.svg)
Cybersecurity companies sell trust for a living. Yet their websites are worse than the average B2B site at answering security questions about themselves. In the Storylane Buyability Index, 19 security vendor sites gave a full answer to questions about their own security 45% of the time. On the other 510 sites in the same scan, the figure was 59%.
That gap changes what an AI SDR on a security website is for. This piece is for the people who own a security vendor's website and pipeline: demand gen, product marketing and web ops. It covers what a website agent should do when the first serious question is "are you SOC 2 Type II, and can I see the report?"
Where do these numbers come from?
They come from the Storylane Buyability Index. Between Sep 8 and Oct 20, 2026, it scanned 529 B2B websites against 10,580 buyer questions. It graded each one as fully answered, partly answered, gated, sent to sales or not found.
Two caveats matter. The questions are generated per company (what a buyer would plausibly ask that company), not logged from real buyers. And the 529 sites were chosen by the people who ran scans, so this is not a random sample of the web. For this piece I tagged 19 of the 529 as cybersecurity vendors by reading their generated questions (threat detection, EDR, SIEM, vulnerability management, email security and similar). That is a small group and my own sorting, so read the security vendor numbers as a strong hint, not a census.
Do security buyers ask more security questions?
Yes, far more. On the 19 security vendor sites, 45.5% of buyer questions were relevant to a security or compliance reviewer. On the other 510 sites, it was 19.6%. When the product is security, the buying team is full of security people. They review the vendor the same way they review everything else.
The questions are specific. Here is a sample of what the scan generated for security vendors.
- Is the platform itself SOC 2 Type II certified, and can we see the report?
- Where is our security data stored, and can we choose the region?
- Does your agent need kernel-level access, and what happens if it crashes?
- What data does the sensor send back to your cloud?
None of these are about the threat the product stops. They are about the risk of letting the vendor in.
How often do security vendor websites answer them?
| Question type | 19 security vendor sites | Other 510 sites |
|---|---|---|
| Questions about the vendor's own security and compliance, fully answered | 45% (27 of 60) | 59% (903 of 1,527) |
| SOC 2 questions, fully answered | 38% (6 of 16) | 61% (194 of 317) |
| Data storage and region questions, fully answered | 35% (6 of 17) | 48% (192 of 397) |
| Product questions, fully answered | 72% (54 of 75) | 77% (1,437 of 1,870) |
The product row gives it away. Security vendors explain what they do nearly as well as anyone. The drop only shows up on questions about themselves.
Across all 529 sites, the picture is middling rather than bad. Questions relevant to a security or compliance reviewer got a full answer 60% of the time (1,303 of 2,170). SOC 2 questions got a full answer 60% of the time (200 of 333). ISO 27001 questions found nothing at all on 12% of the sites that were asked one (7 of 58).
Why would security vendors be worse at this?
The obvious answer is gating. Security vendors keep SOC 2 reports behind an NDA, so of course the website doesn't answer. But the data doesn't fit that story well. Only 1 of the 60 security questions on these sites was graded as gated. The most common result was a half answer. 29 of 60 (48%) were partly answered.
I have a theory for why. A security vendor's website is written about the attacker. The homepage, product pages and blog talk about breaches and detection. The vendor's own security is treated as a back-office document, like a trust page, a portal or a PDF you request. So the site shows a SOC 2 badge in the footer and stops there. It says "certified" without saying Type I or Type II, which criteria are covered, or how to get the report. To a security reviewer, that is not an answer. It is a reason to open a ticket.
Where full answers do exist, they sit far from where the buyer lands. Of the 27 fully answered security questions on these 19 sites, 12 were answered on a trust, security or legal page, and none on a homepage. Across all 529 sites, the homepage gave 1.3% of full answers to security questions (12 of 930).
That distance matters more than it used to. At industry events this October, the topic that booked the most meetings at our booth wasn't AI agents. It was that AI assistants now recommend a few vendors and send the buyer straight to each website, often with rivals open in other tabs. A security reviewer who can't find your SOC 2 details in two clicks has an easy option. They open the next tab.
Do buyers actually ask an agent about security?
Here is the strongest objection to everything above. Internal Storylane data from 1,332 RepX website conversations across five B2B software companies (June 1 to September 9, 2026) found that trust, security and compliance made up 1.5% of buyer questions (34 of 2,225). None of those five companies sells security, so this doesn't settle the question for security vendors. But it is a number from real buyers, set against a number from generated questions.
I think both numbers are true, and the gap between them is the point. Security reviewers do review the vendor. They just don't usually do it by typing into a chat window. They look for a trust page, a security doc or a report. If the page isn't there, they ask sales or move to the next vendor. So the page matters most, and the agent's job is to get the visitor to that page fast. When a security question does come up in chat, the agent should handle it well, because that visitor is usually deep in an evaluation.
What should an AI SDR on a cybersecurity website do?
Most AI SDR advice assumes visitors ask about the product. On a security site, the vendor review runs alongside the product evaluation from the start. Here are five rules I would hold any website agent to.
1. Answer only from what you have published
An agent can't answer from a document it hasn't been given. At events, people often asked us where a website agent's answers come from and what happens when the website is out of date. On a security site, a made-up answer about certifications or data location is worse than no answer. Give the agent your trust page, security docs and any public compliance summaries. Then set a firm rule that it never states a certification, region or retention period that isn't in those sources.
2. Fix the half answers before you add an agent
This is a content problem first. If your site says "SOC 2 certified" with no type, scope or request process, an agent will repeat the same half answer faster. Publish the four facts security reviewers ask for most.
- Which reports you hold, and their type.
- Where customer data is stored, and whether the buyer can choose the region.
- What your agent or sensor collects.
- How to request the full report.
Our security questionnaire playbook for presales covers how to keep these answers current.
3. Make the report request easy
"Can I see the SOC 2 report?" is a buying signal, not a support ticket. Someone is far enough along to run a vendor review. The agent should say what is public and explain the NDA or trust portal process in one sentence. Then it should offer to start that process or book time with the right person. A form with no context loses the buyer you most want.
4. Expect questions about the agent itself
Security buyers will ask where the chat transcript goes, who can read it and whether it trains a model. Have that answer ready before launch. We wrote up what B2B buyers ask about AI website agents and data privacy. At events, some visitors called lifelike AI avatars "creepy", and others said that at some point they want a human. On a security site, I would default to text, keep voice and video optional, and make it easy to reach a person.
5. Qualify on the review stage, not just company size
A visitor asking about kernel access and data location is weighing risk. I think that usually means they already have a shortlist. That visitor is worth more than one asking what EDR stands for. Treat compliance and data questions as a sign of buying stage, and send those conversations to the rep who handles security reviews. For more on how security buyers evaluate before a proof of concept, see how security buyers evaluate a tool before a POC.
Where RepX fits
We build an AI website agent, RepX, so weigh what follows with that in mind. RepX is trained on your website, docs, decks and demos. You can set rules on what it will and won't say about pricing, competitors and compliance. It can also show the product during the conversation through interactive demos, which helps when the question is "what does the console actually look like?" Qualified leads and conversation summaries flow to HubSpot, Salesforce and Slack. Storylane is SOC 2 Type 2 compliant, which security buyers will check first.
RepX is best for security vendors whose own website brings in new buyers, and who have their trust content written down for the agent to answer from. If most of your deals come through resellers and MSSPs, start with helping those partners demo your product.
The one thing to do on Monday
Ask your own website the four questions in rule 2, the way a skeptical security reviewer would. Start from the homepage. Count the clicks, and note which answers are only half there. Whatever you find is what an AI SDR will inherit. It is also what a buyer with a rival in the next tab sees first.
If you want to see how RepX handles a security review question on your own content, book a demo.