The state of AEO in B2B SaaS, 2026.
When a buyer asks an assistant which vendors to shortlist, the assistant reads before it answers. We pointed the same reader at 274 well-known B2B software companies and wrote down what it found. Most of the category leaders have done the mechanical work. The gaps that remain are more interesting, and cheaper to fix, than a missing file.
The numbers
- 61% publish an llms.txt
- 76% carry structured data
- 4% block an AI crawler
- 1 in 12 could not be read at all
Of 274 companies, 251 returned a readable homepage. Every percentage below is a share of those 251 unless it says otherwise. Each site was scored with the same code that runs inside our free AEO Lens extension: half the score is the llms.txt grade, a quarter is structured data on the homepage, a quarter is whether robots.txt lets the AI crawlers in.
The median score was 75 out of 100. A little over half the sites (53%) scored 75 or higher, 31% landed between 50 and 74, and 16% scored under 50. Nobody scored under 25, because almost nobody blocks the crawlers. Just under half (49%) had all three signals in place at once.
llms.txt went mainstream while nobody was looking
152 of the 251 sites publish an llms.txt, the plain-text file that tells a model what the company does and which pages matter. Two years ago this file was a proposal on a developer's blog. Among the companies buyers already know by name, it is now the majority position.
The files are mostly good. 95 of the 152 pass every check we run, which means 38% of all the sites we read have a file with nothing to fix. Where files fail, they fail in three places:
The first one is the trap. A file that lists every help article and changelog entry is a sitemap with a different extension. The point of the file is to choose. A model with a limited window reads the top and stops, so the summary and the first ten links are the file.
Eight files worth copying
76 of the 251 sites scored a full 100. These eight are not a ranking. They are the files we would hand to someone writing their first one, because each does one thing unusually well.
- Cloudflare cloudflare.com Opens with one paragraph that names all four product lines and the scale behind them, then 90 links in 13 sections, and tells the reader where the technical docs live instead of listing them.
- Shopify shopify.com Organized by what a merchant wants to do (start, sell online, sell in person, sell internationally), not by org chart. Every one of its 74 links carries a one-sentence description.
- Vercel vercel.com The shortest of the group: 24 links in under 5 KB. It has a section called "When to use Vercel" and another telling agents how to work with it. It chooses, which is the whole point of the file.
- Zapier zapier.com Written as a root map for agents: stable section anchors that are safe to deep-link, separate indexes per product surface, and a closing section of notes for automated fetchers.
- Webflow webflow.com The summary names the three teams it serves (marketing, design, engineering) in the first paragraph, and the file ends with plain notes for AI systems.
- Snyk snyk.io A curated map that tells the reader which pages answer which kind of question: platform pages for capabilities, docs for workflows, and a pricing section a buyer's assistant will look for.
- Semrush semrush.com Leads with its own numbers (keywords, backlinks, domain profiles, prompts tracked), so a model has a proof point to quote. 42 links, with the lower-priority ones under an Optional heading.
- Grafana Labs grafana.com Built as a documentation index: every docs page is available as Markdown by adding .md to the URL, and the file points to a separate full index for readers that want everything.
What they share: a summary a model can quote as it stands, links grouped by what the reader is trying to do, and restraint. None of them lists everything.
Structured data is common. Saying who you are is less common.
76% of homepages carry JSON-LD, the structured data block that search engines and assistants parse before they read a word of copy. But only 61% use it to declare an Organization: the name, the logo, the official profiles, the one-line description. The rest describe a web page, a breadcrumb or an image, and never state the entity behind them.
That is four in ten well-known software companies leaving it to the model to work out who they are from marketing copy. It usually manages. When it does not, the result is a wrong logo in a search panel, a description lifted from a directory, or a competitor's name attached to your category.
Almost nobody blocks the crawlers
Only 11 sites (4.4%) block one or more AI crawlers in robots.txt, and most of those blocks are aimed at bulk scrapers rather than the assistants buyers use. Two sites block OpenAI's crawler. One blocks Anthropic's. One opts out of Google's AI training. In B2B software the argument about whether to let the assistants read is over, and the answer was yes.
Worth checking anyway: some CDN and security products ship with AI-crawler blocking switched on by default, so a block can exist without anyone having decided on it.
One in twelve could not be read at all
23 of the 274 companies (8.4%) gave our reader nothing. None of them was down. Every one answered with a refusal: 17 returned 403 Forbidden, five returned 429 Too Many Requests to a single request, and one returned an empty challenge page. We tried again claiming to be an ordinary browser, and 20 of the 23 still refused. These are established vendors whose bot protection treats anything that cannot prove it is a person as hostile.
Some of that protection lets the big, verified crawlers through and stops everyone else, so the damage is smaller than it looks. But a growing share of AI reading is not done by the verified crawlers. It is done by agents fetching a page on a user's behalf, research tools, browser extensions and internal procurement bots, and all of those get what we got. A site that cannot be read is scored by what other people say about it.
The category gap
The averages hide a wide spread between categories.
| Category | Sites | llms.txt | Structured data | Blocks a crawler | Median score |
|---|---|---|---|---|---|
| Sales, marketing and customer experience | 53 | 66% | 92% | 2% | 93 |
| Developer, data and infrastructure | 56 | 64% | 70% | 5% | 77 |
| Security and IT | 19 | 68% | 53% | 0% | 75 |
| Finance, HR and back office | 36 | 64% | 75% | 0% | 75 |
| Vertical and industry software | 31 | 52% | 77% | 3% | 68 |
| AI-native | 20 | 50% | 85% | 5% | 63 |
| Productivity, collaboration and automation | 36 | 53% | 69% | 14% | 56 |
Marketing software is the most readable category, which makes sense: these are the teams who sell visibility for a living. Productivity and collaboration tools are the least, and they are the only group where blocking is common: one site in seven turns a crawler away.
The result we did not expect: the AI-native companies are in the bottom half. Half of them have no llms.txt. The companies building the readers are, as a group, less prepared to be read than the companies selling email tools. Security vendors have the opposite profile: the highest llms.txt adoption of any group and the lowest use of structured data.
What the model actually sees
Files and tags are the mechanics. The test that matters is the cold read: hand a model the first 5,000 characters of a homepage's text, with no other context, and ask what the company does, who it is for, and what is missing. We drew 40 of the 251 sites at random and read them that way.
The leaders write clear copy. That is not where they lose. They lose in the order of the page. On 12 of the 40 sites, more than half of what the model received was not copy. Mostly it was navigation: the full product menu, often twice (once for desktop, once for mobile), every language option, every footer link. On three sites the model got the page title and then nothing but font and styling code, and never reached a sentence.
Here is the finding that ties it together. Nine sites showed no proof inside the window. Eight of those nine were the sites whose window was full of menus and code. The customer logos, the numbers and the analyst badges were all on the page. They were just further down than the reader got. The copy was fine. The reader never reached it.
The audience gap is real too. 13 of the 40 described the product clearly and left the customer to inference, and two never got far enough to say. "For" is still the most useful word most homepages are missing.
What to do with this
- Read your own first 5,000 characters. View the page with styles and scripts off, or run the Lens on it. If the first screen of text is a menu, move the one-sentence description of the company above the navigation in the HTML. It can stay exactly where it is visually.
- Declare the Organization. One JSON-LD block on the homepage: name, logo, description, official profiles. Four in ten of the leaders have not done it.
- Publish the llms.txt, and keep it short. A summary paragraph and the pages a buyer would want. Not the help center.
- Ask whoever owns the firewall what a non-browser gets. If the answer is a challenge page, decide whether that is what you want an agent shopping on a buyer's behalf to see.
- Put "for" in the first paragraph. Name the customer in words: the role, the company type, the size.
Method and limits
The list is 274 established B2B software companies across seven categories, assembled by hand from the vendors that appear most often on buyer shortlists. It is not a random sample of the industry. It leans toward larger, better-funded companies, so treat these numbers as what the leaders do. The long tail is almost certainly behind them.
Each site was read once, on 17 September 2026, with a plain request that identifies itself and does not run scripts. The scoring code is the same code that runs in the AEO Lens. Sites that render their homepage only with scripts will look emptier to this reader than to a person, which is the point: many AI readers do not run scripts either.
The cold reads cover 40 sites drawn at random with a fixed seed. Each was read by number, without the domain or any outside context, by a large language model given the first 5,000 characters of page text, the same input and the same question the Lens uses, then sorted into the groups above by us. Forty is enough to see a pattern and not enough to put a decimal on it, so we report counts, not percentages.
We name only companies whose files are worth copying, and only for what is publicly readable at their own /llms.txt. Everyone else stays anonymous: the point is the pattern, and any of these numbers can change with one deploy. Logos belong to their owners and are shown only to identify them.