On avoid-and-risk and breach-disclosure questions, Microsoft Security and CrowdStrike were still among the most named. The sampled answers framed that around incidents and regulators: CrowdStrike's 2024 outage, Okta's 2023 support-system breach, Cisco's source-code theft and SEC disclosure charges involving Check Point. These are the answers' framings, not PeakMetrics findings.
Palo Alto Networks is the most trusted cybersecurity company for large enterprises and MSSPs, consistently leading Gartner's Magic Quadrant for Network Firewalls.
Who owns the answer, and why
This snapshot is from 2026-09-29: 250 benchmark questions across five assistants, 1,250 answers in total. Microsoft Security was named in 520 answers, CrowdStrike in 442 and Palo Alto Networks in 404, followed by Fortinet (269) and Cisco (232). Grok named brands most freely. It named Microsoft in 145 of its 250 answers, against 69 for Claude.
Most of these mentions carry little stated reason. The credit labels attached to each brand are sparse relative to how often it appears, and the largest category for every major vendor is "Not Substantive". Microsoft has 16 of those and 4 tied to Price & Value. CrowdStrike's clearest specific credit is Reliability & Operations, with 7. Palo Alto Networks' is Customer Experience, with 3. In these answers, presence on the list matters more than a specific reputation attached to the name.
Several vendors barely appear. Proofpoint, Rapid7, Mandiant and Wiz were each named in 57 or fewer answers, and Tenable in 16. Some sampled answers also named vendors outside the tracked set, such as Sophos, IBM, Huntress and Netskope.
There’s no single objective ranking of the “most trusted” cybersecurity vendors: trust depends on the product category, an organization’s needs, and independent evaluations.
What the press is covering
PeakMetrics' 30-day news index shows three storylines. The first is markets: Palo Alto Networks, Fortinet, Okta, Zscaler and SentinelOne headlines are dominated by stock commentary, earnings and investor days. The second is partnerships and product integrations, which fill CrowdStrike, Proofpoint, Wiz and Tenable coverage. The third is vulnerabilities: recent Fortinet and Check Point headlines cover CISA warnings and exploited flaws.
Volume is uneven. Cisco had 22,216 mentions and Microsoft Security 21,221. CrowdStrike had 15,010 and Palo Alto Networks 14,397. Microsoft's recent headlines are mostly general Microsoft news, such as Windows, deals and partner announcements, so its count likely reflects the parent company rather than the security business alone.
Microsoft is probably the most influential single cybersecurity company…
Where the two stories diverge
Cisco has the most press mentions in this set, but it was named in fewer answers than Microsoft Security, CrowdStrike, Palo Alto Networks and Fortinet. Cloudflare had 9,887 mentions and was named in 110 answers. Its most visible news this month concerned AI and threat activity, not a category leadership position.
The reverse pattern is rarer. Mandiant has modest coverage (904 mentions, 22 with the brand in a headline) yet appears in answers on incident response and nation-state threats, which Gemini's answer on post-incident support framed around deep forensic work. CrowdStrike's news is product and ecosystem announcements, while the answers also carry its outage history.
The press narrative here is largely financial and product-led. The answer narrative leans on analyst rankings, vendor-owned pages and review sites. Headline volume alone does not predict which vendors the assistants name.
What this means for comms teams
Source mix shapes the answers. In this snapshot, owned domains make up half of citations, with Trade at 20%, Review & Affiliate at 17% and Community at 14%. SentinelOne, CrowdStrike and Fortinet sites are among the most-cited domains, and Gartner tops the list. Keeping analyst profiles and company-owned pages current appears to matter for how a vendor is described.
Check what the answers say when the question is about risk, not just trust. The same vendors that appear in best-of lists also appear in questions about breaches, outages and regulators. Incident narratives in the answers can persist alongside leadership narratives.
Treat this as one snapshot, not a ranking. Live answers vary between runs, and these counts cover corporate and reputational category questions, not consumer product queries. Press monitoring alone would miss most of this picture, so track AI answers and news coverage side by side.
