Positioning & AI visibility

Readiness Audit

A sample report

Sample report
Client redacted

By Scott King  ·  thescottking.com

What this is, and how to read it

This is a sample report. It is a real audit, run against a real company, published
here as an example of the work with the client’s identity removed. The findings, the counts, the scoring
and the method are exactly as delivered. Nothing was softened or invented for publication.

██████████████ marks copy quoted verbatim from a live website. Those
sentences are searchable, so they were deleted from the text rather than covered over.

COMPETITOR A and similar labels replace company, product, person, domain
and investor names. Each label maps to one entity consistently throughout, so every comparison in the
report still holds.

Redaction was applied to the source before this page was generated. Nothing is hidden underneath a
box, and there is no underlying text to recover.

60%

Readiness, 18 of 30

2/91

Unprompted presence

27%

Claims adoptable

Recommended tier

Positioning + Installation

No preconditions. Retrieval crawlers reach the site cleanly and the primary claim is
server-rendered. The client can start immediately.

Contents

1. The verdict
2. What the engines do instead
3. The adoptability test
4. The competitive set
5. The machine read
6. The voice finding
7. Readiness arithmetic
8. Gap list
9. Fix list
10. Tier
11. Method note

The verdict

No preconditions. The client can start immediately.

Retrieval crawlers reach the site cleanly. The primary claim is server-rendered in the initial HTML. Both of the blocking conditions this audit tests for are clear, which is rarer than it sounds and worth saying first.

Readiness: 18 of 30 sections, 60%.

Recommended tier: Positioning + Installation.

The client owns defensible positioning and cannot be found saying it. Five of fifteen scored claims are defensible against a quoted competitor sentence. Three of those five sit in text no machine can attribute to the client, and the single most citable asset on the property appears exactly once, in one blog post, and in no metadata field anywhere.

Across 91 observations where the company name was never mentioned, the client was named twice. Both mentions came from ChatGPT.

The same 91 observations named COMPETITOR A 47 times and COMPETITOR C 26 times.

---

What the engines do instead

Ten prompts, five runs each, three engines, every run logged out in a fresh conversation. 101 of 150 observations completed. Perplexity is marked incomplete and is not estimated.

Presence, as a count out of five

Section 30 scores READY because the client appears in at least one run. Read the count, not the label. Ten of the twelve presence hits came from the one prompt that names the company. Unprompted presence is 2 of 91.

P7 is the finding worth the fee

the client’s homepage h1 reads: “██████████████████████████████████████████████“

P7 turns that sentence into the question a buyer would type. Counted per run out of five:

VENDOR 22 and VENDOR 49 are security products. VENDOR 50, VENDOR 25, VENDOR 26, VENDOR 28 and VENDOR 27 are device management. VENDOR 23 and VENDOR 24 are employee monitoring and remote access. Not one answer in ten returned an agentic AI security vendor of any kind, the client’s or anyone else’s.

The client wrote the sentence and the engines read it as a request for device management. The claim is not losing to COMPETITOR C or COMPETITOR B on that query. It is not in that conversation at all, because the words do not say what the client sells.

The two hits, verified

ChatGPT, P8, run 1, in a comparison table:

██████████████████████████████████████████████

That is a correct, unprompted, category-level placement. It happened once in 91 tries. One observation is not evidence about how a model works, so take it for what it is: on at least one occasion the model produced an accurate placement for the client without being asked about the client. Whatever representation sits behind that, it is almost never reached.

ChatGPT, P1, run 5, also present. Context was not captured on that run; the extractor began recording context afterward. Recorded as present, unverified.

Who the engines name instead

Complete ranking, every vendor named in five or more of the 91 unbranded runs. Nothing is filtered.

the client is not alone at the bottom. Ranking the client and its six independent startup peers by how often the engines named them across the same 91 observations:

The client sits fifth of seven. The peer with the largest round in the set, at a valuation above a billion, was named once. Another peer, funded two months earlier, was named zero times.

Two readings of that, and the audit can support only one of them.

It cannot support “publish more and the ranking changes.” Seven companies is too few to establish that, and the ordering does not track content volume in any case: the peer with the largest published library in the set ranks fourth, below a peer whose site carries a blog and little else.

What it does support is narrower and more useful. Being newly funded and widely covered in the trade press did not put any of the bottom three into an answer. The top three are in the answers, and section 28 shows what the engines were actually reading when they built those answers. That is where the lever is, and it is a question about which sources carry the category, not about how much a company posts.

VENDOR 06 appearing 13 times matters more than its rank. Two of the client’s three founders came from the same incumbent, in senior operating and research roles. That incumbent has since acquired one of the startups in this set, so it appears in the answer set twice over, under two names.

The domains those answers were built from

This is the work order. 59 distinct domains were cited across the 91 runs. Every domain appearing in six or more is listed; nothing is filtered.

Below that, 31 further domains each appeared in exactly 5 runs, among them DOMAIN 08, DOMAIN 09, DOMAIN 10, DOMAIN 11, DOMAIN 12, DOMAIN 13, DOMAIN 16, DOMAIN 14, DOMAIN 15, DOMAIN 18, DOMAIN 20 and DOMAIN 21.

CLIENT DOMAIN appeared in zero of the 91 unbranded runs.

Two domains tie for first. YouTube is the general-purpose one and there is no lever there. DOMAIN 01, a vendor blog, is the other, and it is the pattern worth acting on. The tail below it is mostly vendor domains: DOMAIN 02, DOMAIN 06, DOMAIN 07, DOMAIN 08, DOMAIN 09, DOMAIN 10, DOMAIN 11, DOMAIN 14. This audit recorded which domains the engines cited, not which page on each domain was cited, so treat the mechanism as a hypothesis worth one hour of checking rather than as a finding: pull those cited pages and see whether they are category roundups. If they are, the path onto that list is a published comparison, and the client has nothing of the kind. Its one blog post is about the client.

On the review sites, precisely. G2 appeared in zero of the 91 runs. Capterra appeared in five, all of them ChatGPT, on P1 and P7. That is a thin enough presence that review volume is still not a lever here and it stays off the fix list. Correcting the record matters more than the conclusion it supports. llms.txt is likewise absent from CLIENT DOMAIN and should stay absent.

---

The adoptability test

Every positioning claim on the homepage, platform pages and launch post, scored twice. Could a direct competitor publish this sentence unchanged, and can a machine attribute it to the client. Competitor sentences are quoted verbatim from their live homepages, read AUDIT DATE.

Fifteen claims scored. Four adoptable (27%), six contested (40%), five defensible (33%). Eight of fifteen (53%) are not retrievable.

Adoptable and not retrievable

The worst square on the board, and all of the client’s most prominent copy sits in it.

Claim three is the sequencing problem in one line. It is a complete, well-built sentence sitting in the initial HTML, and a retrieval system lifting it gets an unattributed “we.”

A markup detail that makes the h1 worse than it reads. The h1 is built from three <span class="ln"> elements set to display:block, with no whitespace between them:

<span class="ln" data-BUILD-HASH><span data-BUILD-HASH>█████████████</span></span><span
class="ln" data-BUILD-HASH><span data-BUILD-HASH>████████████████████</span></span><span
class="ln" data-BUILD-HASH><span class="ACCENT-TOKEN" data-BUILD-HASH>████████████</span></span>

(Line breaks added here for legibility. In the source these three spans sit on one line with no whitespace of any kind between them, which is the point.)

An extractor that inserts a separator at block boundaries reads “██████████████████████████████████████████████.” An extractor reading DOM textContent, which is what most non-rendering crawlers do, reads:

█████████████████████████████████████████████

the client’s most prominent sentence may reach a retrieval system with three of its words fused. Which of the two a given engine sees is not something this audit can determine from outside, and it does not need to: adding a space or a line break between those spans costs nothing and removes the question. This does not affect the section 22 score, because the claim is present in the initial HTML either way.

Defensible and not retrievable

The cheapest fix in this report. Under an hour of work, and it comes first.

All three sit below the fold, under the interchangeable headlines above.

Defensible and retrievable

Their asset. Two claims.

“██████████████████████████████████████████████“

A specific, original, first-party number that no competitor in the set can match or copy. It is the single most citable thing the client has published.

It appears once, about halfway into the launch post, which is the only article on the site. It is not on the homepage. The homepage version of the same claim reads “██████████████████████████████████████████████“ That version drops the number and replaces it with “all.”

The client swapped a citable figure for an uncheckable adjective on the page that gets read.

“██████████████████████████████████████████████“

A distinctive workflow claim, named entity, stated as fact. Nobody else in the set claims it. Homepage, below the fold.

Adoptable and retrievable

“██████████████████████████████████████████████“

Machine-readable and saying nothing a competitor could not say. COMPETITOR H claims real-time human and AI activity. VENDOR 16 and VENDOR 29 own “non-human identity” and together appear in 33 runs. Publishing more of this will not help.

The open ground

Claims zero competitors in the verified set of eight make:

1. ████████████████████ an architecture claim no incumbent in the set can make
2. ████████████████████ a data-residency claim about where analysis happens
3. ████████████████████ a claim about how policy gets authored
4. ████████████████████ a first-party scale figure
5. ████████████████████ a named three-part operating model

Now check where that open ground appears in the fields a machine reads.

Five differentiators, zero appearances. Every machine-readable summary of this company describes the adoptable half of the positioning.

---

The competitive set

Eight companies verified for M&A before scoring. One finding came out of that check that changes how the tier reads.

This category is being bought out from under itself.

Of the eight companies scored against the client, one has been acquired: COMPETITOR E is now an VENDOR 15 product line. A second, COMPETITOR A, is not a competitor in the usual sense at all. It is the consolidator, and it already owns VENDOR 14. Seven of the eight are independent today.

The other four acquisitions in the table are not in the scored set. They are in this report because of who bought them, not who they were.

The acquirers bought the client’s adjacent capability. The incumbent where two of the three founders spent their careers already sells shadow-AI discovery through an acquisition. A second incumbent sells AI detection through another. Both meet the client in the same deal, and both are already in the answer set.

The six startup peers closed a combined nine figures across a single summer, with rounds ranging from the high tens of millions to well over a hundred million, one of them at a valuation above a billion. Four of those closed within 90 days of each other.

The client raised a comparable round in the same window and sits fifth of seven on how often the engines name it. A peer funded a month later is named 26 times. Being newly and heavily funded did not put the bottom three into an answer, and it is not what separates the top of that table from the bottom.

The sentences, for the record

COMPETITOR B claims a category in four words. The client hedges toward the same territory in its blog: “██████████████████████████████████████████████“ COMPETITOR B states it. The client believes it, in a sentence with no entity name, in the only post on the site.

---

The machine read

Everything here is publicly checkable. The raw responses behind this section are retained alongside this report as evidence-crawler-parity.txt, evidence-sitemap-status.txt, evidence-path-status.txt and evidence-robots.txt, so a re-measure in 90 days compares against a record rather than a recollection.

Retrieval crawler access: READY

Shell reachability was confirmed first: the homepage returned HTTP 200 and 272,916 bytes to an ordinary browser user agent, so the instrument is valid for this host. Nine user agents were then requested against the live homepage, six retrieval, two training, one browser control.

Byte-identical across all nine. Every response carried an identical server header and no vary: user-agent header. The site runs behind a page-cache CDN rather than the one that flipped to blocking AI crawlers by default on new zones in July YEAR, so it never inherited that setting. robots.txt is User-agent: * / Allow: / with a sitemap directive.

The two training crawlers are included deliberately. Blocking them is a legitimate business decision and its absence is not a defect. It is worth knowing that the client has not made that decision either way, because it is a conversation the CEO should have had and may not have.

Nothing here needs fixing. It is the strongest section in the report.

Server-rendered primary claim: READY

The h1 “██████████████████████████████████████████████” is present in the raw HTML with no JavaScript executed. 11,969 visible characters render server-side.

Most retrieval crawlers do not execute JavaScript, which is why this section exists at all. On this site it does not matter either way: every crawler in the matrix above received the complete claim in the initial response, whether it renders or not.

Crawl hygiene: READY

All 56 sitemap URLs resolve 200. /pricing/, /customers/, /case-studies/ and a nonsense control URL all return a real 404 status, not the soft-404 redirect pattern that makes every dead URL look valid to a crawler. The apex redirects to www in one hop. Trailing-slash variants canonicalize correctly.

One note: /contact/ 404s while /contact-us/ exists. Minor, and a crawler following a conventional path will miss the page.

Entity markup: DEFECT

Organization schema is present sitewide with correct sameAs pointing to LinkedIn and X. Entity naming is consistent: “CLIENT” in the schema and the footer copyright, “the client” as alternateName, CLIENT DOMAIN as the domain, info@CLIENT DOMAIN as the contact. That part is right, and most sites get it wrong.

The author markup is the defect.

██████████████████████████████████████████████

Three people inside one Person entity, as a single name string. No sameAs. No author page.

To be precise about what is and is not broken here, because it changes the fix. The full names do appear in the post’s visible text, two lines under the byline: ███████████████████████████████████████████ So a system reading the rendered page can find them. What it cannot do is connect them to anything. There is no sameAs pointing at a LinkedIn profile, no author page to resolve to, and the schema itself models three people as one. A shortened first name in the byline against the full name on the About page is a further small mismatch.

Three founders with public track records at VENDOR 06 and PRIOR EMPLOYER are, in the only machine-readable statement of authorship on the site, a single unresolvable entity.

This is a template setting, not a decision anyone made.

Passage structure: READY

The homepage carries a genuinely well-built block: three question-shaped headings, “█████████████████████████“, “█████████████████████“, “██████████████████████████“, each answered in the paragraph directly beneath. That is the pattern retrieval systems lift from. Each question appears twice in the HTML, once in an h3 and once in a duplicated responsive block, which is harmless.

A passage that survives isolation:

“██████████████████████████████████████████████“

Entity named, complete, no antecedent required. Lift it anywhere and it still works.

A passage that does not:

“██████████████████████████████████████████████“

Passive, no owner, no company. Lifted alone it advertises the category, not the client.

No comparison content exists in any form, table or image.

Citable assets and evidence of work: READY

Both halves of the bar are met, which is uncommon.

Citable. The scale figure is original first-party data. The founders are named with roles and prior companies. A three-part operating model is defined explicitly.

Original in form. Fifteen distinct images across the site, zero from any stock host. Product screenshots, team photographs and compliance badges all served from CLIENT DOMAIN. No stock CDN path appears anywhere in the HTML. Most B2B sites fail this outright.

The launch post also shows its method rather than asserting it:

“██████████████████████████████████████████████“

A dated observation with a consequence. That is evidence of work, and it is the most persuasive paragraph on the property.

Two problems sit alongside the pass.

The unsourced statistics. Two of them.

“██████████████████████████████████████████████“ on the About page carries no attribution, and no outside source reached in this audit repeats the figure.

“████████████████████████████████████████“ in the launch post, describing VENDOR 06, is likewise unsourced on the site. It is plausible and widely repeated, and it is still an assertion the client makes without pointing anywhere.

A number with no source is the one thing on the page a retrieval system would most like to lift and cannot.

The templated page set. Seven /solutions/ pages and four /platform/capabilities/ pages run on two templates.

Method, so the figures can be reproduced: extract visible text from each page, then discard every line that appears identically on all pages inside its own template group. What remains is that page’s own text. On the solutions group, 61 lines are identical across all seven, and each page is left with 13 lines of its own, ranging from 517 to 625 characters. On the capability group, 54 lines are identical across all four, and each page is left with 18 lines, ranging from 718 to 780 characters.

All seven solutions pages contain this paragraph, byte-identical:

“██████████████████████████████████████████████“

All seven also share the headings “██████████████████████,” “██████████████████████████████████” and “████████████████████.”

Eleven of the site’s twenty-five content pages run on those two templates. The sitemap holds 56 URLs: 26 job requisitions pulled from an applicant tracking system, 5 legal pages, and 25 pages of actual content. Eleven of those 25 carry between 517 and 780 characters that are theirs.

A page with 517 characters of its own text, sharing its headline structure and one whole paragraph with six siblings, gives a retrieval system almost nothing to select it on.

These are observations with owners, not a score. No composite content quality number appears in this report and none should.

Canonical entity resolution: DEFECT

Both complete engines identify the client correctly on the branded prompt. The problem is how.

ChatGPT hedged in four of five runs: “█████████████████████████…” and “████████████████████████…” The model is disambiguating against other entities before it answers.

It has reason to. There is no SOURCE item and no SOURCE article for the client. The name collides with at least four unrelated entities, including a well-known open-source product and a consumer hardware company. Google AI Mode cited the hardware company’s domain among its sources on all five branded runs, on a question about a cybersecurity vendor.

Google AI Mode also fabricated. Two of five runs attributed the client’s founding team to companies it did not come from:

“██████████████████████████████████████████████“

“██████████████████████████████████████████████“

the client’s own site names VENDOR 06 and PRIOR EMPLOYER. VENDOR 32 and VENDOR 04 are invention, stated without hedge.

ChatGPT quoted a tagline the client does not use: “██████████████████████████████████████████████“ The site says “████████████████████████.” The rest was added and then put in quotation marks.

Fact consistency: DEFECT

Four facts that outside sources state uniformly and CLIENT DOMAIN never states anywhere:

The engines are not guessing these. They are reading LinkedIn and SOURCE, because the client’s own site gives them nothing to read. ChatGPT cited the source out loud: “██████████████████████████████████████████████“

Where outside sources disagree with each other, a machine has no way to resolve it:

• Headcount. Two databases give one figure. A third gives a range an order of magnitude lower. ChatGPT reported a fourth.
• Total raised. One database reports a figure 25% higher than every other source and than the client’s own announcement.
• One founder’s background. Three sources name the company he co-founded. A fourth names an entirely different prior employer and role.
• Investors. One pre-launch piece names a lead investor that no post-launch source repeats, and omits one that all of them name.
• One major database’s record describes a different company entirely, under an unrelated software category.

No profile exists on any of the five major review and peer-insight platforms. Two of the competitors in the set have them. This is an eligibility gate, not a lever, and it matters only because the client is absent where a buyer would check.

---

The voice finding

The client has published one blog post.

The archive is a single 1,207-word launch announcement from LAUNCH DATE, written jointly by three founders. That is the entire written corpus.

Measured on that one post, for the record and not as a house voice:

Four of these numbers describe a founding announcement rather than a voice. The 38.9 to 7.5 ratio of first person to second person is what a launch post does. Nobody can tell yet whether it is what the client does.

Byline concentration is not measurable on an archive of one. The tier modifier for concentration above 70% was considered and not applied, and it becomes measurable at roughly six posts.

The post is good. It carries a named trap, a dated observation with a consequence, a specific original number, and a real argument about why the category exists. Voice sections 6 through 9 cannot be filled from it, and that is the finding: the house voice is not undocumented, it is unwritten. Four of the five strategic gaps in this audit exist because there is nothing to measure.

One inconsistency worth a five-minute fix. Seventeen of the 22 pages read close with “Put CLIENT ███████████████████████████████,” in capitals, against “the client” everywhere else. The line beneath reads “██████████████████████████████████████████████” A █████████████████████████ is not what an endpoint sensor does. That block reads like copy from a different product.

---

Readiness arithmetic

Thirty fixed sections, the same thirty scored on every audit.

Readiness = (11 EVIDENCED + 1 INFERRED + 6 READY) / 30 = 18/30 = 60%

The remaining twelve split three ways:

• 5 strategic. Sections 6, 7, 8, 9, 16. A person has to decide something that does not exist yet. More research cannot shorten these.
• 3 data retrieval. Sections 14, 19, 20. The answers exist inside the client and someone has to fetch them.
• 4 defects. Sections 24, 27, 28, 29. Neither gaps nor decisions. They go on the fix list.

Sections 24 and 26 were scored under the widened evidence bar. Recorded in the baseline.

Brand is the strongest file in the audit. The palette is fully tokenized and named across three families: a saturated primary, a near-black, and a warm off-white ramp. Typography is specified across three roles, display, sans and monospace, each loaded from a pinned source. The logo files are named for the palette. Sections 1 through 5 filled themselves, which almost never happens.

Section 18 is inferred, not evidenced, and the reason matters. the client states an ICP across four industries and three roles. There are zero customer logos, zero case studies and zero named references anywhere on the site. The stated ICP cannot be tested against a real one, because no real one is published. That is unusual eight weeks after a ROUND SIZE launch and it is worth asking about in the first interview.

---

Gap list

Decisions and retrieval. These need people, not tickets. Nothing here is a bug.

Channel economics were not estimated. None of it is public and guessing at it would be worse than leaving it empty.

Candidate exclusions for the first interview. Drafted as questions, not statements. The client appears not to do: cloud and SaaS-side agent governance where no endpoint is involved; model-layer red teaming or adversarial testing; network or browser-proxy inspection; CASB or DLP as a standalone function; mobile endpoints, given that the stated support is macOS, Windows and Linux. Confirm each.

---

Fix list

Different owners, different timelines. Do not wait on the gap list to start these.

Fixes 2, 8 and the original-media work the client has already done are the items that serve organic ranking and answer-engine retrieval at the same time. Most of this list does not have that property. Fix 3 costs organic traffic and should still be made, because the traffic it costs is mis-qualified.

What this audit will not recommend, and why.

Each of these is a standing position carried into every audit, not a finding about the client. The evidence behind them comes from published third-party analysis rather than from this run, and where a figure is quoted it belongs to that analysis. Ask and the underlying sources will be sent.

• No llms.txt. Large-scale analysis finds no relationship between publishing one and being cited, and server logs show the major engines do not request the file. The client has not published one. Leave it that way.
• No FAQPage or HowTo schema “for AI.” Rich results for both have been retired and no evidence connects either to citation.
• No blocking of Google-Extended. It is an opt-out token, not a crawler. It will never appear in a log and it does not control AI Overviews, which retrieve from the live Googlebot index.
• No Bing rank as a ChatGPT proxy. OpenAI runs its own index. Bing indexation is hygiene, not a measure of anything here.
• No review-volume campaign on G2 or Capterra. Review count explains a negligible share of citation variance. In this category the runs bear that out directly: G2 appeared in zero of 91 and Capterra in five. A complete, current, correctly categorized profile is an eligibility gate worth having. More reviews is not a lever.
• No content effort score, and no composite number of any kind built from the template, media or methodology readings above. Those are observations with owners. A number derived from them would be invention wearing the clothes of a measurement.
• No AI visibility tool. They disagree with each other, none publish confidence intervals, and none measure what a user sees. A fixed prompt set and a saved baseline cost less and can be defended line by line.

---

Tier

Base tier: Full Installation. Positioning holds and is inconsistently applied. Four of fifteen claims are adoptable, which is not a majority, so the frame is not broken. Five claims are defensible, and they are buried below the fold and absent from every metadata field.

Modifier applied: two or more strategic gaps moves any tier up one. There are five. Full Installation becomes Positioning + Installation.

Modifier applied: a templated page set carrying the bulk of the site. Eleven of twenty-five content pages on two templates. This would move the tier up again, and Positioning + Installation is the top of the table, so it stays there. It raises the scope inside the tier rather than the tier itself.

Modifiers considered and not applied:

• Byline concentration above 70%. Not applied. One post is not an archive and 100% of one is not a concentration measurement. Revisit at six posts.
• Client-side rendering with the claim missing from initial HTML. Not applied. The claim is server-rendered.
• Zero presence across all 150 runs with defensible positioning. Not applied as written, because presence is 2 of 91 rather than zero, and because 49 runs were never collected. The substance of it holds anyway: the client owns defensible positioning and has no distribution. It is the strongest case in this report and the count is 2, not 0.
• Readiness above 70% with no strategic gaps and no defects. Not applied. 60%, five strategic gaps, four defects.

Who has to be in the room

The CEO. Holds What We Do Not Do and the h1 decision. Neither can be delegated and everything downstream waits on both.

Whoever controls the site and the hosting deployment. Holds fixes 1, 2, 7, 8 and 10. This person was probably not in the conversation that bought the audit. Bring them in before the kickoff, because five of the ten fixes stall without them and two of the four defects are theirs.

Communications, plus whoever owns the LinkedIn company page. Holds fixes 4, 5 and 6. Nothing in presence.md is fixed by editing the website, which is why it is a separate file and a separate owner.

One thing worth saying plainly

The client does not have a visibility problem that content volume solves.

The client has three defensible claims that no machine can attribute to it, one citable number buried in the only blog post on the site, and a homepage whose most prominent sentence reads to an answer engine as a request for device management software.

The infrastructure is clean. The brand system is complete. The technical foundation for this work is already built, which is why the tier is about positioning rather than repair.

---

Method note

What ships with this report. The client-facing package is this document, baseline.json, and the four evidence-*.txt files. Nothing else in the engagement folder is written to be forwarded.

Read on the audit date. Homepage, the positioning page, the platform page and four capability pages, the solutions index and seven child pages, about, news and the launch announcement, the blog index and its single post, careers, an interactive calculator, robots.txt, the sitemap index and all 56 sitemap URLs. Raw HTML was pulled once to disk and every static check ran against those files.

Public sources only. No insider knowledge, no prior relationship, no non-public material. Where outside coverage was used it is cited inline. No prior client canon bore on this company, and none was used.

Out of scope. Server logs, GA4, Search Console and ad platform data. Those are the first deliverable of an installation, not of this audit. Every finding that needed them is marked REQUIRES HUMAN, data retrieval, with an owner named.

Prompt protocol. Ten prompts: four category-level, three problem-level, two comparison, one brand-level. Nine of the ten never contain the company name. P7 was written in the client’s own positioning language. Five runs per prompt per engine. Every run was a new conversation started by fresh navigation. Every engine was queried logged out, with no account and no personalization. No session was signed into and no cookie was cleared at any point.

Observation count: 101 of 150 completed.

• Google AI Mode: 50 of 50. Queried at google.com/search?...&udm=50. Model label not exposed logged out. Behavioural fingerprint recorded: AI Mode engaged on all 50 runs, citations rendered as opaque /goto?url= redirects with source domains recoverable only from faviconV2 image parameters.
• ChatGPT: 50 of 50. Queried through the web UI logged out. Model label not exposed. Fingerprint recorded: citations render as publisher labels without anchor hrefs, and several runs returned an advertisement in the Sources block rather than a citation. On this category ChatGPT frequently answered from model knowledge with no web citation at all.
• Perplexity: 1 of 50. INCOMPLETE. The anonymous allowance was verified as unspent before starting; visitor_queries_past_day read 0. Run 1 of P1 returned a full answer with nine cited domains. Run 2 returned “Sign up and repeat your request.” The counter then read 4. Per protocol the engine was abandoned rather than retried, signed into, or reset. The 49 missing runs are not estimated, extrapolated or averaged. They will be appended to this same baseline entry when collected, with the second collection date recorded.

What the incomplete engine costs this report. Perplexity carries the cleanest citation data of the three and normally anchors the third-party source inventory in section 28. That inventory therefore rests on Google AI Mode and ChatGPT alone this run. The finding it supports, that CLIENT DOMAIN appears in zero unbranded runs, holds across 91 observations on two engines and one Perplexity run, and no engine cited CLIENT DOMAIN on any of them.

Checks verified indirectly. None. Shell reachability was probed before the crawler matrix and confirmed directly, so the user-agent parity results are direct measurements rather than inference. Content parity across nine user agents is reported alongside status codes because a CDN serving a thinner variant to bots answers 200 to everyone.

Sources not reached. LinkedIn blocks automated fetch on both the advertised company slug and the variant that search surfaces, so headcount, founding year and self-description from that source are reported only as other sources and ChatGPT quote them, never as verified. One startup database is likewise blocked. Another puts the founded date and funding total behind a paywall.

A name-collision caveat that affects any third-party data about this company. The client’s name also matches at least two unrelated companies in other countries, one of which has its own SOURCE article. Any record pulled under that name must be checked against the domain before use. One record encountered during this audit was the wrong company.

What this audit cannot tell you. Whether the positioning is right. It tells you whether the current positioning survives a competitor saying it, and whether a machine can read it. Those are different questions from what the client should claim, and the second one is answered by the people in the room, not by a website.

Reproducibility, and its limits. The prompt set, the run count and the engine list are fixed and recorded in baseline.json, delivered with this report. Every static check was run against HTML saved on the day and the raw responses are retained, so the crawler matrix, the sitemap statuses and the path statuses can be re-read rather than re-trusted. Character and line counts are reported with the method that produced them, because a different extractor returns different numbers for the same page.

Two things cannot be reproduced. The 49 Perplexity observations were never collected. And answer engines are not deterministic: re-running these ten prompts today will not return identical text, which is exactly why presence is reported as a count out of five rather than as a score.

Re-running the fixed set in 90 days against this baseline is the measurement that shows whether any of this moved. Ask what shipped, with dates, before running it. Movement with no shipped fixes is noise.

About this audit

Every audit runs the same fixed protocol: ten prompts, five runs each, three answer engines, one
hundred and fifty observations, and the same thirty scored sections. The prompt set and the counts are
saved as a baseline so the identical measurement can be re-run in ninety days and show what moved.

If you want to know what an answer engine says when a buyer asks about your category and never types
your name, that is the question this measures.

Talk about an audit

Scott King  ·  thescottking.com  ·  Sample report, client redacted