# Malaysia Cybersecurity SaaS: Getting Cited by Perplexity

> Why Malaysian cybersecurity SaaS and MDR vendors are missing from Perplexity's vendor answers, what CISOs ask, and how to publish facts Perplexity can cite.

URL: https://tryshubi.com/insights/malaysia-cybersecurity-saas-perplexity/
Published: 2026-11-14
Updated: 2026-11-14
Author: Md Shariar Shanaz Shuvon
Market: Malaysia
Industry: saas
Topics: AI visibility, AEO, saas, Malaysia, Perplexity, cybersecurity

## Short answer

Malaysian cybersecurity SaaS and MDR vendors miss Perplexity citations when their service scope, SOC location, NACSA licensing and integrations sit in gated PDFs and sales decks. Perplexity searches the web live and cites pages it can read, so plain HTML pages stating those facts give it something accurate to quote.

## Key points

- Perplexity searches the web in real time and shows numbered citations, so the vendors it names are usually the ones with readable, specific pages.
- PerplexityBot must be allowed in robots.txt and at the firewall or CDN, which security vendors often block by default.
- Malaysian CISOs ask about NACSA licensing, SOC location, PDPA processor duties and integrations, so publish clear pages on each.
- Gated datasheets and threat reports protect leads but leave Perplexity quoting global MSSPs and listicles instead.
- Track mention rate, citation share and accuracy on a fixed prompt set each month, treating single answers as samples.

A CISO at a Malaysian bank is building a shortlist for managed detection and response. Before any RFI goes out, someone on the team asks Perplexity which MDR providers run a security operations centre in Malaysia and can support a licensed, locally monitored service. The answer names two global MSSPs, a hyperscaler security product and a "top 10" listicle from an overseas blog. Your company runs a 24x7 SOC in Cyberjaya, yet it does not appear. That is the **Malaysia cybersecurity SaaS Perplexity** problem: strong vendors missing from the place security teams now do their first round of research.

This article is for marketing, product marketing and alliance leaders at Malaysian cybersecurity SaaS, MDR and managed SOC companies. It explains why Perplexity cites the vendors it does, what Malaysian security buyers actually type, how to audit your position this week, and which fixes give you a fair chance of being cited accurately.

## Why does Perplexity cite global MSSPs instead of Malaysian vendors?

Perplexity cites the pages it can find and read at the moment a question is asked. Global security vendors publish large volumes of specific, crawlable documentation, while many Malaysian vendors keep scope, SOC and compliance facts behind forms, so Perplexity has little local material to quote.

### Perplexity is a live search engine with citations

Perplexity's help centre says it searches the internet in real time and that each answer includes numbered citations linking to the original sources. That matters for security vendors. A Perplexity answer is less about what a model remembers from training and more about which pages answered the question best on the day it was asked.

Perplexity's crawler documentation describes PerplexityBot as the agent that surfaces and links websites in its search results, and says it is not used to crawl content for AI foundation models. To appear, Perplexity recommends allowing PerplexityBot in robots.txt and permitting its published IP ranges. A separate agent, Perplexity-User, visits pages when a user's question needs them.

### Security vendors often block their own discovery

Cybersecurity companies are good at blocking unknown traffic. Web application firewalls, bot management rules and strict CDN settings frequently challenge or drop crawlers by default. Nobody in marketing is told, and the company's best pages quietly become invisible to the one tool its buyers use for vendor research.

### Gated content leaves a vacuum

Security marketing has long relied on gated assets: datasheets, threat reports and solution briefs behind a lead form. Perplexity cannot fill in your form. Google's guidance on AI features makes the same point for Google: important content should be available in textual form on indexable pages. When your facts are locked away, the answer gets built from whoever left theirs open, often a global provider or a comparison blog with no local knowledge.

### Generic claims give the engine nothing to quote

"Next-generation, AI-powered protection" is not a fact. A CISO's prompt asks something precise: where the SOC is, who staffs it, which log sources you ingest, what response actions you take and under what licence. Pages that answer those questions in plain sentences get quoted. Pages that repeat category slogans do not.

## What buyers in Malaysia actually ask AI

Malaysian security buyers ask about local operations, regulation, scope and integration. Most CISOs and security architects prompt in English; Bahasa Malaysia is common in government, GLC and state agency procurement. These are realistic prompts to test, grouped by buying stage.

**Exploring**

- "Which MDR providers have a 24x7 SOC in Malaysia?"
- "Managed SOC providers licensed by NACSA for a Malaysian bank"
- "Penyedia perkhidmatan SOC tempatan untuk agensi kerajaan di Malaysia"

**Comparing**

- "Compare local Malaysian MDR vendors with CrowdStrike Falcon Complete for a mid-size insurer"
- "Which managed SOC in Malaysia integrates with Microsoft Sentinel and Splunk?"
- "Penetration testing firms in KL with CREST or NACSA licensing"

**Checking before an RFI**

- "Does [your company] keep log data in Malaysia, and what are its response SLAs?"
- "What does [your company]'s MDR service include and exclude?"

Notice how many of these prompts carry a regulatory hook. Under the Cyber Security Act 2024, which NACSA says came into operation on 26 August 2024, providers of prescribed cyber security services need a licence. Mayer Brown's summary of the Act notes that the two services currently prescribed are managed security operation centre monitoring and penetration testing. Buyers now ask about it by name, and Perplexity will look for pages that answer.

## How to check where you stand

You can run a useful audit in a week with a spreadsheet and two people. The aim is a baseline you can repeat, not a single screenshot. Our [measurement approach](https://tryshubi.com/how-we-measure/) explains why repeated sampling matters.

### Step 1: Build a fixed prompt set

Write 20 to 30 prompts across the three stages above. Include your company name, your two closest local rivals and the global providers you meet in deals. Keep the wording fixed so next month's results are comparable.

### Step 2: Run them in Perplexity and at least two other assistants

Run each prompt three times in Perplexity, then in ChatGPT and Google's AI features. Record whether you are named, where you appear in the list, and which URLs are cited. Answers vary between runs and users, so one result is a sample, not a verdict.

### Step 3: Score accuracy

For each mention, check the facts: SOC location, hours, licence scope, integrations, response actions, data residency. A wrong SOC city or an outdated product name can do more harm than absence, especially in a regulated bank's vendor review.

### Step 4: Check crawl access

Ask your web team to test whether PerplexityBot, OAI-SearchBot and Googlebot can fetch your key pages. Check robots.txt, WAF rules and bot management settings, and compare against Perplexity's published IP ranges. Security vendors find blocks here more often than any other sector.

### Step 5: Map the cited sources

List every URL Perplexity cited, grouped by type: vendor sites, analyst pages, listicles, news, forums, partner marketplaces. This tells you where the answers come from and which of those sources you could reasonably influence.

## How to fix it

The fix is to publish the facts CISOs ask about in a form Perplexity can read and quote, then make sure trusted third parties repeat them consistently. None of this guarantees a citation, but it removes the reasons you are being skipped.

### Publish one page per service with honest scope

Give MDR, managed SOC, penetration testing, incident response and vulnerability management their own pages. Each should state what is included, what is excluded, response actions you take versus recommend, hours of coverage and who the service suits. Perplexity favours passages that answer a question directly, and "what does your MDR include" is one of the most common.

### State your SOC and licensing facts plainly

Create a short page covering where your SOC is, whether it runs 24x7, where analysts sit, and where log data is stored and processed. If you hold a NACSA licence for managed SOC monitoring or penetration testing, say so with the exact scope. If your application is in progress, say that instead. Accuracy matters more than polish here.

### Explain PDPA and processor duties without overclaiming

Mayer Brown's review of the PDPA amendments notes that data processors are now directly subject to the Security Principle, and that data controllers must notify the Commissioner of personal data breaches as soon as practicable. An MDR provider handling client logs is usually a processor. Publish how your contracts, controls and incident handling support your clients' obligations, reviewed by counsel. Avoid phrases like "PDPA certified"; the Act sets duties, not certificates.

### Put integrations and data flows in HTML

Security architects ask about SIEM, EDR, cloud and identity integrations. Publish an integrations list as a real HTML page, not a logo wall, with one line per integration saying what data you ingest and what actions you can take. Add a plain subprocessor and data-flow summary. These pages are dull to write and exactly what retrieval engines quote.

### Open your threat research, but keep it dated and specific

Dated advisories on threats seen in Malaysia and the region are some of the most citable material a local vendor has. Publish summaries in HTML with a clear date, the sectors affected and practical guidance. Keep detection logic and indicators you would rather not share in the gated version if you must. Open, dated research also feeds the press and community sources AI tools already trust.

### Earn the third-party sources AI already reads

| Source type | Why AI trusts it | What to do |
| --- | --- | --- |
| NACSA licensing records | Official and specific | Check that your registered entity name matches your website exactly |
| Microsoft, AWS and Google partner directories | Structured, frequently crawled | Complete your listing with Malaysian SOC and service scope |
| Local tech and business press | Independent and dated | Offer research and named spokespeople, not product launches |
| Industry bodies and conferences | Credible, sector-specific | Publish talks and slides as HTML summaries on your site |
| Peer review platforms | Buyer voice, structured | Ask real clients for reviews that mention service and location |

### Keep one entity, one spelling

Use the same company, product and SOC names across your site, SSM-registered name references, partner directories, LinkedIn and press. Inconsistent naming splits your evidence across several "entities" and makes it harder for any engine to connect the facts to you.

## What to measure

Measure four things monthly on the same prompt set: mention rate, citation share, accuracy and the source mix. Report them as ranges across repeated runs, because Perplexity's answers change with the question wording, the user and the day.

- **Mention rate:** the share of prompt runs in which you are named.
- **Citation share:** how often your own pages are among the cited URLs, compared with rivals.
- **Accuracy:** the share of mentions with correct SOC, licence, scope and integration facts.
- **Source mix:** which third-party sources appear most, and whether they describe you correctly.
- **Referral traffic:** sessions from perplexity.ai and other assistants in your analytics, as a supporting signal.

Re-run the set after major changes such as a new licence, a new SOC or a product rename. Do not chase week-to-week swings; look for direction across three months.

## Common mistakes

- Blocking PerplexityBot at the WAF or CDN while marketing pays for content that cannot be fetched.
- Keeping every datasheet, threat report and service description behind a lead form.
- Claiming "PDPA compliant" or "NACSA approved" without stating the actual licence, scope or controls.
- Writing service pages in category slogans instead of answering what is included, excluded and where it runs.
- Using different company or product names on the website, partner listings and press.
- Judging progress from one Perplexity screenshot instead of repeated runs on a fixed prompt set.

## How Shubi helps

Shubi is an AI visibility company based in Malaysia. We run fixed prompt sets across Perplexity, ChatGPT, Gemini and other assistants to show where cybersecurity vendors are named, cited and described wrongly, then help fix the pages, crawl access and sources behind those answers. Start with [AI Visibility Intelligence](https://tryshubi.com/services/#intelligence), or see how we approach [content AI can quote](https://tryshubi.com/services/#content). [Message Shubi on WhatsApp](https://wa.me/601137634679)

## Frequently asked questions

### Why does Perplexity list global MSSPs when we run a SOC in Malaysia?

Perplexity builds each answer from pages it finds and reads at the time of the question. Global providers publish detailed service, region and integration pages, while many local vendors keep the same facts in decks and gated datasheets. If the question asks for a Malaysian SOC and your site never states where yours is, Perplexity has nothing to cite.

### Should we mention our NACSA licence on our website?

If you hold a licence for managed SOC monitoring or penetration testing under the Cyber Security Act 2024, stating it plainly helps buyers and AI tools check it. Use the exact licence scope and keep the wording factual. If an application is pending, say so honestly rather than implying approval.

### Does blocking AI crawlers protect our security research?

It stops Perplexity from citing that research, which is often the opposite of what marketing wants. Perplexity documents PerplexityBot separately from model training, so you can choose which pages to open. Keep sensitive detection logic private and publish summaries, advisories and service facts openly.

### How quickly will changes show up in Perplexity answers?

Perplexity says robots.txt changes can take up to 24 hours to take effect, and new pages still need to be found and chosen as sources. Expect weeks rather than days for consistent change, and run the same prompts several times, because answers vary between runs and users.

## Sources

- [Perplexity Crawlers (Perplexity documentation)](https://docs.perplexity.ai/guides/bots)
- [How does Perplexity work? (Perplexity Help Center)](https://www.perplexity.ai/help-center/en/articles/10352895-how-does-perplexity-work)
- [Cyber Security Act 2024 (Act 854) (NACSA)](https://www.nacsa.gov.my/act854.php)
- [Malaysia's New Cyber Security Act 2024: A Summary and Brief Comparative Analysis (Mayer Brown)](https://www.mayerbrown.com/en/insights/publications/2024/12/malaysias-new-cyber-security-act-2024-a-summary-and-brief-comparative-analysis)
- [Key amendments to Malaysia's PDPA and the launch of cross-border transfer guidelines (Mayer Brown)](https://www.mayerbrown.com/en/insights/publications/2025/07/from-legislative-reform-to-practical-guidance-key-amendments-to-malaysias-pdpa-and-the-launch-of-cross-border-transfer-guidelines)
- [AI features and your website (Google Search Central)](https://developers.google.com/search/docs/appearance/ai-features)