How we measured this

For each company we wrote 15 questions about the market it competes in, the kind a customer would actually ask. All of them are unbranded: none names the company being measured.

Two examples: “Are there extra costs or hidden fees with home internet plans in Alaska?” and “Industrial tapes vs. liquid adhesives, which is better for construction projects?” An automatic check removes any question that gives away the company or one of its rivals.

So when an answer names the company, the AI brought it up on its own. It was not confirming a name we had given it.

We put every question to OpenAI, Claude, Perplexity and Gemini, and read every answer they gave.

A mention is the company’s name appearing in an answer. We count the names people actually use, not only the formal one.

Answers say “REI”, “Home Depot” and “AMD”. Official records say “Recreational Equipment, Inc.”, “The Home Depot” and “Advanced Micro Devices”. So we count the short name, the name without “Inc.” or “Corp.”, and the name as the company’s web address spells it, such as “JCPenney” for jcpenney.com.

Where a company is listed under its parent, we count the business we actually tested: Priceline for Booking Holdings, Famous Footwear for Caleres.

Some names are also everyday words. Those count only when they clearly mean the company. Staples the retailer counts; “a stapler and staples” does not. Gap counts only with a capital letter, and Dow never counts in “Dow Jones”. We checked every rule like this against the answers it applies to.

Each company gets one overall score out of 100. It is made of five parts, and each part counts for the share shown below.

AI readiness asks how easily AI tools can read and use a company’s website. We ran fourteen technical checks on each website, and the result is simply how many it passes. These checks look at how a website is built for AI tools. They do not judge what the website says, or what other websites say about the company.

The fourteen checks, for your technical team: robots.txt and AI bot rules, a sitemap, Link headers, llms.txt, Markdown negotiation, OAuth discovery, an API catalog, MCP and A2A cards, a skills index, WebMCP tools and page weight.

A second scan asks what a website offers an AI agent that arrives by itself: can it read the website, use it, and buy from it. It is separate from the fourteen checks above and changes no score.

We ran the scan on all 2,047 companies from October 3 to 5, 2026. The scan makes 23 checks and places each website on one of six levels, by the rules isitagentready.com uses. Level 1 needs two of a rules file, a list of pages and Link headers. Level 2 adds rules for AI bots and Content Signals. Level 3 adds pages served as Markdown. Level 4 adds one published interface for agents. Level 5 adds two of signed bots, sign-in details and every interface.

For buying, we looked for five purchase protocols a website can publish (UCP, ACP, AP2, x402 and MPP), and for cart or checkout tools offered to an agent in the browser. A company counts as one an AI agent can buy from when it has either. We read each protocol file we found.

Some websites show visitors from outside the United States a different page, or none at all. We scanned those from a US home connection. Some websites turn automated visitors away. Where a website refused our scanner, we tried again from an ordinary US home connection, and then with a real browser. 168 websites still refused the purchase files. We report them as turning automated visitors away, not as publishing nothing. 41 let fewer than half the checks run and are given no level.

What it cannot see: a private arrangement between one retailer and one AI assistant, and whether an agent could click its way through an ordinary checkout page. See the results.

The study covers large and well known US companies, drawn from six public lists.

All 100 retailers on the NRF Top 100 are in the study. 59 of them are also on another list (28 consumer brands, 26 S&P 500 companies and 5 other US-listed companies) and are counted on both, so the lists add up to more than 2,047. Two of them, the Army and Air Force Exchange Service and the Defense Commissary Agency, are retailers run by the US government. They are included because NRF ranks them among the hundred largest US retailers. Trader Joe’s and Sam’s Club are counted with the other US retailers, because NRF does not rank them separately. How the lists compare.

The S&P 500 and US-listed companies come from public lists, matched to their official websites through Wikidata, a public database. The retailers come from the NRF Top 100 Retailers list, plus companies that Wikidata lists as retailers and that also appear in Cloudflare Radar’s ranking of visited websites. Sectors come from Wikidata’s industry labels where they exist, and from our audit tool’s own category where they do not.

We also added thirty of the most visited websites in the United States by hand, such as Facebook, Instagram, YouTube, Wikipedia and Netflix. The lists above name the company that owns a website, not the website people use. The thirty come from Similarweb’s ranking of the 50 most visited websites in the United States (August 2026). We left out adult websites, websites that are not US-owned, sign-in addresses and any already in the study. They are counted with the consumer brands and the large private companies.

Three names appear twice, once at the address people visit and once at the corporate address: Google (google.com and about.google), Netflix (netflix.com and netflix.net) and The New York Times (nytimes.com and nytco.com).

It shows what four AI assistants said on the days we asked, in answer to questions written for each company. It does not measure traffic, revenue, or how often real people ask questions like these.

858 companies were named fewer than three times and are marked as rarely named. Their scores rest on very little, so read them with care.

The ranking is by overall score, which covers more than how often a company is named. So the order will not match a list of the most named companies.