Site health, conversion quality, referring-domain growth, and DACH share of search all moved forward this quarter. Search click volume on the ontinue.com property came in below Q1 — largely because the German site moved to its own domain (ontinue.de) mid-quarter, taking its traffic outside this property's measurement.
Average search position improved to 13.5, clearing the Q1 report's sub-14 target. Click and impression volume on the ontinue.com property came in below Q1 — the German site moved to its own domain (ontinue.de) in April, which took a meaningful share of that traffic outside this property's measurement, and a Q1 spike in branded and job-search queries also normalized.
Two things shaped the quarter's search volume. The German site moved to its own domain, ontinue.de, in April — its traffic now lives on a property that isn't yet measured here, so a portion of the Q1-to-Q2 difference reflects that boundary shift rather than lost demand. Separately, a Q1 surge in branded and job-search queries normalized, as expected. Ranking quality kept improving throughout. The clearest next step is verifying ontinue.de in Search Console, which brings the German traffic back into view and completes the picture.
April held near March's high before the German site moved to its own domain on April 21. May and June are the first full months measured without it, which is the main reason both sit below the Q1 monthly average — that traffic now lives on ontinue.de rather than having gone away. All three months are GSC data on rolling 28-day windows.
Non-branded, product-led queries grew this quarter — Microsoft-ecosystem terms (E5, Microsoft Sentinel, E5 licensing) and threat-intel content among them, exactly the commercial direction the strategy points toward. Job-seeker interest stayed healthy, shifting toward "ontinue jobs." The main declines are branded and category terms that spiked in Q1 and have since normalized.
| Query | Q1 Clicks | Q2 Clicks | Change | Signal |
|---|---|---|---|---|
| ontinue jobs | 5 | 28 | ↑ 460% | Job-seeker demand |
| e5 | 7 | 22 | ↑ 214% | Microsoft-ecosystem term |
| microsoft sentinel | 4 | 13 | ↑ 225% | Partner/platform term |
| microsoft e5 license | 1 | 9 | ↑ 800% | Microsoft-ecosystem term |
| ontinue soc | 14 | 20 | ↑ 43% | Recovering category term |
| password attacks | 65 | 72 | ↑ 11% | Growing — CTR still lags impressions, a title/meta rewrite opportunity |
| Query | Q1 Clicks | Q2 Clicks | Change | Context |
|---|---|---|---|---|
| ontinue (branded) | 2,313 | 1,904 | ↓ 18% | Branded volume normalizing from Q1's peak |
| ontinue ag | 144 | 102 | ↓ 29% | Branded variant |
| ontinue careers | 214 | 190 | ↓ 11% | Job-seeker interest shifted to "ontinue jobs" (above) |
| ontinue cybersecurity | 53 | 9 | ↓ 83% | Normalized after a +333% Q1 spike |
| mxdr | 17 | 3 | ↓ 82% | Normalized after a +70% Q1 gain |
| Page | Q2 Clicks | Highlight |
|---|---|---|
| Homepage — ontinue.com/ | 1,124 | Branded, normalizing from Q1 peak |
| /careers/ | 252 | Steady job-seeker traffic |
| /password-attack/ | 172 | Strong evergreen threat content |
| /resource/detecting-lumma-stealer/ | 135 | Threat-intel resource |
| /what-is-e5/ | 123 | ↑ Growing vs Q1 (110) |
| /resource/blog-behind-a-fake-claude-code-installer/ | 74 | ★ New this quarter — top new-content gainer |
| /sentinel-cyber-security/ | 52 | Microsoft-platform term |
Note: the German-site pages moved to ontinue.de in April (see Technical), so they no longer appear on this property.
The clearest theme in the data: E5 (7→22), Microsoft Sentinel (4→13), and Microsoft E5 license (1→9) all climbed as queries, and the pages behind them — /what-is-e5/ (123, up from 110) and /sentinel-cyber-security/ (52) — are pulling traffic to match. Buyers researching the Microsoft security stack are finding Ontinue, exactly where the positioning is strongest. More Microsoft-ecosystem content is the highest-confidence content bet.
Timely threat coverage earns organic search fast: the fake-Claude-installer post went 0→74 to become the quarter's top new-content gainer, while /password-attack/ (172) and /resource/detecting-lumma-stealer/ (135) are steady evergreen performers. A repeatable play — pairing threat-intel publishing with search demand.
The query grew 11% (65→72) and /password-attack/ is already a top-5 page (172 clicks), but its click-through rate lags its impression volume — Ontinue is being shown for the term more than it's being clicked. A title-tag and meta-description rewrite on that page is the single highest-leverage optimization available right now.
Three SEMrush audits — May 6, June 1, and July 1 (Q2 close) — track the quarter: site health climbed to a two-month high and held there, the German site moved to its own domain, and a small publishing-checklist item (distinct SEO titles) is worth building in to stop a recurring flag. Several long-standing items also closed out this quarter.
Site health held flat at 96% in April (matching the Q1 close figure), then climbed to 98% in May and held there through June — sustained for two full months, not a one-time blip. Warnings did spike mid-June (peaking near 14, driven by the recurring duplicate title/H1 issue below and new missing-meta-description flags), but active remediation brought them down to 3 by June 30 without denting the health score.
ontinue.com/de/ went from 372 GSC clicks in Q1 to effectively zero in May and June. The cause: on April 21, the German site moved off the ontinue.com/de/ subdirectory onto its own domain, ontinue.de, with TranslatePress handling 301 redirects from every old URL. Google Search Console's Coverage report shows why: 87 old /de/ URLs are flagged "Duplicate, Google chose different canonical than user," starting April 20 and holding at 88 pages from June 12 onward. That's Google correctly recognizing the redirect and pointing to the new domain instead of the old one — expected behavior for a domain migration, not a technical failure. The real gap: ontinue.de has never been added and verified as its own property in Search Console, so there's no visibility into how the migrated site is actually performing. The traffic may well have moved over and be performing fine — verifying ontinue.de in Search Console is the immediate fix, and Q3's first task is finding out what its numbers actually look like.
Domain growth continued at a healthy pace through Q2. The raw count of toxic domains crept up every month (32 → 37 → 41) even as the categorical toxicity label bounced Medium → High → Medium — worth watching, but not yet a trend that changes the strategy below.
May was the first reversal to High. The disavow-revisit trigger requires two consecutive High months — June's scan reads Medium, so that trigger does not fire this quarter.
New pages keep flagging because the SEO title tag is left to inherit the on-page H1, so the two match. The fix is to override the SEO title on publish so it differs from the H1 — a keyword-focused title tag alongside the reader-facing headline. Cleared reactively this quarter; building it into the publishing checklist prevents the flag at the source.
Missing Strict-Transport-Security header and a misconfigured HTTP-to-HTTPS redirect chain are both still flagged as of the June audit. No evidence of remediation via WP Engine/Cloudflare this quarter — carrying forward as an open item.
The GTM-side CMP template update flagged in May was applied and published July 1 (GTM Version 15). The "template update available" banner is gone from the live workspace. Closing this out.
The AI visibility score climbed steadily through the quarter — 15 in April, 21 in May, 23 at close — ending above the ≥20 benchmark. Ontinue's strongest AI citation to date also landed in the July query re-test: a #2 ranking on ChatGPT for a Microsoft-focused MDR query. Citation sourcing is still concentrated in Google's ecosystem, and mention counts remain small and noisy at this stage — both areas the Q3 plan targets directly.
A steady climb across the quarter — 15 (April) → 21 (May) → 23 (June) — ending above the ≥20 benchmark.
Mention counts are still small enough to swing month to month, so this early in AI discovery the citation-quality signals — the #2 ChatGPT ranking and a rising Gartner profile — are the more meaningful read than raw volume. The score itself trended up all quarter.
These are consent-gated counts under the new GA4 measurement (see GA4 section), so they set a fresh baseline rather than comparing to Q1's pre-gating numbers. GA4 also introduced a dedicated "AI Assistant" channel in June, which will make this cleaner to track from here.
The July 7 re-test covered all 5 core queries on both ChatGPT and Gemini — 10 combinations in total. The standout result: a #2 ranking on ChatGPT for "top MDR vendors for Microsoft 2026," described as "probably the strongest Microsoft-specialized MXDR provider today" — Ontinue's best AI citation in this exercise to date. The results confirm how much query phrasing drives outcomes, which is exactly the lever a targeted content and PR program can pull.
Ontinue didn't surface in Gemini's answers this quarter, where ChatGPT is already citing it — a distinct, addressable gap rather than a general visibility problem. Gemini leans heavily on the same review and analyst sources mapped below, so the review-volume and citation work already planned should move it directly.
ChatGPT's #2-ranked answer cites Sentinel expertise, AI-assisted investigations, and Teams integration — all real product differentiators, not a misrepresentation. The challenge remains frequency and consistency of appearance, not what gets said once Ontinue is present.
Ontinue surfaces most strongly on Microsoft-specific framings — the #2 ChatGPT result came from exactly that angle. Broader, generic MDR queries still favor incumbents with years of accumulated review volume, which is why the review-growth and citation work below matters. The through-line is consistent: lean into the Microsoft-first, Sentinel-native positioning where Ontinue already wins, and build the review and analyst footprint that extends it into the broader queries over time.
Both platforms disclosed their full source bibliographies during the July 7 re-test — a direct look at the citation graph feeding AI answers in this category. Counting every distinct source referenced across all 10 query/platform combinations gives a concrete map of where GEO effort should go, beyond the general "grow reviews" advice.
Prophet Security (10 refs), Quzara (7), and Radicl (6) are independent "top MDR/MXDR providers" roundup posts that both models cite repeatedly — and unlike Gartner or Forrester, getting included in a vendor-roundup blog post is a realistic PR/content placement, not a multi-year analyst relationship. These three are the highest-leverage, most attainable citation targets surfaced by this data.
Gartner is the single most-cited source by a wide margin (18 references, ahead of Microsoft's own ecosystem at 17). This hard-counts what the report has argued qualitatively all along — every new Gartner review compounds directly into AI citation probability. It's the same recommendation, now with a number behind it.
One of Red Canary's citations traces to a PR Newswire announcement of its Microsoft Verified MXDR designation — evidence that a well-timed, well-distributed press release can become a citable AI source, not just a one-day trade-press hit. Ontinue holds Verified Microsoft MXDR partner status but has no equivalent announcement showing up in either model's source list — a low-cost gap to close.
Gartner review volume directly correlates with AI citation frequency in vendor comparisons — a core GEO lever. Ontinue's rating rose to 4.8★, now tied for 2nd-highest among the 8 named alternatives Gartner surfaces. Review count held at 73; growing it is the clearest way to move the AI-citation and competitive-standing numbers together.
| Vendor | Gartner Reviews | Avg Rating | vs Ontinue |
|---|---|---|---|
| Arctic Wolf | 788 | ★★★★★ 4.9 | 10.8× more reviews |
| Sophos | 1,030 | ★★★★★ 4.8 | 14.1× more reviews |
| Ontinue ← you are here | 73 | ★★★★★ 4.8 | ↑ from 4.7 · 95% recommend · 0 new reviews |
| CrowdStrike | 476 (+21 this Q) | ★★★★★ 4.7 | 6.5× more reviews |
| SentinelOne | 384 | ★★★★★ 4.7 | 5.3× more reviews |
| Rapid7 | 315 | ★★★★★ 4.6 | 4.3× more reviews |
| Expel | 145 | ★★★★★ 4.6 | 2.0× more reviews |
| Red Canary | 136 | ★★★★★ 4.6 | 1.9× more reviews |
| Alert Logic | 154 | ★★★★★ 4.3 | 2.1× more reviews |
At 4.8★, Ontinue rates higher than every named competitor except Arctic Wolf (4.9) and ties Sophos — and Gartner's comparison engine flags Ontinue as scoring higher than CrowdStrike, Rapid7, and Alert Logic on evaluation/contracting and delivery/planning. The rating is a genuine competitive asset; the opportunity is turning it into review volume, where the count (73) sits below competitors like Red Canary (136) and Expel (145).
Review volume held flat on Gartner this quarter, so it's the most direct opportunity heading into Q3 — a review-generation push against the existing customer base compounds straight into both AI-citation probability and competitive standing. G2 is an even bigger opening: Ontinue's profile currently has zero reviews, so even a first handful would establish presence on a source AI engines weight heavily.
The headline this quarter is engagement quality: the session-to-key-event rate reached 6.2% in June, over four times the Q1 baseline. On volume, consent gating went live May 5, so May and June count only consent-granted sessions and set a new measurement baseline — April's higher totals reflect the old method plus a bot spike, and aren't directly comparable. June's device count sitting ~40% below the recent baseline is one genuine signal to keep an eye on.
Direct fell to 46.5% and Referral tripled to 21.4% of June's smaller, consented pool. Two non-organic drivers explain most of it: a new bot-like referral domain (trafficheap.cc, 339 sessions, 0 conversions — see below) and the growing webinar/email-mkto tagging gap now inflating Unassigned to 8.8%. Organic Search's 20.8% share is close to Q1's 20% — the most stable channel in the mix.
GA4 event tracking · Q2 total (April – June 2026)
GA4 sessions attributed to AI tool referrals · June 2026 vs Q1 baseline
Tracks the same consent-gating measurement change as overall sessions, not a real drop in AI-driven interest — GSC impressions, unaffected by GA4 gating, climbed across major markets over the same period. GA4 also added a new "AI Assistant" channel grouping in June, so this isn't a perfectly clean comparison.
trafficheap.cc sent 339 referral sessions in June with a high engagement rate but zero key events — the signature of low-quality bot referral traffic. A referral-exclusion / bot-filter rule keeps it out of the numbers, the same approach used for a similar source last quarter.
A focused set of moves for next quarter — completing the German-site measurement picture, building on the AI-citation and review momentum, and carrying the quarter's technical and conversion gains forward.
The German site moved to ontinue.de in April with redirects in place, but the new domain isn't yet a verified Search Console property, so its traffic isn't yet being measured. Verifying it brings that traffic into view and gives a true read on the site's total search performance — the single highest-leverage step for Q3, and a straightforward one.
Target: ontinue.de verified and reporting · full-property click volume back in viewThe July re-test produced Ontinue's strongest AI citation yet (#2 on ChatGPT for a Microsoft-focused query), confirming the Microsoft-first framing works. The next moves: extend that presence into Gemini, where Ontinue isn't yet surfacing, and activate one external citation source beyond Google's ecosystem. Both are driven by the same review-growth and content work in the source map above.
Target: Open Gemini presence · land 1 external citation sourceOntinue has a G2 profile but no reviews yet, so it isn't contributing to AI citations or category standing. A first wave from existing customers — pairing with the Gartner review push — turns an unused asset into an active, heavily-weighted source.
Target: First G2 reviews published · profile active in the categoryNew pages keep flagging because the SEO title tag inherits the H1. Overriding the SEO title on publish — a keyword-focused title tag distinct from the reader-facing H1 — prevents the flag at the source and removes a recurring reactive cleanup.
Target: Distinct SEO-title step added to the publishing checklistWHM will make two quick GA4 tracking fixes in July for cleaner attribution. Webinar and Marketo email traffic currently lands in Unassigned rather than Email (a channel-mapping override fixes it), and a new low-quality referral source (trafficheap.cc) will be filtered out the way its predecessor was last quarter. Both are quick, one-time changes that sharpen channel attribution going forward.
WHM to complete in July: Email channel mapping applied · trafficheap.cc filteredReferring domains grew 20.0% since Q1 close and toxicity settled back to Medium — quality-link volume is naturally outpacing the low-quality inflow, which is exactly the outcome a deliberate outcompete-with-volume approach would aim for. That's a strong case for making it an intentional, resourced effort rather than reaching for disavow. Site health also climbed to 98% by quarter close, the best reading yet. Separately, June's session key-event rate (6.16%, over 4× the Q1 baseline) shows the smaller, consented GA4 audience is converting better than ever — worth understanding well enough to replicate as raw volume recovers.
Target: 50+ more quality referring domains · Hold conversion-rate gains as volume recoversZooming out from this quarter's numbers, one theme runs through all of them — and the upcoming website rebuild is the moment that theme gets addressed head-on. Here's where things stand and what's worth getting in place between now and launch.
People who find Ontinue clearly like what they see — top-tier ratings, an accurate and favorable story in AI answers, and conversion quality that's better than ever. The gap isn't quality; it's visibility. Ontinue simply doesn't show up as often as it deserves to — in search results, in AI answers, and in the places buyers look to compare vendors. Closing that "found less than we're liked" gap is the work of the next few quarters.
A site refresh and rebuild is a rare opportunity: it's the one time you get to build search visibility and AI-friendliness in from the start, instead of patching it in later. It's also the moment when a site is most at risk of losing traffic — this quarter's German-site move is a small preview of how quickly hard-won visibility can drop out of view when things change. So the rebuild is worth planning as much around "keep what's working" as around the new look. The considerations below are the ones that protect the downside and capture the upside.
Every page that ranks today needs a clear home on the new site, with old web addresses pointing to the new ones. Done right, the rankings and traffic Ontinue has built simply carry over. Skipped, a rebuild can quietly reset months of progress — this is the single biggest thing to get right.
Right now, AI tools quote Ontinue's competitors far more often than Ontinue — not because they're better, but because there's more of their material out there to draw on. The rebuild is the chance to make Ontinue's content easy for both search engines and AI tools to read, understand, and quote, and to publish more of it.
Ontinue's strongest results — in search, in AI answers, and in conversions — consistently come from its Microsoft and Sentinel angle. Structuring the new site to lead with that strength, rather than spreading evenly across everything, plays to exactly where Ontinue is already pulling ahead.
Every behind-the-scenes change this year — the domain move, the tracking updates — briefly broke the ability to measure results. Setting up the new site's tracking before launch means results are measured cleanly from day one, and the rebuild's payoff can actually be proven rather than guessed at.
More customer reviews (on Gartner, and on the G2 profile that's still sitting empty) and more mentions in the "best MDR" roundups and press are the fastest ways to show up more often in AI answers and vendor comparisons. None of this needs to wait for the rebuild — it can start now and run straight through launch.
The biggest room to grow is the US market and the broader, non-Microsoft-specific searches — the places where larger, longer-established competitors still lead. Everything above is what builds the foundation to compete there over time.
WHM already tracks and interprets all of this quarter to quarter. The site rebuild is the natural point to bring that same lens to the planning itself — helping the new site launch without losing hard-won visibility, and come out the other side easier to find in both search and AI. We'd welcome the chance to partner on that from the start rather than measure it after the fact.