The verdict in three sentences
In Amsterdam, a growing share of CISOs and CIOs begin shortlisting providers by asking AI assistants like ChatGPT, well before any tender is issued. A cybersecurity firm appears in those answers when the public information about it is consistent, factual and confirmed by third parties: certifications actually held, clearly described services, mentions in specialist press and industry associations. The market prices a diagnostic at EUR 2,500 to 8,000 in 2026, and the effect is measured on a dated record of answers, never on a promise of being cited.
What buyers ask AI assistants in Amsterdam
The questions below are realistic examples of what a CISO at a fintech, a port logistics group or a SaaS scale-up might type today. They are often in English, sometimes in Dutch.
| Question asked of the AI | Buyer profile | What the answer needs to find about you |
|---|---|---|
| Which firms in Amsterdam run CREST-accredited penetration tests? | CISO at a scale-up | Accreditation actually held, pentest service page |
| Who can help a Dutch fintech prepare for TLPT under DORA? | Risk lead at a financial entity | Financial sector experience described without naming unauthorised clients |
| NIS2 gap assessment providers in the Netherlands for a 500-employee manufacturer | CIO at a mid-sized company | Factual NIS2 page, general approach, sectors covered |
| What does a 24/7 incident response retainer cost in Amsterdam? | CFO, CIO | Ranges or price factors, visible emergency number |
| Managed SOC in Dutch and English for a 300-person company | CIO | Team languages, SOC scope, hours |
| Is [firm name] ISO 27001 certified? | Buyer at verification stage | Certificate, scope and date, consistent everywhere |
| Compare MDR providers in the Benelux | Selection committee | Clear positioning, team size, regions covered |
The verification question (row six) carries the most risk: if an AI answers inaccurately about your certification or scope, the buyer may drop you without ever getting in touch.
Why some firms appear and others do not
| Factor | What AI assistants seem to pick up | Common gap at cybersecurity firms |
|---|---|---|
| Consistent public information | Same description of the business on the site, directories, professional profiles | Site says "SOC", directory says "GDPR consulting" |
| Factual, precise pages | Service pages with scope, standards, deliverables | Generic marketing pages with nothing verifiable |
| Third-party mentions | Specialist press, professional associations, conferences | Visibility limited to the team's own networks |
| Structured data | Organisation, services, address, contacts readable by machines | No markup, conflicting addresses |
| Verifiable certifications | Accreditations cited with scope and date | Undated logos, expired certifications still displayed |
| Freshness | Dated, updated content | Last article published two years ago |
There is no guarantee: AI assistants like ChatGPT build their answers according to their own rules, which change. Serious work raises the likelihood that accurate information is found and reused.
What the work covers, and what it costs
In broad terms: a diagnostic of current answers, bringing public information into line, factual pages on services and certifications, structured data, and work on third-party mentions. The market is young; 2026 ballpark, based on typical agency quotes and public rate pages in Europe:
| Service | 2026 range (EUR) | Note |
|---|---|---|
| One-off AI visibility diagnostic | 2,500 to 8,000 | Dated record across 20 to 50 questions |
| Monthly programme | 1,500 to 6,000 / month | Content, consistency, monitoring |
| Specialist PR and third-party mentions | 2,000 to 10,000 / month | Depending on the number of markets |
| Rework of service and certification pages | 3,000 to 15,000 | Often shared with SEO work |
| Copywriting in Dutch and English | 150 to 400 per page | Technical review by your experts |
At Kolonell, this work is on quote, after an initial diagnostic.
Constraints to keep in mind: name no client or incident without written permission, claim only the certifications (CREST, ISO 27001) you actually hold, and comply with the GDPR (AVG) under the supervision of the Autoriteit Persoonsgegevens. If your clients are supervised by the AFM or DNB, their own confidentiality obligations limit what you can publish. This is not legal advice.
How it is measured
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Measurement rests on a dated record: the same questions asked at regular intervals, with three indicators. The share of answers that mention your firm, the accuracy of what is said (services, certifications, location), and whether your pages appear among the cited sources when the AI shows them. Traffic from assistants and inbound enquiries that mention an AI complete the picture.
Mini case study
Illustrative example: Grachtwacht Security (fictional), 40 people in Amsterdam, specialised in penetration testing. The initial record across 30 questions shows a mention in 3 answers, or 10%, one of them inaccurate about a SOC offering the firm does not provide. Budget considered: a diagnostic at EUR 5,000, then 6 months at EUR 3,500, or EUR 21,000, for EUR 26,000 in total. An average pentest engagement is worth EUR 18,000 with an estimated 35% margin, so EUR 6,300. Break-even is 26,000 / 6,300 = 4.13, so 5 engagements over 12 to 18 months. The decision rests on whether that number is plausible, not on a promise.
FAQ
Do CISOs really use AI to choose a provider?
Increasingly for shortlisting: drawing up a list of 5 to 10 names, checking a certification, comparing ranges. The final decision stays human, but being absent upstream shrinks the list before the tender even starts.
Can we be sure ChatGPT will cite us?
No, and no serious provider can promise it. What you can measure, across 20 to 50 dated questions, is whether your firm appears more often and whether what is said is accurate.
What does this work cost in Amsterdam in 2026?
A one-off diagnostic sits around EUR 2,500 to 8,000, a monthly programme EUR 1,500 to 6,000 depending on ambition. This is a market ballpark and still very variable.
Is this different from SEO?
The two overlap heavily: clear pages, structured data, third-party mentions. AI visibility adds monitoring of the answers themselves and close attention to accuracy, which matters most when an error concerns a certification.
Do we need Dutch content?
For public buyers and Dutch mid-sized companies, yes; for international scale-ups, English dominates. Budget EUR 150 to 400 per written page, including technical review by your experts.
Find out how AI assistants describe your firm. We record what AI assistants say about your firm today across a selection of buyer questions in Amsterdam. Request a diagnostic quote: reply within 48 hours.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
