The verdict in three sentences
In Riyadh, part of the shortlisting of cybersecurity providers now happens in AI assistants like ChatGPT: a CISO or CIO asks for a short list before even opening a search engine. A firm shows up when the public information about it is consistent, factual and confirmed by third parties: precise services, certifications actually held, an identifiable team, technical publications. This work is measured with a dated record of the answers to the same questions, never with a promise of being recommended.
What Riyadh buyers ask AI assistants
The questions read like tender requirements. They combine a service, a compliance framework and a local criterion (Saudi presence, Arabic-speaking team, data hosting).
| Typical question put to an AI assistant | Buyer profile | What the answer needs to cite |
|---|---|---|
| Which firms run application penetration tests in Riyadh with certified testers? | CISO at a fintech | Described service, individual certifications actually held |
| Who offers a 24/7 managed SOC with a team in Saudi Arabia? | CIO at an industrial group | Team location, hours, scope |
| Which provider helps with NCA controls compliance? | Compliance lead at a semi-government entity | Clear compliance pages, no certification promise |
| Which firm has an incident response hotline in Riyadh? | Head of operations after an alert | Emergency number, stated response time |
| Which firms are ISO 27001 and CREST certified in Saudi Arabia? | Public sector buyer | Verifiable certifications, certified entity named |
| Compare two red team providers for a bank in Riyadh | Bank CISO | Public methodology, publications, team |
| Who can audit our PDPL compliance? | Data protection officer | Described offer, clear limits |
The NCA (National Cybersecurity Authority) publishes cybersecurity controls that many buyers cite in their tenders. The PDPL, enforced by SDAIA since September 2023, governs personal data. Stay factual about what you cover. This is not legal advice.
Why some firms get cited and others do not
AI assistants like ChatGPT build answers from what is readable and corroborated on the web. A highly capable firm with thin public documentation stays invisible.
| Factor | What helps | What hurts |
|---|---|---|
| Consistent information | Same name, same Riyadh address, same services everywhere | Conflicting listings, old company name |
| Factual service pages | One page per service: scope, deliverables, typical duration | A single vague security solutions page |
| Certifications | Exact list, entity and scope, link to the registry where one exists | Logos shown without real certification |
| Third-party mentions | Conference talks, specialist press, vulnerability disclosures | No trace outside the site |
| Structured data | Organisation, services, address, contacts marked up | No markup |
| Freshness | Dated technical analyses, updated pages | Blog stopped in 2023 |
| Arabic and English | Key pages in both languages, consistent | Machine-translated, incomplete Arabic version |
One sector-specific point: never invent clients or incidents handled. An AI assistant that repeats a false claim from your site spreads it further, and a CISO will check it.
What the work covers and what it costs on the market
In broad terms, AI visibility work covers a diagnosis of current answers, cleaning up public information, rewriting service and compliance pages in Arabic and English, structured markup, and a plan to earn credible third-party mentions. It is an emerging market: prices vary widely.
| Service | 2026 ballpark | Note |
|---|---|---|
| One-off diagnosis of AI answers | 2,500 to 7,000 USD | 30 to 60 questions tested, report |
| Service and compliance page overhaul | 8,000 to 25,000 USD | Arabic and English, by number of services |
| Monthly support | 3,000 to 12,000 USD a month | Technical content, mentions, tracking |
| Quarterly record only | 1,000 to 3,000 USD a quarter | Same questions, answers archived |
| Specialist PR | 3,000 to 9,000 USD a month | Often separate |
These ranges come from typical Gulf agency quotes and public rate pages. At Kolonell, this work is on quote, after a diagnosis.
How it is measured, and what nobody can promise
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Measurement relies on a dated record: the same list of questions, asked at regular intervals, answers archived. Three indicators are tracked: the share of answers mentioning the firm, the accuracy of what is said (services, certifications, location) and competitor presence. Answers vary between sessions, so each question is asked several times. No provider can guarantee that an AI assistant will recommend you.
Mini case study
Illustrative example: Najd Secure Labs, 40 people in Riyadh, penetration testing and managed SOC. Baseline: 40 questions asked 3 times, so 120 answers; the firm appears in 9 of them, or 7.5%, and 3 of those answers attribute a service it no longer sells. After 6 months of cleanup and technical publications, the new record shows 27 mentions out of 120, or 22.5%, with a single error. Hypothetical budget: 5,000 USD diagnosis plus 6 × 6,000 USD = 41,000 USD. If one SOC contract worth 180,000 USD a year follows, the investment represents about 23% of the contract's first year.
FAQ
Do CISOs really use AI assistants to choose a provider?
Increasingly for shortlisting, rarely for the final decision. A short list of 3 to 5 names is often built this way before a tender.
How much does an AI visibility diagnosis cost?
As a 2026 ballpark, 2,500 to 7,000 USD depending on the number of questions tested (30 to 60) and languages. Monthly support runs from 3,000 to 12,000 USD.
Should we publish in Arabic?
Yes for service and compliance pages if you target Saudi government or semi-government entities. RTL scope is set in the quote.
Can we cite our CREST or ISO 27001 certifications?
Only those actually held, with the exact entity and scope. A wrongly displayed certification is a commercial and reputational risk.
How long before anything changes?
The first measurable differences often appear within 3 to 6 months, depending on how often the sources AI assistants rely on are updated.
Find out how AI assistants describe your firm. We record what AI assistants like ChatGPT say today about your firm when Riyadh CISOs ask, in Arabic and English. Request a diagnostic quote: reply within 48 hours.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
