The machine already has an opinion

Ask Perplexity which password manager to buy and it does not hesitate.

Best overall for most people, 1Password. Best premium alternative, NordPass. Best value and best free option, Bitwarden. Best privacy-focused free option, Proton Pass. Each claim carries a small superscript number, and the numbers lead off to Tom's Guide, Wirecutter, ZDNET, PCMag, a forum thread. It reads like advice from somebody who has done the reading. For a growing number of buyers it is the reading: the answer is the destination, not a list of places to go and look.

Then notice who wrote it. Every company in that answer is being recommended in words assembled by strangers, from sources none of them control, in a sentence they will never see.

We wanted to know how that sentence gets built, so we measured it. Seventy buying questions, the kind people actually type, across two categories chosen to behave differently: password managers, where buyers are frightened of getting it wrong, and robot vacuums, where they are comparing price and suction. Every question went through five surfaces: a retrieval engine built for agents, a conventional search index, and three answer engines. Four hundred and ninety calls, no failures. Then we audited the twenty brands those answers were choosing between, page by page, to see what each had done to prepare.

And we did one thing the commercial tools do not do. We ran every question twice: once with the model free to search the web, and once sealed off from it entirely.

That second run is where this piece comes from.

Taking an answer apart

When a model names a brand, the claim can have arrived from three different places, and they behave nothing alike.

It can come from your page. The model searched, retrieved your site, and lifted an answer out of it. You control this completely. Making a page easy for a machine to read is the discipline usually sold as answer engine optimisation.

It can come from the web's consensus about you. The model searched, but what it read was PCMag and Reddit and Wikipedia, and what it produced was a synthesis of what they collectively say. You influence this. You do not control it.

Or it can come from the model's memory. No search at all. The brand is simply present in the weights, absorbed during training from millions of pages written long before you woke up this morning. You cannot control this, you cannot edit it, and almost nobody is measuring it.

Almost everything sold as AI visibility operates on the first layer. Structured data, llms.txt, crawler permissions, question-shaped headings. All sensible. All aimed at the layer with the least leverage.

Your brand exists twice, and the two versions disagree

Here is what happened when we turned the web off.

Dashlane was named in 44% of answers when the model was working from memory, and 20% when it was allowed to search. LastPass fell from 44% to 24%. iRobot from 49% to 30%.

Three brands went the other way. RoboForm was named in none of the memory answers and 19% of the searched ones. Dreame rose from 9% to 36%. NordPass from 11% to 37%.

These are not rounding errors. They are two different populations.

Memory brands are the incumbents. They are baked into the weights by years of being written about, and they quietly lose ground the moment a model checks what the live web currently says. Dashlane, LastPass and iRobot sit here, and so, more gently, do 1Password and Bitwarden.

Retrieval brands are the mirror image. In the model's memory they barely exist. They appear when it goes and looks. Dreame, NordPass, RoboForm and Keeper sit here.

Now the part that explains why nobody has noticed. Averaged across all twenty brands, the difference between the two runs is nothing at all. The falls and the rises cancel almost exactly. Any tool measuring this at category level sees a flat line and reports that the web makes no difference, when in fact it is reshuffling the order of who gets recommended.

One brand in the study is strong in both conditions, Roborock, at roughly two thirds either way. That is what dominance actually looks like, and it is rare.

Why that matters more than it sounds

These two groups have opposite problems, and almost everyone treats them as one problem.

A memory brand is defending a description it cannot edit. Its reputation is fixed in a set of weights, formed from a web that has since moved on, and no amount of work on its own website touches it. Its only real move is to make the live web disagree, consistently and loudly enough that the next training cycle absorbs the correction. That is a programme measured in years, and it will never arrive on the quarter you needed it.

A retrieval brand has the opposite exposure. It is winning today on borrowed ground. It looks healthy in every dashboard, and it disappears the instant a model answers from memory, or a search call fails, or a user has search switched off. Its visibility is real but rented.

Same headline metric. Completely different work, completely different budget, completely different timescale.

The test that tells you which one you are takes an afternoon. Run your top questions twice, once with the model's web access on and once off, and compare. As far as we can tell, nobody is doing it, because no commercial platform offers it as a feature.

Who is writing your recommendation

Being named is the goal. That is worth saying plainly, because it is easy to get distracted by citation counts.

In our data, being cited and being recommended travel closely together. But the direction is not the one people assume. The most recommended brand in the study, Roborock, has its own domain appear in about one answer in fourteen of the answers that recommend it. iRobot, one in twenty-five. Shark is recommended in roughly a quarter of the answers in its category, and its own websites appear three times in the entire study.

So the model decides to recommend you, and sometimes links you afterwards. Citation is a by-product, not a route in.

What citation actually buys you is narrower, and worth having anyway.

The first thing is authorship. When a model builds its answer out of PCMag, a comparison site and a forum thread, you are recommended in someone else's words, using their feature list and their idea of your pricing. Shark is being sold to a quarter of that category by people who do not work at Shark.

The second is freshness. Your current price, your current plans, your current version. Third-party content is stale by construction.

The third is a route to correct an error, which we will come back to, because in some industries it is the only one that matters.

The pattern behind that figure is worth stating on its own. A retrieval engine pulls brand-owned pages for about a quarter of the sources it returns on password managers. The answer engines use them for seven to eleven per cent. In robot vacuums it is thinner still: thirteen per cent at the retrieval layer, five per cent in GPT's answers.

The pages are there. They are findable. They are simply not what gets used. Reddit is the most-cited domain on the conventional search index in both categories, and the most-cited source in Perplexity's answers in both, which makes it the second most-cited domain in the study overall.

What twenty brands had actually built

Before any of this, we looked at what each company had done to prepare, on the assumption that the well-prepared ones would be winning.

Five of the twenty had written any rules at all for AI crawlers. Ten published an llms.txt. Four deliberately served machine-readable formats to bots.

Bitwarden was the most thoughtful site we found. It hands AI crawlers markdown files rather than rendered HTML, and publishes three separate llms-full.txt endpoints for its blog, help centre and resources. Dashlane maintains a hand-curated list naming OpenAI, Anthropic, Google, Perplexity, Apple, Meta, xAI, Cohere and DeepSeek, allowing all of them everywhere except the payment pages. Somebody at both companies has clearly sat down and thought about this properly.

The other sixteen had done essentially nothing. Roborock, the most recommended brand in its category, has no robots.txt file at all. Dyson returns a 403 to an ordinary request.

And almost nobody has put anything readable behind the permission they granted. Across all twenty homepages there were three tables. 1Password's homepage contains 3,438 characters of text inside roughly a megabyte of JavaScript scaffolding. A retrieval engine arriving there finds a door held politely open onto an empty room.

Does the technical work do anything? We could not tell

This is where a study like this is supposed to produce a scorecard and a correlation, so here is the honest version.

We scored all twenty brands on fourteen technical signals and looked for a relationship with how often they were recommended. We did not find one. But twenty brands is a small sample, the result changes sign between the two categories, and the statistical range is wide enough to contain a real and useful effect. The correct conclusion is that we failed to find an effect, not that there is not one. Anyone telling you otherwise from twenty data points is overselling.

One pattern did come through clearly, and it is more interesting than a flat answer would have been.

In the password manager category, the brands with the richest entity presence, a proper Wikipedia article and a well-populated Wikidata record, were almost exactly the brands recommended most. The ordering is nearly perfect. In the robot vacuum category, that relationship disappears.

Read that as a difference in what the model reaches for. When a buyer is asking whether something can be trusted, the model leans on the reference web, the encyclopaedic layer, the places where facts are stated rather than opinions. When a buyer is comparing suction and battery life, it leans on reviewers.

Which means the right programme depends on what your buyers are actually anxious about. That is enough to act on. It is not enough to be smug about.

The leverage point

Donella Meadows spent her career on one question: where do you push a system to actually change it? Her answer, published in 1997 as Leverage Points: Places to Intervene in a System, was a ranked list of twelve, and the ranking was the whole argument. At the bottom, weakest of all, sit parameters: the numbers, the settings, the constants. Higher up sit the structures that determine what information flows where, and above those, the rules and the goals of the system itself.

Her warning was that parameters are where everybody intervenes, precisely because they are the easiest things to reach. Tax rates. Subsidy levels. Thermostat settings. You can change them on a Tuesday afternoon and watch nothing happen.

A robots directive is a parameter. What the web remembers about you is a structure. Meadows spent a career explaining which of the two actually moves a system.

Read our results through her list and they stop being surprising. A crawler permission is a parameter. An llms.txt file is a parameter. They are settings on a system whose behaviour is decided somewhere else entirely: in which sources are treated as authoritative, in how consistently your entity is described across them, and in what a training corpus absorbed about you years ago. Those are structures, and they sit far higher on her list than anything you can deploy this sprint.

It also explains the discomfort in the Bitwarden and Dashlane comparison. They are the two most technically prepared sites in the study. One is joint first on visibility and the other is fifth and falling. The parameter is not what separates them.

The practice nobody has built

There is one more result, and in a regulated industry it would be the only one anyone cared about.

We looked at how often a model mentioned LastPass in answers to questions that had nothing to do with security, and whether it attached any risk context when it did. With the web available, 38% of the time. Working from memory, 15%.

That gap comes from one brand and forty-three mentions, and it is not statistically significant. We would not publish it as a proven effect. But the mechanism behind it is not in doubt, because it is structural. The memory channel cites nothing. There is no source attached, nothing for a reader to check, and nothing for a company to correct. A model recommending from memory is recommending from a snapshot, and a snapshot has no errata page.

Now change the nouns. Replace a password manager with a medicine, and a data breach with a contraindication.

Stafford Beer's line was that the purpose of a system is what it does, not what it was built to do. A system that recommends confidently from memory, and often without the qualifying information, is, whatever anyone intended, a system for producing unqualified advice at scale.

Every product in this market sells measurement. Several sell content tooling. Not one of them is built to detect that a model has said something wrong about you, route it to whoever owns the correction, and track how long the fix takes. In consumer categories that is a nuisance. Anywhere with a regulator, it is the whole job.

The tools, and what none of them do

Worth being concrete, since this is where budgets get spent.

The document layer is already solved by tools that predate all of this. An ordinary technical crawler will tell you whether your pages render without JavaScript, whether your structured data is valid, and whether your headings answer questions. Your server logs will tell you which AI crawlers are actually arriving. None of this needs a new category of product.

The entity layer is barely served, which is striking, because in the trust category it is where the signal was. Wikidata and Wikipedia are edited by hand, and the norms matter more than the tooling.

The memory layer has no product at all. Measuring it means deliberately running models with search disabled, and nobody ships that as a feature. We built it in an afternoon, and the entire study, every API call across five surfaces, cost $1.10.

The monitoring category is crowded and converging. The platforms broadly do the same job: run a prompt set across the assistants on a schedule, score mentions and citations and sentiment, chart you against competitors. Buy one when you are running thousands of prompts across markets and languages and need dashboards other people can read. Insist on raw response export, because a vendor who gives you only aggregates is renting you their questions instead of letting you ask your own. And accept that the accuracy practice is yours to build whoever you buy from.

What we would actually do

Find out which kind of brand you are, first. Run your questions with search on and search off. It costs almost nothing and it determines everything else. If you are a memory brand you are fighting a description you cannot edit, and your work is off-site and slow. If you are a retrieval brand your visibility is real but rented, and your work is to get written into the reference layer before the next training cycle closes.

Fix your entity before your website. Wikipedia, Wikidata, the reference sites in your category, and consistency in how you are named everywhere. This is unglamorous, mostly not on your own domain, and it is where the pattern was strongest in the category where trust was the question.

Then make your pages readable, not because it wins the recommendation, but because it buys you authorship of your own description and gets your real pricing in front of the model. Direct answers under question-shaped headings, comparison tables, statistics with sources, text that exists without JavaScript.

Track what is said wrongly about you, not just how often you appear. Every tool counts mentions. None watch for errors. Decide now who owns a correction and how quickly they act.

And set the timescale honestly with whoever is paying. Off-site corroboration moves over quarters. The memory layer moves over training cycles, which is to say years, and never on your schedule.

Close

The uncomfortable part of this data is not that brands are losing. It is that most of them are being described, daily, by a system they have never looked at, using a version of themselves that may be two years out of date, in a sentence assembled from sources they did not write.

A search engine sends people to you. An answer engine decides whether to mention you at all, and then tells the reader what you are.

You cannot write that sentence. You can only spend long enough changing what the rest of the web says that the machine eventually changes its mind.

Method. Seventy questions across two categories, run in August 2026 through Exa, Brave, GPT, Claude and Perplexity. 490 calls, no failures. Twenty brands audited on fourteen technical signals. Brand mentions are detected by alias matching and were hand-checked for false positives on the risky names (Shark, Keeper, Dyson); citations are matched against every domain a brand owns. The memory comparison is paired per question across two models and is significant for nine of the twenty brands, several below p=0.001; the aggregate shift across all brands is not significant (Wilcoxon p=0.795), which is the point. The entity relationship in the password manager category is strong (Spearman +0.97, p<0.001) and absent in robot vacuums (+0.30, p=0.41). The technical scorecard showed no detectable relationship with recommendation (Spearman -0.08, p=0.73, 95% interval -0.51 to +0.38), which at n=20 means we could not detect one rather than that none exists. The LastPass risk-context gap is not statistically significant (Fisher p=0.14, 43 mentions) and is reported as an observation. The searched arm is instructed to use the web; the memory arm is given no tools, and the question is identical in both. API surfaces are not the consumer apps: there is no personalisation, memory or location here, which makes this repeatable rather than representative. Every figure is generated directly from the raw responses, which are kept.