An AI audit of digital strategy among the 100 largest security systems integrators in the United States.
An independent study, not affiliated with or endorsed by SDM Magazine. Produced by a marketing firm that serves this industry. Self-funded — no company paid to be included, excluded, scored, or described. The scoring instrument is published in full so that anyone can reproduce the study independently (Appendix A).
This study was produced by a marketing firm that sells its services to the security industry. So it is fair, on picking it up, to wonder whether it is research or a sales pitch wearing the costume of research.
You would be right to ask. A business leader who simply took it on faith would be the careless one. We ask only that you resolve the doubt the right way — by checking, not by assuming — because this study is built to be checked. Three things settle it.
A disguised sales pitch withholds the answer to force the call. This report gives the answer away. Read the rest with that in mind.
Of the 100 largest security systems integrators in the United States, just five demonstrate genuine vertical-market expertise on the pages where their buyers actually decide. Not five per vertical — five in total, out of the ninety-eight whose business this study could assess. The overwhelming majority name the industries they serve without owning them, differentiate on product capability or geography instead of buyer understanding, and — in not one single case out of the hundred — give a prospective buyer a real tool to diagnose their own risk before being asked to buy something.
This is not a competence gap. These are the largest firms in the industry. It is a gap between what an integrator's website claims — partnership, consultative service, tailored solutions — and what that same website does a click later, which is lead with product. Nearly every site presents as buyer-focused on the surface. Most have made a real move in that direction: they describe their products in terms of customer benefit rather than dry specification. But benefit-framing still leads with the product. Genuine buyer-focus reverses the order — it leads with the buyer's world, their threat, their situation, and their exposure first, and presents the product only afterward, as the answer to a problem the page has already made the buyer feel. That reversal is a discipline of sequence, not vocabulary, and it is almost entirely absent across the cohort.
The natural question, reading this, is the one worth sitting with: where would we land?
This report is built so you can answer that for yourself. The finding and its evidence are in Findings (Section III). If you doubt the method, Methodology (Section II) shows exactly how every site was scored, including the verbatim instrument. The Model (Section IV) describes what genuine vertical ownership looks like when it is done right, drawn from the few firms that achieved it. Everything is navigable from the top; nothing requires wading through a hundred company write-ups to reach the point.
A complete, company-by-company analysis — every integrator's stage placement and the reasoning behind it — exists as part of this study. It is not reproduced here. Your own company's specific placement is available on request; the complete named dataset is part of a client engagement. The pattern this report documents is the industry's; whether it is also yours is the question the rest of this report is built to help you answer.
Why vertical-market authority decides who is read as an advisor and who is sorted on price — and the uncomfortable hypothesis this study set out to test.
Buyers in regulated, high-stakes environments — schools, hospitals, financial institutions, regulated facilities — are not shopping for cameras and card readers. They are looking for a partner who understands their world: the threat model of a school at dismissal, the compliance exposure of a hospital pharmacy, the after-hours vulnerability of a cash-handling branch. An integrator who demonstrates that understanding is positioned as an advisor. An integrator who does not is positioned as a vendor — interchangeable, and sorted on price.
That sorting increasingly happens before a salesperson is ever involved. The buyer's first and often decisive encounter with an integrator is its website, evaluated alone, on the buyer's schedule, frequently now with the assistance of AI tools that read and summarize that website on the buyer's behalf. The page is the pitch. If the page treats a school district and a warehouse as the same buyer, the buyer concludes the integrator sees them the same way.
Among the largest, best-resourced integrators in the country, how many genuinely demonstrate vertical-market expertise — not merely on the page, but all the way through to the moment the buyer tries to act?
Because “buyer-focused” is a phrase every firm applies to itself, the study had to define it precisely enough to measure. We did not measure tone, polish, or sincerity. We measured five observable properties of a buyer's actual path through a site:
The central distinction running through all five is one of sequence. Product-led positioning leads with what the integrator sells and reasons outward to the buyer. Buyer-focused positioning leads with the buyer's situation and arrives at the product as its resolution. The same products appear in both; nobody buys an unspecified system. The difference is order. Diagnose, then prescribe.
The hypothesis the study tested was not that buyer-focused positioning is superior to product-led positioning. That proposition is well established and not in dispute; marketing authorities since Theodore Levitt have affirmed it, and most integrators would say they already practice it. The hypothesis was sharper and more uncomfortable: that the industry's websites overwhelmingly present as buyer-focused while demonstrating the opposite the moment the buyer acts — and that the likeliest explanation is a confusion between describing products attractively and actually leading with the buyer.
If so, the gap is not a knowledge deficit to be taught around. It is a positioning blind spot — and the firm that sees past it first moves before the field does.
One uniform rubric, applied identically to all 100 sites — generous on effort, strict on proof — with the instrument published in full so the study can be checked, not merely trusted.
The population is the 100 companies in SDM Magazine's 2025 ranking of top systems integrators, ranked by North American security-integration revenue. This cohort was chosen deliberately: it represents the industry's leading edge. If the gap appeared among small, under-resourced regional dealers, it would be unremarkable — a competence-and-budget story. Finding it among the hundred largest and best-resourced integrators in the country makes it a paradigm finding rather than a resource finding. These firms have the means to do this well. The question is whether they do.
A small number of companies on the ranking compete in an adjacent business rather than vertically-segmented commercial security integration — for example, a firm whose website addresses acquisition targets rather than security buyers, or a pure fire-suppression specialist with no security-integration practice. These boundary cases were flagged during scoring and reviewed individually (see Scope Boundaries, §8) rather than silently dropped or forced into a score.
Each company's public website was assessed against a single, uniform rubric, applied identically to all 100 sites. Sites were reviewed during July 2026; each placement reflects the public site as observed that month, and sites change. The assessment followed the buyer's own path: homepage and navigation; vertical or industry pages (prioritizing healthcare and education where present, for comparability; otherwise the company's strongest available vertical); and — critically — the actual call-to-action path, followed click by click to the point where the buyer would act.
Scoring was deliberately generous in one direction and strict in another. Generous: each company was scored on its strongest observed vertical effort, giving every firm the benefit of its best work. Strict: the bar for what counts as authority was high, and ambiguous depth was scored down, not up. Vertical vocabulary, product lists under an industry header, bare regulation names, and tenure claims did not count as expertise. Only specific, demonstrated, operational understanding did.
The assessment was conducted by an AI model reading each public site. This choice was intentional: a single AI instrument holds the same rubric steady across all hundred companies, without the fatigue, drift, or sympathy that erode human consistency over a hundred-site review — and it can be reproduced by anyone, since the instrument is published in full (Appendix A). It also mirrors how a growing share of buyers now encounter these sites: increasingly through AI tools that read and summarize on their behalf.
The core of the rubric is an adversarial test we call find-and-replace. For any vertical page, mentally strike out every product and equipment word and every instance of the vertical's name, then read what literally remains. If what remains is generic assurance that could apply to any industry or any vendor — “we keep you safe,” “trusted for decades,” “comprehensive solutions” — the page fails. Only if specific, operational, vertical-particular understanding survives does it pass.
A healthcare page that, stripped of “healthcare” and its product names, still speaks to pharmaceutical diversion control and accreditation-inspection reporting has survived. A healthcare page that reduces to “we protect your facility with integrated solutions” has not.
The full scoring instrument, including the five-stage definitions and the explicit list of surface markers that do not count as expertise, is reproduced in Appendix A. We publish it in full deliberately: a study that hides its instrument asks to be trusted; a study that shows it asks to be checked.
Every company was placed at one of five stages — a climbing scale from no vertical attempt at all, to a single buyer's world owned completely on the buyer's actual path.
Two boundary questions arose and were resolved explicitly rather than buried.
The fire-versus-security spectrum. Several firms span fire/life-safety and security integration. We drew the line at whether the company competes in vertically-segmented commercial security integration: a pure fire-suppression specialist with no security practice falls outside the study's question and was flagged for exclusion; a fire-led firm with a genuine security-integration practice was scored on that practice. That boundary cases arose, and were resolved individually rather than waved through, reflects how the rubric was applied throughout.
Scale. Size was never a reason for exclusion. A national integrator with its own buyer-facing site was scored exactly as a regional firm was — on what its site demonstrates, not on its revenue.
These assessments are AI-generated and were not individually validated by human reviewers (except as noted in §10). Each reflects an AI model's interpretation of a company's public website at a point in time. They may contain errors, including misclassification or, in cases of company-name collision, analysis of the wrong entity. Findings should be read as an AI-instrument audit, not as adjudicated fact.
We state this plainly because it is both honest and load-bearing. The study's value is not the precise placement of any single company; it is the distribution across a hundred companies, which is robust to individual error in a way no single row is. Two further disciplines bound the limitation: companies proposed for exclusion on scope grounds were reviewed by a human before being set aside, and any company singled out for specific positive recognition was verified first-hand before being named. Websites also change; this is a point-in-time study.
This is an audit of public website evidence. It does not measure — and draws no conclusion about — a firm's sales performance, win rates, customer satisfaction, technical competence, proposal quality, offline reputation, or the quality of its private, relationship-led selling.
The finding is narrower and specific: it concerns what a firm's public pages demonstrate to a buyer — or to the AI reading on that buyer's behalf — who arrives without a prior relationship. That buyer is a growing share of the market, and the website is the only thing they can see. (Nor is the finding “stop showing products”: as §16 argues, buyer-first is additive.)
The distribution is steeply concentrated at the bottom — and human review trimmed the top rather than inflating it. What survived that process is what follows.
Before the distribution, a word on what happened when human judgment went behind the instrument — because it is the best evidence available that the numbers below mean what they say. The AI instrument scored every site; humans did not re-score all hundred. But the placements that carry the most weight — the small number of companies flagged as reaching the top of the framework — were each inspected first-hand. That review did two things worth reporting.
First, it moved one company down. The instrument had placed a firm at the top stage on the strength of genuinely good vertical content. First-hand inspection found that the content lived off the buyer's path — in a blog post reachable only by search, not on the company's navigated site — and that the point of action discarded the vertical entirely. Good material, wrong place. On review, the company was moved from the top stage down to the “names it, then the funnel forgets it” band, which is where its real behavior placed it. The number at the top is lower after human review than the instrument first reported — which is the direction that should increase, not decrease, a reader's confidence in it.
Second, it confirmed the rest — and surfaced something the rubric was right to allow. The remaining top-stage companies held up: each genuinely owns a buyer's world on the buyer's path. But execution quality varies even among them. One top-stage firm leads with the buyer correctly, sequences the page well, and offers a genuine give-first asset — and that asset, on inspection, is thin and awkwardly built. It still clears the bar, and it should, because the bar measures the right thing: this firm gets the sequence right, and sequence is what the buyer meets first.
Execution can be improved in an afternoon; sequence is the thing most of the industry has not figured out at all.
Across the hundred largest security integrators in the country, vertical-market authority is steeply concentrated at the bottom. Of the ninety-eight firms whose business fell within scope, eighty-nine — more than nine in ten — either make no vertical attempt at all or name verticals they do not own. A thin band of four carries a genuine vertical page to the edge of action and then abandons it at the click. And at the top — the firms that carry buyer-focus completely through, for even a single vertical — there are five.
| Stage | What it means | Firms | Share |
|---|---|---|---|
| 0Doesn't try | No vertical segmentation at all. Addresses a generic “business,” or splits only into “home” and “commercial.” | 27 | 28% |
| 1Names it | Industry pages or mentions exist, but are generic underneath — a product menu under a vertical header, a regulation named but not explained, the same page with the noun swapped. Fails find-and-replace. | 62 | 63% |
| 2Funnel forgets | A genuinely owned vertical page exists, but the point of action discards the context, routing the buyer into a generic “what type of property?” form. | 4 | 4% |
| 3Diag → sale | A real multi-question tool exists, but it qualifies a product sale rather than diagnosing the buyer's own risk. | 0 | 0% |
| 4Owns it | For at least one vertical: operational understanding that survives find-and-replace, regulation explained rather than named, a give-first asset or vertical-respecting point of action, the buyer carried through to action. | 5 | 5% |
| — | Reviewed and set aside on scope grounds (competes in an adjacent business; see §8). | 2 | — |
| — | In scope, scored | 98 | 100% |
Denominators, stated plainly: the cohort is the 100 largest integrators by the SDM 2025 ranking; 2 were set aside on scope grounds (one a pure fire-suppression specialist, one an acquisition-focused holding company), leaving 98 in-scope companies as the scored denominator; 5 of those reached Stage 4. Any share in this report is a share of the 98 in-scope companies unless a narrower subset is named. Individual placements are AI-generated and unverified (see §9); the value of the table is the distribution, not any single row.
Two findings stand out as categorical rather than merely lopsided:
Stage 3 is the sales-qualifying diagnostic — a real multi-question tool, but one that asks “what do you currently own?” to qualify a product recommendation. We found none. More tellingly, no company built the stronger thing that would sit above it: a give-first diagnostic that helps the buyer understand their own exposure before any ask. Every “free assessment” and “free security review” we encountered was a contact form or a service offer, not an instrument that hands the buyer insight. The most powerful give-first move available to an integrator — let the buyer diagnose their own risk — was built by no one in this cohort. It is the cleanest first-mover opening the study found.
The highest-scoring companies are not generalists who do everything well; without exception, they achieved their standing through deep ownership of a single buyer's world — a school, a bank branch, a cannabis operation — rather than through broad, shallow coverage of many. Depth in one beat breadth across all, every time.
The single most damaging pattern in the study is not the absence of vertical content. It is the abandonment of vertical content at the precise moment the buyer acts.
Picture a school facilities director who finds a genuinely strong K-12 security page — one that understands dismissal-time vulnerability, the procurement realities of a district budget, the difference between a panic button and a compliant alert system. She is met, page by page, by a firm that appears to understand her world. She clicks “Get Started.” And she lands on a form that asks: What type of property? Homeowner / Business / Rental. There is no option for a school. The firm that understood her thirty seconds ago no longer knows she exists.
This is the Stage 2 failure, and it is uniquely costly because it squanders work already done. A Stage 0 company never raised the buyer's expectations. The Stage 2 company raised them, earned the click, and then — at the one moment that converts interest into contact — reverted to treating a school district like a homeowner shopping for a doorbell camera. The understanding was real. It simply was not carried across the threshold where it would have mattered most.
Several recurring substitutions explain how sites that present as buyer-focused end up product-led in practice:
Many firms differentiate on a genuine product strength — verified audio detection, remote video guarding, armed patrol response — and deploy that single capability story across every industry. It is a real differentiator. It is not vertical understanding. A strong answer to “what makes you different?” is not an answer to “do you understand my world?”
A large group organizes the site by city rather than by industry, producing dozens of near-identical location pages. Notably, several of these firms demonstrate genuine give-first instincts — local crime data, severe-weather guidance, even explained local fire code — but aimed at place rather than buyer type. The muscle for buyer-focused content exists; it is simply pointed at the wrong axis.
The most common single pattern: a site lists the industries it serves — sometimes a dozen — as a menu, a roster of past clients, or a set of identically-structured pages with the industry noun swapped in. The intention to be vertical is visible. The substance is not.
A notable subset genuinely possess deep vertical expertise — but it lives somewhere the buyer's path does not go: a gated PDF, a blog post, a client-project roster, a testimonial, even an employee's personal social media. We treat the frequency of this pattern as an open question rather than a measured rate. But where it occurs, it is the most telling case of all — because it proves the gap is not a knowledge gap.
The most instructive company in the entire study (described here in anonymized form, as no underperforming firm is named) is not one of the weakest. It is one of the most elaborate. This firm built the most extensive vertical architecture in the field — more than twenty distinct industry pages, with sub-segments beneath them: healthcare split into acute and long-term care, education into K-12 and higher education, and so on. By the measure of effort and structure, no one in the cohort tried harder. And underneath that architecture, the copy is interchangeable. Strip the products and the industry name from any one of those twenty-plus pages and the same sentence remains: comprehensive, scalable, integrated solutions for the sector in question. The scaffolding of buyer-focus is immaculate. The substance is generic.
What makes this firm the definitive case is what we found one layer down. It possesses genuine expertise — a detailed, operationally sophisticated risk-assessment document for K-12 security. That document exists. It is simply gated behind a download, off the page where the buyer lands — and even it, at its close, reverts to product pillars.
This gap is not a knowledge gap, an effort gap, or a resource gap. The firm has all three in abundance. What it lacks is the discipline of sequence and deployment — leading each vertical with the buyer's world, on the page the buyer actually reads. If the firm that built the most vertical scaffolding in the industry still does not lead with the buyer where it counts, then “try harder” is not the answer. The answer is to do the one thing almost no one does: diagnose before you prescribe, where the buyer can see it.
What genuine ownership looks like, why buyer-first is additive rather than subtractive, and the unusually clean first-mover opening the gap creates.
The few firms that reached the top of the framework share a recognizable pattern, and it is worth describing because it is reproducible. Genuine vertical ownership looks like this:
Notably, genuine ownership did not require a regulatory hook. One of the strongest examples owned bank-branch security through pure operational depth — the workflow of cash handling, the specific vulnerability of the after-hours deposit, the access controls that keep a service technician from holding a permanent code — with no single statute to cite. Operational understanding, deeply demonstrated, was sufficient. Vocabulary never was.
One clarification is essential, because the easy misreading of everything above is “stop talking about your products.” That is not the argument. Buyer-first is a discipline of sequence and coverage, not suppression. Products belong on the site — in depth, with specifications, named platforms and all. Nobody buys an unspecified system, and a buyer who has reached the point of comparing equipment is a buyer who should find equipment. The discipline is not to remove product content; it is not to lead with it as the only content, and to make sure the rest of the buying picture is served too.
Because the buyer is never one person. A commercial security decision runs through a buying group, and that group is plural in two dimensions at once — in role (facilities, IT, finance, security, each weighing different things) and in situation (where each person sits in their own journey, and why they came). The IT stakeholder genuinely needs the technical guts — integration, network posture, data handling — and serving that depth, framed around IT's actual review concerns, is buyer-first for that buyer. The framework does not flatten the buying group into one narrative; it maps the matrix and speaks to each cell in the language that cell needs.
Buyer-first never means hide the products. It means serve the actual buyer in front of you — and sometimes that buyer is holding a service ticket, not a problem statement.
Consider the prospect whose integrator has folded, been acquired, or worn out their welcome, and who already has equipment on the wall. This buyer is not shopping for a security philosophy. They are searching, specifically and by name, for a company that can service and monitor the system they already own — do you support this access platform, can you take over monitoring on this panel, will you service this camera line. Every integrator knows what this buyer is worth: a takeover that converts directly to recurring monthly revenue with no installation sale in front of it. A site built only around buyer-world narrative is invisible to exactly this buyer — and hands that recurring revenue to whichever competitor bothered to say, plainly, “yes, we service that.”
This is not an exception to “diagnose before prescribe.” It is what the sequence looks like when the buyer arrives pre-diagnosed. The takeover buyer has already done the discovery a skilled salesperson would have led. Meeting them immediately with product- and platform-specific service capability is not leading with the product over the buyer; for this buyer, in this situation, the product-specific answer is the buyer-first answer. The discipline was never “hide the products.” It was always “serve the actual buyer in front of you” — and sometimes that buyer is holding a service ticket, not a problem statement.
For the integrator on the wrong side of this gap, the cost is positional. A firm that looks interchangeable online is evaluated as interchangeable — pulled into product-and-price comparisons it cannot win on differentiation, because it has demonstrated none. The buyer who cannot tell, from the website, whether this firm understands a hospital from a warehouse will decide on price, proximity, or whoever a peer happened to recommend.
For the integrator willing to close it, the opportunity is unusually clean, for three reasons the study makes concrete:
The firm that imports the sales discipline into its marketing does something almost no competitor has thought to do — because almost no competitor's marketing team was ever taught it.
The buyers these integrators serve are already evaluating them the way this study did — increasingly with AI tools that read a website, judge whether it demonstrates understanding of a specific buyer's world, and summarize the verdict before a salesperson is ever contacted. The website is no longer the brochure that supports the sale; it is the first round of the sale, conducted in the firm's absence.
In that environment, the gap this study documents is not a cosmetic one. A firm whose site cannot demonstrate — to a buyer or to the AI reading on the buyer's behalf — that it understands a hospital differently from a warehouse, will be sorted accordingly. The firms that close the gap — that lead with the buyer, explain rather than name, give before they ask, and carry the buyer through to action — will be the ones the next generation of buyers, and the tools those buyers rely on, recognize as the experts.
The gap is wide. The top is nearly empty. And the discipline required to claim it is one the industry already half-possesses and has simply never pointed in the right direction.
If this study has prompted the question where would we land?, the most useful next step is to find out — and you can begin that yourself, today, before talking to anyone.
Step one — run this on your own site. Take your strongest vertical page and apply the find-and-replace test: strike out every product name and every instance of the industry's name, and read what remains. If what's left could describe any vendor in any industry, the page names a vertical it does not yet own. Then follow your own call-to-action the way a buyer would — click “Get Started” from that vertical page and ask whether the next step still knows which buyer you are.
Step two — go deeper. A fuller, more actionable walkthrough — how to lead with the buyer's world, how to explain regulation operationally, how to build the diagnostic none of the hundred had built — is available on the SMR website, along with a growing library of related guidance. It is given freely, and useful whether or not we ever speak.
And if you want more. Your own company's specific placement in this study — where you landed, and why — is available on request. The complete, company-by-company analysis is part of a client engagement. Neither is required to act on everything above — and that is the point. By design, you now hold everything you need to close this gap yourself: the framework, the test, and the model of what good looks like. That was the promise on the first page. This is us keeping it.
Every company in this study was scored against a single instrument, applied identically to all 100 sites. In brief:
The five stages are defined in §7. A company is placed at its strongest observed vertical effort — the benefit of its best work — but the bar is strict, and ambiguous depth is scored down, not up. The resulting placement is a best-case read of a company's public buyer-focused maturity, not an average across its whole site.
On any vertical page, strike out every product and equipment word and every instance of the vertical's name, then read what literally remains. Generic assurance that could apply to any industry or any vendor fails; only specific, operational, vertical-particular understanding passes.
Each is a surface marker, neutral at best: naming a regulation without explaining what it requires; operational vocabulary (“lockdown,” “compliance,” “campus”) over generic copy; tenure and authority claims; a product list under a vertical header; a generic “free assessment” form (a service offer, not a give-first diagnostic).
When uncertain between two stages, assign the lower one — over-scoring is the failure mode the instrument is built against. And a Stage 4 placement requires a specific, citable operational insight that survives find-and-replace; a page that merely sounds expert does not qualify.
The complete company-by-company assessment — each integrator's stage placement and the full analysis behind it — is available in the complete edition of this report. Access is provided to clients and to qualified industry leaders on request. Your own company's placement is available on request as a first step.
The cohort is the SDM 100 — SDM Magazine's 2025 ranking of top systems integrators — a roster SDM publishes publicly. We reproduce it here for the reader's convenience and as a statement of method: every company below received the identical instrument and the same review, regardless of its size or rank. The list is presented alphabetically, not by revenue, deliberately — the study shone the same light on every firm, and ranking the roster by size would misrepresent that. Stage placements are not shown here; the aggregate distribution appears in §11, and individual placements are part of the complete edition.
The roster above is the SDM 100 as published by SDM Magazine, reproduced for reference. A small number of these companies were reviewed and set aside on scope grounds — they compete in an adjacent business rather than vertically-segmented commercial security integration (see §8); the in-scope count is given in §11. Sonitrol and Security 101 each appear as multiple independent franchise/regional entities in the ranking; each was assessed on its own public site.