Will ChatGPT recommend a local cybersecurity firm over a global one? (Malaysia)

Mostly yes. When Malaysian buyers asked ChatGPT for a cybersecurity firm in our test, 74 of the 89 times it named a firm, that firm was headquartered in Malaysia. The exception was the English question "best cybersecurity company in Malaysia for penetration testing", where foreign firms outnumbered local ones because ChatGPT read international directory and CREST pages. On every other question that drew names, local firms led, mostly through their own websites and Malaysian provider lists, and the NACSA licence stated on those websites was repeated back to buyers.

The scoreboard below goes question by question. The questions are EasyFound's standard buyer set for this trade: short, keyword-style phrases rather than full chat sentences, each asked three times.

A firm counts once per answer. "Malaysian" means headquartered in Malaysia, which we checked by hand on each firm's own site and public profiles; a Malaysian subsidiary or office of a foreign group counts as based abroad.

Where did local cybersecurity firms beat global ones in ChatGPT's Malaysian answers?

Local cybersecurity firms led both English questions that described the buyer's situation: a managed SOC for a mid-sized company, and help for a KL SME after a ransomware scare. For those two questions, all 35 links in ChatGPT's answers went to firms' own websites, and about half of those pages had "Malaysia" in the title.

One KL firm, Firm A in our CSV, shows what got repeated. It was named in 8 of the 18 answers. It came first in 6 of them. Every time, ChatGPT linked the firm's own website and mentioned its NACSA licence, and half the answers also gave its KL office.

The Malay and Chinese questions also went local. ChatGPT searched almost entirely in English for both, as in our language test. For the Chinese question, two of the three answers took their names from provider lists: CyberSecurity Malaysia's certified and registered partner lists, and CREST's member pages. The firms named were the ones on those lists.

Where did global cybersecurity firms come out ahead on ChatGPT in Malaysia?

In our test, global cybersecurity firms came out ahead only on the English "best … for penetration testing" question. Across its three runs, 5 of the 8 firms named were based abroad. ChatGPT read lists here, not firms' own pages: 7 of the 8 links went to international B2B directories or to CREST's accreditation pages.

The lists blurred where firms are. The first run put a US-based firm first, taken from one directory's Malaysia page, without saying it was American. The second said that if you need "a Malaysia-based pentest vendor", you should shortlist an Indian firm first; CREST's own page on that firm lists offices in India, the USA and Singapore, not Malaysia.

A "best" question sending ChatGPT to directories is the pattern we saw for AI automation firms. Across the whole test, 9 of the 15 namings of firms based abroad came from a directory, CREST or CyberSecurity Malaysia list rather than the firm's own site.

What role did the NACSA licence play in ChatGPT's answers about cybersecurity firms in Malaysia?

The NACSA licence came up again and again in ChatGPT's answers about Malaysian cybersecurity firms, and ChatGPT took it from the firms themselves. It called a firm NACSA-licensed 21 times across its answers. In 20 of those, the source was the firm's own website, usually worded as what the firm "says" or "states".

None of the 9 answers carrying those mentions linked a NACSA page, so the licence reached buyers as the firm's own claim. Asked directly for a "NACSA licensed cybersecurity service provider", it named no firm in any of its three answers. It explained the licence and linked only NACSA's own pages.

NACSA's licensing page says the application "must be submitted electronically via the online portal at licence.nacsa.gov.my starting on 1st October 2024" (NACSA). Its FAQ, linked from that page, sets the scope: "Any cyber security service related to managed security operation centre monitoring service and penetration testing service." It also says "The list of licenced Cyber Security Service Providers will be published on NACSA's Licensing portal once the approval process has been completed" (NACSA FAQ).

NACSA's rules don't set local firms apart. The same FAQ says "A foreign company which provides cyber security services to companies located in Malaysia must apply for a licence." Our reading: the licence helped Malaysian firms in these answers because they wrote it on their pages, and that advantage is open to anyone who does the same. The FAQ also covers anyone who intends to "advertise, or in any way hold himself out as a provider" of these services, so only state a licence you hold. This is general information, not legal advice.

If you're a local cybersecurity firm in Malaysia, what should you change for ChatGPT?

A local firm's edge in these answers came from its own pages and the Malaysian lists ChatGPT relied on, so start there.

1. Begin with EasyFound's free check. It shows which firms ChatGPT names when someone asks, say, "we're a 300-staff manufacturer in Shah Alam and need a managed SOC, who's good in Malaysia?", and we then walk through the answers with you on a free call.
2. If you hold a NACSA licence, put it on your homepage in plain text. Name the service it covers (SOC monitoring, penetration testing, or both) and keep it current, since NACSA says a licence lasts one year.
3. Give each service its own page. Managed SOC, penetration testing and incident response each need a page with "Malaysia" and your city in the title.
4. Make your head office plain wherever you're listed. The "best" question was answered from CREST announcements and international directories, so check that your CREST page and any directory profile name a Malaysian head office, and that your own site says it in words.

EasyFound is an AI search visibility (GEO) tool built for Malaysian businesses. For a SOC or pentest firm, it shows which providers AI engines shortlist for buyer questions in English, Malay, Mandarin and Manglish, and whether your licence and head office come through correctly. Our team can run it for you in our AI SEO service and rewrite the service pages that fall short.