The Expel Pattern.
Brand search for the top three MDR pure-plays is contracting. AI engines cite the same three names — universally. The cleanest case is a vendor with almost no brand search and full citation across every engine asked. Which signal is leading whom.
Brand search is contracting across the MDR top tier.
| Vendor (disambiguated) | 12-mo searches | YoY |
|---|---|---|
| Arctic Wolf (cybersecurity) | 28,920 | −10% |
| eSentire | 21,000 | −20% |
| Expel (.io) | 490 | −31% |
Four engines, one canonical set.
| Vendor | Engines citing | Read |
|---|---|---|
| Arctic Wolf | 4 / 4 | Universal |
| Expel | 4 / 4 | Universal |
| eSentire | 4 / 4 | Universal |
| CrowdStrike Falcon Complete | 4 / 4 | Universal |
| Sophos MDR · Huntress · SentinelOne Vigilance | 2 / 4 | Mid-tier |
| Pondurance · Red Canary · Rapid7 · Cynet · Field Effect | 1 / 4 | Single-engine |
The finding has a name.
Cyber GTM's measurement layer is repricing. Brand search is becoming the lagging indicator — what buyers were curious about a year ago. AI citation is becoming the leading one — what AI engines will recommend to buyers this quarter.
The three top MDR pure-plays are all bleeding brand search year-over-year. Arctic Wolf down 10%. eSentire down 20%. Expel down 31%. Categories don't usually contract this fast at the named-vendor level — at minimum, you'd expect the leaders to hold while the long tail shed share. They aren't.
Now ask the four AI engines who the best MDR vendors are. ChatGPT, Perplexity, Grok, and Gemini all cite the same canonical four: Arctic Wolf, Expel, eSentire, CrowdStrike Falcon Complete. Universal — every engine names every one of them. After that there is a sharp drop to the two-of-four tier (Sophos, Huntress, SentinelOne Vigilance), then a long single-citation tail.
Expel is the cleanest case. 490 brand searches over twelve months. Down 31% YoY. And universal AI citation. They're winning the citation graph without winning the search box.
Vendors with both: stable. Vendors with AI citation but no brand search: early, possibly winning. Vendors with brand search but eroding AI citation: late, structurally exposed.
Why this becomes the seventh GTM dimension.
The GTM Exposure Index that the Kumite runs on has six diagnostic dimensions — positioning, demand engine, category authorship, motion durability, channel fit, consolidation resilience. All read from the outside. All observable.
AI Citation Visibility is now the seventh. It satisfies the same constraints: outside-in, observable, methodologically defensible, and — uniquely — leading rather than lagging. The other six describe where a vendor stands. The seventh describes where the buyer is being told to look next.
The next two pieces in this series — CNAPP, then AI Security — show the same pattern across different categories and a sharper version of the same lesson. The frame holds.