AI Visibility for B2B Software Vendors

A B2B software purchase rarely has one buyer. A champion builds the shortlist. Security reviews the vendor. IT checks deployment and identity. Finance looks at pricing. Each of them can open ChatGPT, Copilot, Perplexity or Google and ask a narrow question.

Those questions are different from consumer queries. They are checkable. "Does this vendor have SOC 2 Type II?" has a right answer. So does "Can it run in our own AWS account?" When an AI assistant answers wrongly, nobody tells you. The vendor just doesn't make the shortlist, or security asks a question your sales team has to unwind.

The model's answer comes from one of two places. With retrieval off, it comes from what the model learned before its cutoff. OpenAI documents a February 16, 2026 knowledge cutoff for the GPT-5.6 family and August 31, 2025 for the Instant path, so a certification you earned this spring may simply not exist in a retrieval-off answer. With retrieval on, the engine fetches pages and quotes them. That second path is the one you can influence, and only by making your facts fetchable.

The next move: treat AI answers as a sales-qualification surface, and check the specific facts your buyers verify.

Here are realistic prompts for a hypothetical mid-market data integration vendor. Swap in your own category.

1. "Shortlist five ETL tools for a 300-person fintech that needs SOC 2 Type II and EU data residency."
2. "Does [vendor] support SAML SSO and SCIM provisioning on its standard plan?"
3. "Can [vendor] be self-hosted or deployed in our own VPC?"
4. "Compare [vendor] and [competitor] for Snowflake and Salesforce integrations."
5. "Is [vendor] HIPAA compliant, and will they sign a BAA?"
6. "What does [vendor] cost for 20 users, and is there a free tier?"
7. "Which tools in this category are ISO 27001 certified?"
8. "Summarise [vendor]'s security posture for a vendor risk review."

Notice that only prompts 1 and 7 are discovery questions. The rest assume the buyer already knows your name and is verifying. Those verification prompts are where wrong facts do the most damage.

One caveat: what the buyer types is not what the engine searches. OpenAI says ChatGPT search rewrites a query into one or more targeted queries before sending it to search providers. Use your prompt list as a test set, not a map of real queries. Our prompt research method walks through building one, and writing your own prompts versus generating them covers the trade-off.

Each engine pulls from a different place, so check them separately.

Copilot deserves extra attention in B2B because it sits inside tools many enterprise buyers already use. It grounds answers in Bing, so a site that is healthy in Google can still be thin in Bing. Otterly's 2026 experiment showed how far apart the two can drift: Google deindexed both test sites, Bing kept them, and Copilot kept citing them. The same test found ChatGPT citations near zero even while the sites ranked in Bing, so being in Bing is not a shortcut to ChatGPT.

For more on Copilot specifically, see what is in your hands with Copilot and whether agents built on Bing grounding can find you.

B2B software facts change faster than model training data and sit in places crawlers struggle to read. These are the ones to audit first.

• Compliance certifications. SOC 2 type, ISO 27001, HIPAA, FedRAMP status. These often live only in a trust portal behind a request form or a gated PDF report.
• Deployment options. Cloud-only, single-tenant, self-hosted, customer VPC, regions. Old blog posts and third-party write-ups frequently describe a deployment model you have since changed.
• Integrations. Which connectors exist, which are native and which need a partner. Integration pages built as JavaScript filters may show nothing to a crawler.
• Identity and admin features. SSO, SCIM, audit logs, and which plan includes them.
• Pricing and packaging. Plan names, seat minimums, free tiers.
• Company facts. Ownership after an acquisition, product renames, sunset features.

There are three common causes. The fact is stated differently across your own site (pricing page, docs and footer disagree). The fact is not fetchable at all. Or a third-party page states an old version. Fix the first two yourself. The third needs outreach.

The practical fix is plain: state each fact once, specifically, on a public page that renders without JavaScript. A sentence like "SOC 2 Type II, report available under NDA" gives an engine something it can quote. Security-heavy categories face the same issue in sharper form; see AI visibility for cybersecurity vendors.

When engines cite other sites instead of yours, being named accurately on those sites is the route into the answer. The evidence shows an association there, not a guaranteed effect. So treat these as places to check, not channels you can count on.

• Software review marketplaces. Check your category placement, listed integrations, deployment options and pricing tiers.
• Analyst and research pages. Check that product names and capabilities match today's product, not last year's.
• Integration directories and cloud marketplaces. Partner listings often lag behind your own changelog.
• Comparison and "alternatives" articles. These frequently carry stale pricing and feature claims.
• Your own old press releases and partner announcements. They are still crawlable and may contradict your current docs.

When you find an error, ask the owner to correct it. Don't create thin pages to drown it out. Otterly's experiment saw Google silently deindex sites built from scaled AI content, and Google's spam policy names generating many pages without value as scaled content abuse. Also watch for third-party pages carrying hidden instructions aimed at AI agents. That is manipulation, it is a real exposure for vendors being misrepresented, and you should never use it yourself.

Access is where the strongest evidence sits. These checks remove blocks. They don't promise citations.

Crawler permissions

robots.txt rules are per bot. OpenAI states each setting is independent: GPTBot covers training, OAI-SearchBot covers ChatGPT search. A common error is a blanket AI block that also removes search eligibility. A setup that opts out of training but stays in search looks like this:

User-agent: GPTBot
Disallow: /

User-agent: OAI-SearchBot
Allow: /

User-agent: Claude-SearchBot
Allow: /

User-agent: PerplexityBot
Allow: /

Firewall and CDN

OpenAI says eligibility means allowing OAI-SearchBot and confirming your host or CDN allows its published IP addresses. A firewall can return 403 to a crawler robots.txt allows. Cloudflare changed its AI crawler defaults on 2026-09-15 for new domains and free-tier sites, so check even if you edited nothing. The AI Crawler Checker requests a page as each AI crawler and shows which ones get turned away.

Rendering

Vercel found ChatGPT and Claude crawlers fetch JavaScript files but don't execute them. If your trust center, integration list or pricing appears only after JavaScript runs, those crawlers see an empty page. Googlebot renders, so Google may look fine while others see nothing.

Gated and login-walled content

A PDF behind a form and docs behind a login give engines nothing to fetch or quote. Keep the gated report gated if you need to, but publish a public summary page with the facts buyers verify.

Index and snippet controls

Check docs and trust pages for noindex, nosnippet, max-snippet:0 or data-nosnippet left over from a template. Google says a page must be indexed and snippet-eligible to appear as a supporting link in AI Overviews or AI Mode. Then check Bing Webmaster Tools separately for Copilot.

Week 1: baseline. Write 15 to 25 prompts across discovery and verification, using the list above as a template. Run them on each engine separately and record which facts come back wrong. The free checker on this site gives a quick snapshot for three buyer questions. For an ongoing view, see what AI brand monitoring tools track.

Week 2: access. Audit robots.txt per bot. Test firewall reachability for OAI-SearchBot, PerplexityBot, Claude-SearchBot and bingbot. Diff raw HTML against the rendered page on your pricing, trust, integrations and deployment pages. Search for stray noindex and nosnippet directives.

Week 3: facts. Publish one public, server-rendered page each for security and compliance, deployment options and integrations. State each fact in one specific sentence. Remove contradictions across your own site. Verify the domain in Bing Webmaster Tools and Google Search Console and confirm the key pages are indexed.

Week 4: third parties and re-test. Request corrections on review, marketplace and directory listings. Re-run your prompt set and compare engine by engine. Expect some answers not to change: retrieval-off answers stay frozen until the next model, and no one controls which pages an engine picks. For the content side, read how B2B SaaS companies approach ChatGPT and Perplexity citations.

Should we block GPTBot if we don't want our docs used for training? You can. OpenAI documents GPTBot as the training crawler and OAI-SearchBot as the ChatGPT search crawler, and says each setting is independent. Blocking GPTBot doesn't remove you from ChatGPT search. Blocking OAI-SearchBot does, apart from navigational links. Decide training and search separately, then check your firewall applies the same decision, since a CDN rule can block a bot that robots.txt allows.

Does adding schema markup to our pricing and security pages get us cited? There is no good evidence that it does. Google says structured data isn't required for its generative AI features, and Ahrefs' matched test found AI Overview citations fell 4.6% after pages added schema. Existing markup does no harm. The stronger move is stating each fact plainly in the page's HTML, on a page crawlers can fetch without running JavaScript.

Can we track our ranking position inside Copilot or Google AI answers? No reliable position data exists. As of October 2026, Google's Search Console report for AI features shows impressions only, with no clicks or position. Bing Webmaster Tools' AI Performance report shows citations and the grounding queries Copilot actually ran, but has no API. Measure whether you appear and whether facts are correct, engine by engine.

Why does Copilot describe us differently from ChatGPT? They retrieve from different places. Copilot grounds on Bing's index. ChatGPT search uses OpenAI's own crawler plus search partners, and it also answers some questions with no retrieval at all, from training data with a fixed cutoff. Different sources and different retrieval states produce different answers, which is why one blended score hides the problem.

Is a public trust center enough, or do we need a separate page? A trust center works if its core facts are in the HTML before JavaScript runs and the page isn't behind a login or request form. Many trust portals load content client-side or gate it. If yours does, add a plain public page listing certifications, report types, data regions and subprocessors, and keep the detailed reports gated.