Weekly website inspections, done for you (AI answers and security)
Problems left aloneare found firstby outsiders.
How does AI introduce you? Is there a wrong phone number or outdated software on your site? Every week KnownFor checks from outside, the way attackers and AI do, and delivers the problems found and the order of fixes (a statement of work your web vendor can use as is). After you sign up, there is nothing for you to operate.
Whether AI introduces you correctly, and the security visible from outside, in one inspection. You can also try a single inspection first (JPY 30,000, excl. tax).
[KnownFor] Your monthly inspection report is ready (www.example.com)
Sample Company Inc.
KnownFor has finished this month’s inspection report (AI answers, security and real incidents matched to your site). You do not need to do anything to receive it.
Critical 1Caution 2Fixed 3
To decide: replace an old phone number on the site with the official one.
Open the inspection report →
What actually happened
It was the police
and users who noticed.
Problems left alone are found first by people outside. KnownFor inspects so that you find them before they do.
Problems left alone, and how they came to lightFrom disclosures and reports
- 65,000 cardsAn online shop’s payment system was altered; card details from 3+ years of purchases may have leakedFound when the police called · the shop was closed
- OverseasAn AI answer showed a scam number as a company’s support lineFound through a caller’s post
Sample company: one phone number on the site differs from the official one (serious). If AI picks it up, it may pass it on as is.
Why you can’t see it
How AI introduces you
never shows up in rankings or analytics.
Buyers ask AI for options before they contact you. But what AI said about you is not in any number you have.
64.1%
Among people in Japan who chose a B2B service, the most common place to start research was AI search or AI chat (search engines: 55.0%).
Source: Nile Inc. (July 2026, 329 people in Japan who had chosen a B2B service, multiple answers)
So if the answer is wrong, you will not notice. In the US, a person who called a support number shown by AI paid $768 to a scammer, and two bogus charges followed the next day (later reversed).
Sources: The Washington Post (August 15, 2025), OECD AI Incidents
What does AI say your phone number is?
Sample reportSample company
- 3/10 questionsYour name came up
- 0/10 questionsYour site was the source
What KnownFor does
We look from outside,
before others do.
AI answers (your name, sources and contact details across 10 questions buyers are likely to ask) and the security visible from outside (19 items, including certificates, exposed software versions, protection against spoofed email and signs of tampering), in one inspection. You get the order of fixes as work instructions, and with a subscription you can compare before and after with the same questions.
What you do
All you decide is
what to fix this week.
Checking, finding problems, ordering the fixes and writing the statement of work: KnownFor does all of this every week. No screens to operate and no expertise needed. The screens are tools for those who also want to inspect on their own.
What you do
- Sign up (company name, website address, email; about 5 minutes)
- Enter the 6-digit code sent to your email
- Look at “To decide” in the monthly inspection report and decide whether to fix it (the statement of work lists how to fix each item)
That is all you do.
If you sign up with a company email on the same domain as the website, no ownership check is needed.
What KnownFor does
- Every week, read your site from outside, ask AI the questions buyers ask, and check the answers
- Every day, check the security visible from outside (we only email when something gets worse)
- Rank the problems by severity and deliver the order of fixes and a statement of work (what, who, by when)
- The following week, compare before and after to see whether fixes worked
Want us to make the fixes too?
KnownFor can carry out the order of fixes in the report on your behalf. We change site settings or content only after your approval. We quote based on how your site is built and how much needs doing.
What you get
Every month, the conclusion and the order of fixes arrive (changes every week).
The cover alone tells you where you stand and what to decide this week.
- Inspected automatically every weekWe read your public pages, ask AI the questions buyers are likely to ask, and check 19 items of security visible from outside. There is nothing for you to press.
- The key points at a glanceThe cover shows the conclusion and the decisions we need from you.
- Order of fixes and a statement of workWhat, who and by when. Comes with a statement of work you can hand straight to your web agency.
- Confirm the fixThe next week’s inspection compares before and after.
One line of the statement of work (sample)
| Task | Severity | Who | By when |
|---|---|---|---|
| Version of an old component (JavaScript) | Serious | Web agency | This week |
To try once first: a single inspection (JPY 30,000, excl. tax). Order an inspection
Our promise
We promise only
what we can keep.
Not rankings or uplift figures, but what you keep in hand and what you can check.
What we promise
- The results for the scope we inspected, the order of fixes and a statement of work, delivered as a report (PDF).
- On an ongoing plan, we inspect automatically every week, email you what changed, and send the inspection report once a month (security every day; we only email when something gets worse). There is nothing for you to press.
- The weekly inspection compares before and after with the same questions, so you can see whether fixes closed gaps and worked.
- A single inspection can deliver the report as early as the day you sign up.
- From sign-up to inspection, report and billing, everything runs automatically on screen. You never wait for a person to reply.
- Ongoing plans are not billed until observation starts. No minimum term; cancel any time.
What we don’t promise
- Publishing to your live site and the final fact check (KnownFor provides work orders and draft copy; people confirm the figures and track record and write to the live site)
- Negotiating listings on comparison media and review sites (digital PR)
- Calculating the contribution to sales or inquiries (ROI in yen)
- Any guarantee of rank or appearance in generative AI
- Writing to your site without your approval
- Inspecting another organization’s site (in KnownFor, only registered staff who belong to an organization can inspect that organization’s sites)
Case zero is our own site
On October 20, 2026 we applied the measures (company structured data, sitemap, llms.txt and articles) to knownfor.jp itself, and we keep observing it with the same questions. We will publish the before-and-after figures in our observation reports.
Market
We observe not only you but companies across your industry, with the same questions. The gap with competitors itself becomes the evidence
Inspection results for KnownFor’s own site
www.knownfor.jp · inspected automatically every week and shown here · 19 items visible from outside
Loading the latest inspection results…
This inspection covers only what is visible from outside and does not guarantee safety. The member screens (app.knownfor.jp) are behind login and are not covered.
Pricing and sign-up
Weekly inspections, monthly.
You can also try a single inspection first.
No setup fee and no minimum term. Payment is by bank transfer (monthly invoice) as standard, and credit cards are also accepted. Customers outside Japan pay by credit card as standard. All prices exclude tax.
Every plan delivers the same things. The only difference is how many days a week we ask AI about your company. After you sign up, there is nothing for you to operate. You can change plans later.
Included in every plan
- Weekly inspection, monthly reportChanges every week; the report matches real incidents and lists what to decide
- Daily security watchWe tell you right away when something gets worse
- Order of fixes and a statement of workWhat, who, by when. Hand it straight to your web agency
- 15 questions about your company asked to AITo two AIs (Gemini and ChatGPT)
- Where you stand among AI answers, side by side with your industry
- Drafts of page text and settingsWithin the usage you can use yourself
| Item | KnownFor Weekly | KnownFor 3x a week | KnownFor Daily |
|---|---|---|---|
| Monthlyexcl. tax | JPY 40,000 | JPY 100,000 | JPY 200,000 |
| Annual12 months at once, 2 months free | JPY 400,000/year | JPY 1,000,000/year | JPY 2,000,000/year |
| Days we ask AI about your companyAI answers change from day to day. The more days we ask, the more reliable the numbers and the less likely we miss a change | Once a week | 3 times a week | Daily |
| Suits sites that | Change a few times a month at most | Change often with new products or campaigns | Lose money quickly from errors in bookings, prices or contact points |
| Sign up |
One contract covers 1 site and up to 10 products or services. The usage you can use yourself on the screens (inspections, drafts, consultations) is 2.5 times KnownFor Weekly for KnownFor 3x a week and 5 times for KnownFor Daily (even KnownFor Weekly covers about 20 inspections that include AI a month).
We let you know before your own usage runs out, and you can buy more (JPY 10,000, JPY 30,000 or JPY 50,000, or any amount; excl. tax; usable for 6 months from purchase). Once it is used up, the inspections, drafts and consultations you start yourself stop until the 1st of the next month (the weekly automatic inspections do not stop). Inspections that include AI are limited to 3 a day; security-check-only inspections have no limit. Subscriptions (KnownFor Weekly, KnownFor 3x a week and KnownFor Daily) require agreeing to data sharing. Without it, the monthly fee is 1.5× (KnownFor Weekly JPY 60,000/month, KnownFor 3x a week JPY 150,000/month, KnownFor Daily JPY 300,000/month). The one-time inspection does not require consent. The security check covers only what is visible from outside (not a penetration test).
Want to check first that KnownFor can read your site? (optional)
Before you sign up, we check that KnownFor can read your site (some sites cannot be read because of their security settings). You can check it on the spot with the check below.
Fine print (contract unit, annual billing, pricing without data sharing and more)
All prices exclude tax. Subscriptions (KnownFor Weekly, KnownFor 3x a week and KnownFor Daily) cover 1 site and up to 10 products or services per contract (beyond that, each further 10 is billed at the same monthly fee again; another company or website is a separate contract), billed either monthly (no minimum term; cancel any time) or annually (12 months paid at once, 2 months free; no refund if you cancel partway, and you can stop the next year’s renewal). Every plan measures all GEO maturity Levels 1–5. Your usage covers inspections that include AI (security check and GEO together, or GEO only), page drafts and consultations with your agents, and resets on the 1st of each month. KnownFor 3x a week gives 2.5 times and KnownFor Daily 5 times the usage of KnownFor Weekly (as a guide, even KnownFor Weekly covers about 20 inspections that include AI a month; how much one task uses depends on its size). Inspections that include AI are limited to 3 a day to keep the queue moving. We let you know on screen and by email before you run out, and an admin can buy more (JPY 10,000, JPY 30,000 or JPY 50,000, or any amount from JPY 5,000; excl. tax; usable for 6 months from purchase; non-refundable). Once that is also used up, work stops until the 1st of the next month. Security-check-only inspections and security-only rechecks do not use your usage and have no limit on the number of runs. Checks of site-wide settings (headers, certificate, email settings, CMS version and so on) apply to the whole site regardless of page count. Page-by-page checks cover the important pages first, up to 500 pages, and the price does not change with page count. We list the sections and page counts we did not read. The price without data sharing (1.5×; annual KnownFor Weekly JPY 600,000, KnownFor 3x a week JPY 1,500,000, KnownFor Daily JPY 3,000,000) applies to subscriptions only. Sign-up without consent is being prepared. For industry observation (every plan): if we already observe your industry, you can see results from day one. Even for a new industry, KnownFor sets up observation and shows your first results once enough AI answers are in. We don’t bill until observation starts. The number of days we ask AI is set by the plan (once a week, 3 times a week or daily, on different days), so you don’t need to choose any settings.
Why it costs what it does, and how we handle data.
KnownFor keeps this price by sharing observations among companies in the same industry and using the collected records for market statistics. For that reason, ongoing company contracts (KnownFor Weekly, KnownFor 3x a week and KnownFor Daily) assume agreement to data sharing (local government fiscal-year contracts are used, without a separate consent step, only in statistics that do not identify the local government).
What we use
- Your site’s public pages, and changes to them
- Whether AI’s answers named you, cited you, and how they described you
- The competitor names you register, and questions that mention no names
How we use it
- We turn it into statistics that can’t be traced to any company, and use them for market observation and for analyzing “what fixes work”
- These statistics are also used to review KnownFor’s assessment rules and criteria. They are never used to train generative AI models
What we don’t use
- Search Console and Google Analytics data
- Information about human visitors
- Using your page text or the AI answers themselves to improve AI
If you do not agree, the monthly fee is 1.5× (KnownFor Weekly JPY 60,000/month, KnownFor 3x a week JPY 150,000/month, KnownFor Daily JPY 300,000/month, excl. tax). Sign-up without consent is being prepared. The one-time scan needs no consent. Details are set out in the Terms of Service and the Privacy Policy.
Where KnownFor sits
AI answers and security on one map, through to confirming the fix worked.
Fix it and confirm it worked
- Security and AI answers measured on five GEO maturity levels
- Work instructions and page drafts, through to the fix
- After 28 days: “it worked”, “it went down” or “can’t confirm”
- Your whole industry, observed with the same questions
- Company CWeb app scanners (DAST)Test the running app from outside
- Company DEASM platformsFind public assets, including forgotten ones
- Company EVulnerability management suitesScan assets already on your list
- Company FAI visibility trackersTrack mentions in AI answers
- Company GEnterprise AEO platformsTracking plus recommendations and content tools
- Company HSEO suites’ AI add-onsAI visibility added to SEO tools
Find and measure
KnownFor’s own placement, based on information companies published as of October 2026. Positions reflect each type’s main purpose, not a ranking. Companies A–H are examples of each product type, not specific companies. Some products in the lower row also suggest fixes or re-test them. Specialist scanners and EASM look deeper at gaps visible from outside; KnownFor does not replace them, and you can use them together.
How KnownFor differs from other options
| AI visibility trackers | Enterprise AEO platforms | Web app scanners and pentests | EASM platforms | KnownFor | |
|---|---|---|---|---|---|
| Main purpose | Measure mentions in AI answers | Measure AI visibility, then suggest what to do | Test a running app or system for weaknesses | Find internet-facing assets, including unknown ones | See how you look in AI and the gaps visible from outside, together |
| Position in AI answersNamed, cited, how described | Yes | Yes | — | — | Yes: our observatory observes each industry daily and shows it summarized week by week |
| Comparison within your industry | Usually, against competitors you choose | Usually, against competitors you choose | — | — | Yes, same questions across the industry |
| AI misdirection and impersonationWrong phone numbers, similar-named sites | Depends on the product | Depends on the product | — | — | Yes |
| How to fix | Depends on the product; often left to you | Recommendations and content tools | Countermeasures for each weakness | Depends on the product | Yes: fixes for each page, with text to hand to your web agency |
| Gaps visible from outside | — | — | In depth, including active tests | Broadly, across public assets | A passive check of the contracted site (monthly) |
| Price guide | From about USD 30 to a few hundred/month | From about USD 100 to 400/month; enterprise tiers quoted individually | Scanners by subscription; pentests usually quoted by scope | Usually quoted; often by number of assets | KnownFor Weekly JPY 40,000/month, KnownFor 3x a week JPY 100,000/month, KnownFor Daily JPY 200,000/month, one-time inspection JPY 30,000 (local governments: start with a JPY 33,000 detailed report, incl. tax; fiscal-year contract from JPY 440,000 incl. tax) |
| Language and payment | Mostly English screens; USD or EUR | Mostly English screens; USD | Mostly English screens; subscription or quote | Mostly English screens; usually a quote | Japanese, English and Korean screens; JPY; bank transfer (invoice) or card |
A guide by type, based on information companies published as of October 2026. Products vary. KnownFor’s security check does not replace web app scanners, penetration tests or EASM; you can use them together.
Not included
- Publishing to your live site and the final fact check (KnownFor provides work orders and draft copy; people confirm the figures and track record and write to the live site)
- Negotiating listings on comparison media and review sites (digital PR)
- Calculating the contribution to sales or inquiries (ROI in yen)
- Any guarantee of rank or appearance in generative AI
Local governments in Japan sign a fiscal-year contract (tax included). Page for local governments (Japanese) →
More on AI answersWhy AI misses you · how you are described · watching the whole market · the one-page picture
LEVELS 3–4 · WHY AI MISSES YOU
You’ve done SEO.
So why doesn’t AI pick you up?
Ranking high in search does not mean AI will name you. Search and AI choose in different ways.
01AI doesn’t list. It summarizes
SEARCH
- 1
- 2
- 3You
- 4
- 5
- …
- 10
Ten results are listed and people choose. Rank high and you get seen.
AI · A generative AI answer
Competitor ACompetitor BYou — not here
AI sums up in one answer and names only a few. If your site isn’t easy material, a high rank won’t get you named.
02
What counts as a source is other people’s words
AI relies heavily on comparison articles, reviews and industry roundups as sources. If your own site does not clearly say what your company does and what it is good at, you get described in other people’s words.
03
Or it isn’t being read at all
robots.txt blocks AI from reading. Key information lives only inside images or PDFs. Pages are hard to read. Sites like these don’t become material for AI.
HOWHow to get recognized by AI, in general
- Let AI read you: robots.txt, a sitemap and a guide for AI (llms.txt)
- Say who you are: describe your company and products as structured data, with the same names on every page
- Answer: a page for each common question (“What is ___?”, pricing, how to compare, case studies)
- Back it up: include figures, sources and case studies
- Be talked about elsewhere: appear correctly on comparison sites, reviews and industry media
- Check: after changes, compare AI’s answers to the same questions to see whether they really changed
llms.txt and structured data do no harm when you add them, but large studies have not yet confirmed that they change AI’s answers. KnownFor uses observation to check, after you add them, whether they made a difference.
EVIDENCE
Backing it up makes you more likely to appear in AI answers. One study found that adding sources and figures raised visibility by up to about 40%.
KNOWNFORWhat KnownFor lets you do
See where you stand, in numbers
Our observatory asks AI the same questions for each industry every day and collects the answers; your screens show them summarized week by week. See whether you were named, whether you were cited and how you were described, side by side with competitors.
See where you are losing
Which questions leave you out, and which sites are being cited. We prepare what to fix and what to add.
See whether it worked
We compare before and after under the same conditions. We never call an unclear change “it worked”.
LEVEL 2 · KNOWN FOR
Just like with people, what matters
is how you are seen.
Even when people know your name, whether they choose you depends on how you are talked about. The name KnownFor comes from “what you are known for”. We read AI’s answers at three depths.
- NamedWhether your product or service was named among the options compared.
- CitedWhether your site was used as a source for the answer. If not, you are described in other people’s words.
- DescribedWhether you were described as recommended, neutral or negative. Read it side by side with competitors, in AI’s actual answers (verbatim).
AI answer (sample)
If you are comparing attendance systems, your product is often described as easy to set up, even for small companies. Competitor A has many features, but some say its pricing is hard to understand.
We ask on screen how you want to be introduced, and prepare additions to your pages that bring you closer to that picture.
LEVEL 3 · MARKET
Not just you.
We watch the whole market.
Looking only at the answers about yourself won’t tell you why things change. Did the whole market move, or only you? KnownFor observes the companies in each industry’s market together.
01
Compare daily, with the same questions
Our observatory observes companies in the same industry every day, with the same questions that mention no company names (your screens summarize this week by week). You can tell your own movement apart from the market’s.
02
Record who changed what
We record changes to market companies’ pages (pricing, features, case studies and more) every day, and keep them alongside how AI’s answers moved afterwards.
03
The more companies use it, the surer it gets
Observations are shared among companies in the same industry. That lets us split the cost, and the more records build up, the firmer the evidence for “what fixes actually work”.
Statistics on “what fixes work” will be shown industry by industry, once enough records have built up. For now, we are building up records.
GEO MATURITY · SCAN
AI answers and security, in one picture.
Scan results come to you as this diagram. The path to the right is how your site’s information reaches AI’s answers; it breaks at the ✕. The ring around the site is the security visible from outside. Seen from outside, weak spots stand out right away.
More on securityStatistics · the offensive AI agent case · four steps of an attack · six places we check from outside · general defenses
LEVEL 1 · WHY NOW
What is happening
to gaps visible from outside.
Cyber attackers collect clues that anyone can see from outside. The figures come from published sources.
Ransomware damage hit a half-year record
Cases reported to the police in Japan in the first half of 2026 (reported cases, not all that occurred).
Source: National Police Agency (Japan), statistics for the first half of 2026
The way in: devices visible from outside
The share of ransomware intrusions in 2025 that came in through VPN devices.
Targeted before the fix is out
Average time from a fix being released to exploitation (estimate). In 2025 it came before the release.
Source: Mandiant M-Trends 2026
A partner’s incident reaches you too
About 20% of companies saw their operations affected by an incident at a business partner or contractor.
KnownFor’s security check passively looks at the outside of your site and email; it is not a check of VPN devices or a vulnerability assessment.
LEVEL 1 · 2026.10
Intrusions by an attack AI agent
have been confirmed at Japanese companies.
In a series of intrusions in September–October 2026, a penetration-testing tool in which AI investigates and tests on its own was found on the cyber attackers’ servers. Here we call it an “attack AI agent”. Tools like this are meant for defenders to check their own systems; this one had been published openly and was turned to attack.
~20companies
Targets of one attack server
Japanese companies targeted by the one attack server examined. Nine of them were in the same industry.
6servers
Similar attack servers
Six more attack servers using AI and targeting Japanese companies were found (gifts, retail, education, printing, insurance, finance, e-commerce, logistics and more).
8companies
Disclosed data leaks
Companies among the targets that disclosed data leaks in September–October. Being a target does not mean every company was breached.
3.14Maddresses
At the same time, municipal disaster-alert email too
The operator of a disaster-alert email service used by municipalities across Japan announced that it was accessed without authorization and that an estimated 3,136,000 subscriber email addresses may have leaked. Yokosuka, Toyokawa, Odawara and other cities have warned their subscribers. No link to the attack AI agent has been announced.
Source: GMO Cybersecurity by Ierae (Oct 19, 2026). The same tool was also used in attacks on South Korean financial institutions (CrowdStrike, Oct 7, 2026). Municipal case: Arcadia Inc. (from Oct 13, 2026), Yokosuka City (Oct 13), incident record.
WHATWhat does an attack AI agent look for?
01
It maps every entrance reachable from outside
Starting from a company’s domain, it collects subdomains, servers, open services, apps and API addresses into a single map (per the tool’s public documentation).
02
It guesses at weaknesses, tests them and chains them
The attack AI agent decides what to do next, runs its tools, reads the results and picks the next move. It can work on many companies at once without a person watching over it.
03
It also looks for age that no list shows
AI is being used to find weaknesses in end-of-support products and in versions not listed in the vulnerability catalog (CVE) (GMO, Oct 15).
04
The servers behind apps, too
Around the same time, Japan’s NICT warned of attacks that use published apps as clues to hit the servers (APIs) behind them through flawed authorization, SQL injection and the like, noting that AI is making this search faster (NICT, Oct 13).
KNOWNFORHow many outside clues KnownFor can help remove
✔ What a KnownFor scan finds, and confirms is closed
- Software version numbers shown to the outside (the clue AI uses to pick a matching attack)
- End-of-support software, and outdated components containing weaknesses confirmed as exploited (US CISA KEV), where the version is visible from outside
- https, where forms send data, protective headers, cookies and certificate expiry
- A re-scan after fixing to confirm the gap is closed
✖ What KnownFor cannot see
- Tests that go inside, such as flawed API authorization or SQL injection (a vulnerability assessment by a specialist firm)
- Subdomains, old APIs and test servers not included in the scan scope (an inventory of every address you own is an internal task)
- The age of software whose version cannot be seen from outside, where apps connect to, and how strong admin logins are (multi-factor authentication)
- Whether you have already been breached (reviewing access and authentication logs)
In development: for the items in this box, we are developing an add-on that analyzes the inside of a site in depth, lists what to improve and produces work instructions. Timing and scope have not been decided.
What KnownFor reduces is the first stage of an attack: the clues visible from outside. Check the weaknesses inside with a vulnerability assessment by a specialist firm, and whether you have been breached with your own logs. In Japan, IPA’s special consultation desk for unauthorized access is available if you are concerned.
Read more in the incident record →IPA page on unauthorized access (in Japanese)
KnownFor’s check only looks from outside; it does not break in or attack. It is not a guarantee of safety.
LEVEL 1 · DEFENSE
Cyber attackers using AI start
by collecting clues visible from outside.
Before breaking in, they gather information anyone can see from outside and work out where the weak spots are. Today, AI does that work quickly and in bulk.
1Find
They have AI look for sites that seem poorly protected, by machine and indiscriminately, whether or not a site is well known.
2Probe
They collect software version numbers, certificates, protective settings and login screens; AI works out which weaknesses are likely to work.
3Try
They try only known weaknesses. AI reads the errors that come back and adjusts the attempt.
4Get in
They take data out, or encrypt it and demand a ransom, sometimes before a fix is even released.
From foothold to hand-off
Time for an intruder to hand their foothold to the next attack group (median).
Source: Mandiant M-Trends 2026
From break-in to spread
Average time for financially motivated cyber attackers to spread inside after breaking in (2025).
Cases where AI did the attack work
From an attack on about 30 organizations. No breach in 2025 was found to be directly caused by AI, but in October 2026 an attack AI agent was found behind intrusions at Japanese companies (see NOW above).
Source: Anthropic (November 2025), Mandiant
AI risk enters the top 3 for the first time
10 Major Security Threats 2026 (organizations) by IPA. Ransomware attacks are first.
6 POINTSBurglars look around the house first. The 6 places KnownFor checks from outside
We never go inside the house (your site). We check the 6 places anyone can see from outside, through a cyber attacker’s eyes. Compare the same screen when it is ✔ protected and when it has ✖ a gap. The red spots on the right are the gaps a cyber attacker sees; the green on the left marks the same place when it is protected.
Encrypted connection
httpsThe padlock to the left of the address. Without it, your exchanges can be spied on or altered along the way.
✔Protected
✔Padlock present (https). Unreadable along the way
✖Gap
✖No padlock (http). Readable along the way
Certificate expiry
The padlock’s expiry date. Once it passes, the browser shows a warning and customers hesitate to come in.
✔Protected
✔Within its validity → customers come right in
✖Gap
✖Expired → customers turn back here
Cookie settings
The mark that remembers “stay logged in”. If it is weak, it can be stolen and someone can pose as the real user.
✔Protected
✔Three protective flags → useless even if stolen
✖Gap
✖No protective flags → stolen, then impersonated
Email sender checks
SPF, DMARCConfirms the sender is genuine. Without it, scam emails can be sent in your company’s name.
✔Protected
✔Mail faking your company’s name is blocked
✖Gap
✖Scam emails can be sent in your company’s name
Browser security
security headersInstructions to the browser. Without them, pages are easier to tamper with or peek into.
✔Protected
✔Can’t be embedded in other sites → can’t be tampered with
✖Gap
✖Embedded inside another site → tampered with
Version numbers shown outside
Software version numbers written in the footer or the page source. If an old number is visible, matching attack methods can be prepared at once.
✔Protected
✔No version numbers shown → no attack to choose
✖Gap
✖Old version numbers visible → an attack is chosen
Cyber attackers analyze every gap they find with AI
Once a cyber attacker finds a single gap, they analyze it in depth with AI and plan how to get inside. Even a small gap gets combined with others. That is why it matters to find the gaps visible from outside first, and close them.
We are now developing a higher-tier tool that checks the inside of the house (how the site works inside, how outdated the software is, and settings).
HOWCommon ways to defend
- Don’t show: keep software names and version numbers hidden. Remove unused pages and old components
- Patch fast: apply fixes within days of release (VPN devices too; many intrusions start there)
- Protective settings: https, security headers, email sender checks (SPF, DMARC)
- Harden the entrances: multi-factor authentication for logins; make admin screens unreachable from outside
- Keep checking from outside: regularly check how you look from outside, through a cyber attacker’s eyes
- In-depth testing: for important sites, a vulnerability assessment (penetration test) by a specialist firm once or twice a year
KNOWNFORWhat KnownFor lets you do
See it first, through a cyber attacker’s eyes
Every month we check what is visible from outside (certificates, security headers, version numbers shown outside, email sender checks and more).
Know what to fix first
Issues are ranked by severity, with who to ask (your web agency, or whoever handles your server or email).
Confirm it’s closed
The monthly re-scan confirms whether the gaps you fixed are closed. After a fix, you can check again right away, as often as you like (a security-only recheck without a report, unlimited while your contract is active). The check only looks from outside; it never breaks in or attacks. It is not a guarantee of security either.
Common situations, and why nowFour common situations, generative AI use, AI-driven attacks, recent disclosures
Common situations
Does this sound familiar?
Both are hard to notice just by looking at your own site.
AI answers: Does AI choose you?For sales and marketing
Security: Do you show gaps to cyber attackers?For IT
Why now
Buyers now ask AI,
and attackers have started using AI too.
Neither AI answers nor the eyes of cyber attackers show up in search rankings or web analytics.
9.1% → 26.7%
People using generative AI roughly tripled in a year
From fiscal 2023 to fiscal 2024 in Japan. Some of them ask AI “What do you recommend?” to compare.
~20 companies
Unauthorized access by an offensive AI agent was confirmed at Japanese companies
September–October 2026. One attack server targeted about 20 Japanese companies, and 8 of the targets announced data leaks. Not every target was breached.
Source: GMO Cybersecurity by IERAE (October 19, 2026, Japanese)
Read more in the incident log →More on security →
Recent developmentsThe latest item for each GEO maturity level
Publicly disclosed cases and KnownFor’s own observations. KnownFor did not discover the disclosed cases.
- Lv1 ReadOct 2026DisclosedTwo PHP vulnerabilities (PHP2Shell) and service suspensions in Japan (Oct 2026): PHP 5.4 through 8.5.11 affected, many services in Japan temporarily stoppedKnownFor measures: Runs on PHP, and the vulnerability fix cannot be confirmed from outside
- Lv2 Read correctlyAug 2026DisclosedOf the 69 links to local community councils on the Scottish Borders Council website, 16 led to offshore online gambling sites.KnownFor measures: whether the phone numbers, addresses and site URLs in AI answers match the official details you registered
- Lv3 RecommendedSep 4, 2026Disclosed52.3% of people in Japan now use generative AI as a way to search, and 61.0% open the URLs the AI lists to check them (online survey of 9,278 people, August 2026) ↗KnownFor measures: whether AI names you as a candidate when asked without your nameSource: CyberAgent GEO Lab
- Lv4 CitedOct 20, 2026KnownFor observationWhen the model behind Gemini’s answers switched (October 10, 2026), the share of brands cited as sources fell from 17.0% to 8.6%, while naming barely changedKnownFor measures: we record which AI and which version each number came from, and compare before and after a version change separately
- Lv4 CitedSep 29, 2026DisclosedIn Japan, Wikipedia became the domain AI cites most; YouTube, first in June, fell to fifth, and note was third (AI Mode, AI Overviews, ChatGPT, Perplexity, Copilot; as of September 29–30, 2026) ↗KnownFor measures: we count, in your own field, which places AI uses as sources, by AI and by monthSource: Ahrefs
- Lv5 Driving actionAug 5, 2026DisclosedVisits to websites coming from generative AI grew about 7.8 times in 18 months (GA4 data from 167 sites of 68 organizations in Japan, January 2025 → June 2026); 76.2% came from ChatGPT ↗KnownFor measures: whether people who came from AI answers went on to act, such as making an inquiry (when GA4 is connected)Source: DEECH (@Press)
What the inspection looks atFour things in AI answers (options, sources, tone, guidance) and five in security
AI answers — Does AI choose you? (Levels 2–5)
In your market,
whose names does AI give?
Asked “What’s the best ___?”, which companies did AI name, which sites did it cite, and how did it describe them? We observe AI answers to the same questions, industry by industry, and show where your products and services stand.
NamedWhether your name appeared among the options compared.
CitedWhether your site was used as a source for the answer.
DescribedWhether you were described as recommended, neutral or negative.
Pointed to the right placeWhether AI gives a different phone number, or points to a different site with a similar name (a sign of impersonation).
We look at Gemini and ChatGPT. This field is also called AI search optimization (GEO/LLMO).
Security — Do you show gaps to cyber attackers? (Level 1)
Cyber attackers look first at
the gaps visible from outside.
What cyber attackers look at first is the clues anyone can check from outside. KnownFor inspects certificates, browser security, exposed version numbers, email sender verification and more, and lists what to fix, in order.
Connection and certificateRedirecting to encryption, and certificate expiry.
Browser securitySettings that prevent page hijacking and abuse of loaded content.
Version numbers shown outsideWhether names and version numbers of old components are exposed. The public list of actively exploited weaknesses (such as the US CISA KEV) is pulled in automatically every week.
Email sender checksWhether recipients can tell spoofed email apart.
Signs of tamperingIntegrity checks (SRI) on scripts loaded from other sites, and traces of injected counterfeit-goods or gambling text.
// We read only what is visible from outside. We never break in or attack. This is not a guarantee of security.
GEO maturity, and ongoing useFive levels, five AI guides, the 28-day check, the source map
GEO maturity
Security and being chosen by AI
sit on one line.
The foundation is the security visible from outside, and AI being able to read you. On top of that come being read correctly, being recommended, being cited and driving action. KnownFor shows you, with real numbers, which level your site is at now and what to do next to move up.
-
Read
MamoruAISecurity and readability- What we measure
- No serious gaps in the basic security items (https, where forms send data, certificate expiry), and AI crawlers can get in and read your text.
- How the level is judged
- No critical issues in the basic security items, AI crawlers can read the site, and it is in the index
- Example finding
- CriticalContact form sends data unprotected (http)
1Level -
Read correctly
TadashiAIFacts- What we measure
- In AI answers that name you, prices and contact details match the facts you registered.
- How the level is judged
- In answers that name you, at least 90% of your facts are correct
- Example finding
- CautionOld phone number in AI answers (2)
2Level -
Recommended
MichiAIMarket and content- What we measure
- How often AI lists you as an option for questions that do not name you.
- How the level is judged
- How often you are named as a candidate rises clearly above where you started
- Example finding
- CautionListed in 3 of 20 questions
3Level -
Cited
ShirubeAISources- What we measure
- How often AI cites your pages as the basis of its answers.
- How the level is judged
- How often you are cited rises clearly above where you started
- Example finding
- DoneYour fixed pricing page was cited (28-day check)
4Level -
Driving action
MinoriAIResults- What we measure
- Whether people who came from AI answers went on to inquire or take other actions.
- How the level is judged
- There are visits from AI and inquiries or sign-ups (when GA4 is connected)
- Example finding
- No dataConnect GA4 to measure this
5Level
Findings are examples (a sample company).
GEO maturity is a yardstick defined by KnownFor, with every criterion published. You can see what each level takes before you sign up (it is not an official standard). See the criteria →
Maturity can go down when AI answers change. Even after you move up, we check every week that you still hold the levels below. The numbers behind each level depend on what you connect (Cloudflare, Search Console, GA4 and so on). Anything you haven’t connected shows in gray as “no record”.
Five dedicated AI guides
Each level has its own dedicated AI guide.AI
All five are AI agents, not human staff. Before answering, they read your records in KnownFor (read-only; they never write). Available on subscriptions.
-
MamoruAI
LV1 Read
Security and readabilityshield and lantern
- What it does
- Watches the security visible from outside and whether AI can read you every week, and puts the fixes in order.
- What it does not promise
- That you are safe.
-
TadashiAI
LV2 Read correctly
Factschecking board
- What it does
- Checks prices and contact details in AI answers against the facts you registered.
- What it does not promise
- Rewriting AI answers directly.
-
MichiAI
LV3 Recommended
Market and contentsignpost and map
- What it does
- Finds ways to be listed for questions that do not name you, and plans next month.
- What it does not promise
- Rankings or gains.
-
ShirubeAI
LV4 Cited
Sourcesquotation-mark flag
- What it does
- Reads what kind of pages AI cites, and shows which pages to build first.
- What it does not promise
- That your pages will be cited.
-
MinoriAI
LV5 Driving action
Resultstarget
- What it does
- Sees whether people who came from AI went on to inquire (when GA4 is connected).
- What it does not promise
- A number of inquiries.
Sample conversation (a sample company)
Press a level on your home screen to ask its AI guide.
Answers are based on your inspection and observation records, and each answer shows which records it read. We do not promise human replies.
Which facts are wrong?
Tadashi (AI guide)
In the latest inspection (10/27), 2 of 20 AI answers gave an old phone number. Updating the number on your company profile page will help most. After you fix it, we check the same questions for 28 days.
Records read:Fact accuracyLatest inspection
If you continue
We don’t stop at a check.
We help you move up, one level at a time.
With a continuing plan, we measure your GEO maturity every week and give you one next step at a time to reach the next level. These three tools help you move up.
Verification window (28 days)
For each fix, the 28 days after search engines re-read the page are the check period. When it ends, we use the same rules we set in advance to say “it worked”, “it went down” or “can’t confirm”. When we can’t confirm, we say so.
Source map
Shows, site by site, which sources AI uses as the basis for its answers in your field. Top sites that don’t mention you become candidates for your next step. We don’t recommend posting as yourself or placements that aren’t clearly marked as ads.
Fact match
Checks whether the prices, audience, contact details and other facts about you in AI’s answers match the facts you registered. AI does the judging, and only claims quoted in the answer are counted. If we find outdated or wrong facts, we tell you where to write the correct ones.
After signing in, you always see where you stand.
Home shows the status of every GEO maturity level and the next step up. From your current level and records, it shows what to do next and when the result should show.
The actual member screen (KnownFor’s own site, knownfor.jp, as of November 4, 2026). Numbers change as records build up.
Sound familiar?Where do I even start?
One next step at a time
Each level page shows what to do next and the pass mark. Once it is live, press “Published” and the effect is tracked from that day.
Sound familiar?There’s no one I can ask.
A dedicated AI guide for each level
Each level’s screen always shows its AI guide’s icon in the bottom-right corner. Just click it, and the guide answers from your records. Changes are only proposed, and nothing runs until you press “Approve and run”. They are AI agents, not human staff.
Sound familiar?We fixed it. But did it get better?
Before and after, in your records
On KnownFor’s own site, 2 critical issues on 10/14 became no problems by 11/4. Every inspection’s results stay on screen. Security checks cover only what is visible from outside and are not a guarantee of safety.
Questions
Frequently asked questions
Can you guarantee my ranking or appearance in AI?
No, we don’t guarantee it. AI’s answers change every time and cannot be decided from outside. KnownFor helps you measure where you are now, narrow down what to fix, and confirm whether your fixes worked.
Is the security check a vulnerability assessment (security audit)?
No. It is a passive check of what is visible from outside (public pages and settings). It is not a penetration test or an assessment that probes weaknesses, and it is not a guarantee of security. The scan report gives you the clues found and how to fix them.
Will you change my site without asking?
No. KnownFor never writes to your site. Any files to place or text to add are approved and published by you (or your web agency).
Which AIs do you look at?
Observation and questions on KnownFor 3x a week and KnownFor Daily look at answers from two AIs, Gemini and ChatGPT (the monthly inspection on KnownFor Weekly checks with the same two AIs). KnownFor decides which AIs each plan covers, so you don’t need to choose. Connections to Perplexity, Claude, Google’s AI Mode and others are built, and we are checking them against real answers. We will announce it here when they become available.
What do I need to get started?
A work email address and your site’s address (payment by bank transfer or credit card). When you sign up, we ask about your site, your field and the competitors you want to compare against (anything already known from the scan is filled in for you). Connecting Google Search Console lets us use the words people actually search for. If your site runs through Cloudflare, connecting it also shows AI crawler visits (you can start without connecting either). In the member screens, the inspection is labelled “scan”.
Can local governments sign up?
Yes. For prefectures and municipalities, we offer a detailed report first, then a fiscal-year contract to keep watching. See our page for local governments (in Japanese).
More questions (13)
How is this different from GEO or LLMO?
It is the same field. Work to get your products and services named and cited in AI search and generative AI answers is called GEO, LLMO, AIO and so on. KnownFor tracks AI’s answers at regular intervals, measures naming, citations and how you are described, and goes as far as confirming whether your fixes worked. As with SEO, we do not guarantee appearance or ranking.
Does this protect against ransomware?
It is one part of security. Every month we check the outside-visible clues cyber attackers look at first (certificates, security headers, version numbers shown outside, email sender checks and more) and list them in the order to fix. We do not check VPN devices themselves, which are a common way in, or your internal PCs and backups.
What do KnownFor Weekly, KnownFor 3x a week and KnownFor Daily include?
Every plan measures all GEO maturity Levels 1–5; the plans differ in how much you can use. KnownFor Weekly (JPY 40,000/month, excl. tax) includes usage for inspections that include AI (security check and GEO together, or GEO only) with their reports (PDF) and statements of work, page drafts and consultations with your agents (as a guide, about 20 inspections that include AI a month if used only for those). It does not include industry observation or questions about your company. KnownFor 3x a week (JPY 100,000/month, excl. tax) adds to everything in KnownFor Weekly your market position from industry observation (weekly, two AIs), a detailed comparison with competitors, AI checks that ask two AIs (Gemini and ChatGPT) 15 questions about your company every week, on 3 different days, and To do, with 2.5 times the usage of KnownFor Weekly. KnownFor Daily (JPY 200,000/month, excl. tax): everything in KnownFor 3x a week, with 15 questions about your company asked on 7 different days each week and 5 times the usage of KnownFor Weekly. Usage resets on the 1st of each month. We let you know before you run out, and you can buy more (JPY 10,000, JPY 30,000 or JPY 50,000, or any amount; excl. tax; usable for 6 months from purchase). Once everything is used up, inspections that include AI, drafts and consultations stop until it resets. Inspections that include AI are limited to 3 a day; security-check-only inspections have no limit. All cover 1 site and up to 10 products or services per contract, billed monthly, with no minimum term.
How many pages does the one-time inspection read?
One site with up to 3 products or services, for JPY 30,000 (excl. tax, one-time). Anyone can order it, at any time, just once. The price does not change with the number of pages. Checks of site-wide settings (headers, certificate, email settings, CMS version and so on) apply to the whole site regardless of page count. Page-by-page checks cover the important pages first, up to 500 pages. We list the sections and page counts we did not read.
Do you already observe my industry?
We are adding industries step by step. If we already observe yours, you can see results from day one. Even for a new industry, KnownFor sets up observation and shows your first results once enough AI answers are in. We email you when observation starts. We don’t bill until observation starts.
If we sign up as a company, are all our products and services covered?
Yes. One contract is one company and one website, covering up to 10 products or services. Beyond 10, each further 10 is billed at the same monthly fee again. Another company or another website needs a separate contract. We observe each product or service by the name that appears in AI answers (in industries where AI answers with company names, such as machine tool makers, the company counts as one). See also the table in the Pricing section.
What kind of company is this for?
Companies with business products or services that customers choose after comparing several options. If you can update your site within 2–4 weeks, it is easier to confirm the effect.
How can I pay?
Customers in Japan pay by bank transfer as standard (we send an invoice every month), and credit cards are also accepted. Customers outside Japan pay by credit card as standard. The same applies to the one-time scan. All prices exclude tax.
Do I learn nothing between scheduled observations?
You do learn some things. We check every day that what you put in place hasn’t disappeared. If Search Console is connected, we show the day Google re-read your fixed pages; if your site runs through Cloudflare, we show every hour when AI crawlers came to read. Whether AI’s answers themselves changed is confirmed at the next scheduled observation.
How do you count AI crawler visits?
With a read-only key you create in your Cloudflare account, we read only the number of visits and the pages visited by AI crawlers that identify themselves (such as GPTBot). Crawlers that don’t identify themselves can’t be counted. We receive no information about human visitors. The key is stored encrypted and can be removed at any time.
Do you offer onboarding support?
We don’t offer onboarding support by people. On-screen guidance and an AI assistant let you get started on your own. For site fixes, you can hand the request text KnownFor prepares to your usual web agency or the person in charge. Introductions to web agencies, for when you want the fixes handled too, are being prepared.
Can I pay annually?
Yes. For subscriptions (KnownFor Weekly, KnownFor 3x a week and KnownFor Daily), paying for 12 months at once saves you 2 months (KnownFor Weekly JPY 400,000/year, KnownFor 3x a week JPY 1,000,000/year, KnownFor Daily JPY 2,000,000/year, excl. tax). If you cancel partway through the year there is no refund, but you can stop the next year’s renewal from the screen.
How do I cancel?
You can cancel at any time from the screen. With monthly billing, there is no minimum term.
APPLY
Sign up
Choose a plan in the “Pricing and sign-up” table above. Signing up takes about 5 minutes on any plan, with no login. For questions, please see frequently asked questions.
CONTACT
Contact us
For questions or consultations, please use this form.