The verdict in three sentences
For a cybersecurity firm in Dublin, SEO still captures the CISO who types "penetration testing Dublin" with a budget already approved, while AEO/GEO decides whether your firm is named when the same CISO asks an AI assistant like ChatGPT to shortlist NIS2 or DORA specialists. Most firms should fund SEO first and add AI visibility once their service pages are factual and their certifications are stated exactly as held. Measure SEO with Search Console and qualified leads, and AEO with a dated record of AI answers to the same questions; anything else is opinion.
Two channels, two moments in the buying cycle
Security buyers in Ireland move in two modes. In urgent mode, after a phishing incident or an audit finding, they search for a specific service and call within the hour. In shortlisting mode, before a NIS2 readiness project or a managed SOC tender, they research for weeks, and increasingly they ask AI assistants to summarise who does what in Dublin. The two channels serve these two modes differently.
| Criterion | SEO | AEO/GEO |
|---|---|---|
| What it targets | Positions on queries such as "SOC as a service Ireland" or "pentest Dublin" | Being named, accurately, when buyers ask AI assistants for a shortlist |
| Typical time to effect | 4 to 9 months for competitive service terms | 2 to 6 months for answers to change, uneven across questions |
| 2026 market budget ballpark | EUR 1,500 to 5,000 per month, typical Dublin agency quotes | EUR 2,000 to 5,000 diagnostic, then EUR 1,000 to 4,000 per month |
| Core metrics | Impressions, clicks, qualified enquiries, pipeline | Share of answers naming the firm, accuracy, enquiries citing AI |
| Main risk | Thin service pages that rank for nothing | AI repeating outdated certifications or services |
| What it needs from you | Pages per service, case material you can publish, technical health | Consistent public facts, third-party mentions, factual explanations |
The overlap is large. A clear page explaining what your incident response retainer covers, response times and who answers the hotline serves both channels at once. The difference lies in what you measure and how quickly you can expect movement.
Where to put the first euro: a decision table by situation
| Your situation | Fund first | Why |
|---|---|---|
| New firm, under two years, few published references | SEO on 4 to 6 core service pages | AI assistants have little to cite until the basics exist |
| Established brand, partners known in the Irish market | AEO/GEO diagnostic alongside SEO | Your name is already cited; accuracy becomes the issue |
| Clients in financial services (DORA, Central Bank of Ireland supervision) | SEO and AEO on regulatory content, reviewed by counsel | Buyers ask detailed compliance questions in both channels |
| Limited budget, under EUR 2,000 per month | SEO only, plus quarterly AI answer checks | Measurement is cheap; full AEO work can wait |
| Incident response hotline as a key offer | SEO on urgent queries first | Urgent buyers search and call; they rarely ask an assistant |
| Expansion to the UK or continental EU | AEO/GEO diagnostic per market | Answers differ by country and must be checked separately |
Two details matter for this niche. Certifications and accreditations, such as CREST membership or ISO 27001 certification, should only appear as actually held, with scope and dates, because both search engines and AI assistants will repeat whatever you publish. And never describe client incidents or name clients without written consent; the trust cost is far higher than any traffic gain.
How results are measured, and what a diagnostic covers
SEO is measured in Google Search Console (impressions and clicks on service queries), in your analytics (enquiries by landing page) and in your CRM (pipeline and contracts by source). A serious provider reports these monthly and does not promise positions; no serious provider promises a ranking.
AEO/GEO is measured with a fixed list of 20 to 40 buyer questions, asked on fixed dates, with the answers saved. You track how often your firm is named, whether what is said is accurate, and which enquiries mention an AI assistant.
A diagnostic, in broad terms, should cover: the current answers to your buyers' questions, the consistency of your firm's public facts across site, directories and partner pages, the state of your service pages, technical health for search, and a prioritised list of gaps. It should also flag data and accessibility points. Contact forms on a security firm's site collect personal data under the GDPR and the Data Protection Act 2018, overseen by the Data Protection Commission, and the European Accessibility Act raises expectations for digital services. Stay general here and check specifics with your counsel. This is not legal advice.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Illustrative example. Liffey Shield Security, a fictional 14-person Dublin firm offering pentests and a managed SOC, has EUR 4,000 per month for twelve months. It decides on EUR 2,800 for SEO and EUR 1,200 for AI visibility, after a one-off EUR 3,000 diagnostic. Year one: 3,000 + 12 × 4,000 = EUR 51,000.
Its break-even is easy to compute. One managed SOC contract at EUR 60,000 per year (market assumption) covers the full spend, and two pentest engagements at EUR 15,000 each (market assumption) cover more than half. The firm reviews the split after six months, using Search Console data and the dated answer record, not impressions alone.
FAQ
Is AEO/GEO replacing SEO for cybersecurity firms?
Not in 2026. Urgent buyers still search and call, and SEO remains the main source of inbound enquiries for most firms; AEO adds a second channel at the shortlisting stage, often from EUR 1,000 per month.
How long before we see results in Dublin?
For SEO, 4 to 9 months on competitive service terms. For AI answers, changes can appear within 2 to 6 months, but unevenly, which is why a dated record of 20 to 40 questions matters.
Should we publish our CREST or ISO 27001 status?
Yes, if you hold it, exactly as held, with scope and dates. Outdated or overstated claims are repeated by AI assistants and can cost you a tender worth EUR 100,000 or more.
What does a diagnostic cost on the market?
As a 2026 ballpark, EUR 2,000 to 5,000 for a one-off diagnostic from a Dublin or European agency. At Kolonell, the diagnostic and any follow-up work are on quote.
Can any agency guarantee that ChatGPT will name our firm?
No. AI assistants rely on public sources that no provider controls; a serious offer commits to the work and to monthly measurement on a fixed list of questions.
Find out how AI assistants describe your firm. We record what they say today about your services, certifications and incident response offer, and show where to invest first. Request a diagnostic quote: reply within 48 hours.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
