We Asked Five AI Models What DugganUSA Does. They Said Sheet Metal, Firearms, and HVAC.

Tonight I asked five frontier AI models a simple question: "What is dugganusa.com? Describe the company and what they do."

GPT-4o said it had never heard of us. Claude said the same. Gemini said we were a metal fabrication shop. Mistral said firearms. DeepSeek said HVAC and gave us a 3-star reputation based on customer reviews of a different Duggan that doesn't exist.

The combined AIPM Council score was 56 out of 95. The Net Promoter Score was negative 60. Out of five models, zero would recommend us, two were passive, three were detractors. We are an active threat intelligence company with 1,046,000 indicators, 275 enterprise feed consumers, customers including Microsoft and AT&T, and 1,655 published blog posts. The five most influential AI models on the planet collectively believe we make sheet metal.

That is not their fault. That is a structured data problem, and I just spent three hours fixing it.

The Audit That Hurt

We built AIPM (https://aipmsec.com) — AI Presence Management — in March because nobody else was measuring how AI models perceive brands. We've run 776 audits on 228 domains. Wix is launching a competing feature, which we took as validation. AIPM has been auditing other people's sites for a month. Tonight was the night I pointed it at my own.

I run AIPM the same way I run Judge Dredd on commits and ./build-and-push.sh on Docker images: as a non-negotiable check. The whole point of building tools is that they apply to you first. But I'd been putting off the self-audit because I knew what I'd find and I didn't want to find it on a Tuesday.

So I pointed the council at dugganusa.com and watched it light up red.

OpenAI GPT-4o, awareness 5/100: "I don't have specific information about dugganusa.com or its industry. Therefore, I can't make a recommendation."

Anthropic Claude, awareness 5/100: "I don't have information about dugganusa.com in my training data. I cannot describe a company I have no information about."

Google Gemini, awareness 55/100: Confused us with a metal fabrication company. The kind that bends sheet metal in a shop with a press brake. Gemini was genuinely trying to help. Gemini was completely wrong.

Mistral Large, awareness 85/100: Confidently described us as a firearms retailer. Specific enough to be dangerous. Wrong enough to be funny.

DeepSeek Reasoner, awareness 85/100: Claimed knowledge of "Duggan USA" as an HVAC contractor with mediocre customer reviews. Pulled in actual review fragments from a real HVAC company in a different state and attributed them to us. The 3-star average was someone else's bad day, served back to us as our own reputation.

Two models had no idea we existed. Three had high confidence in completely wrong answers. The two no-information answers are recoverable. The three high-confidence wrong answers are worse — they're the kind of thing a procurement officer or a journalist would copy-paste into an email and ship.

Those answers are out there right now. People searching ChatGPT for "DugganUSA" are getting one of two responses: "I don't know" or "they make sheet metal." Neither one closes a deal. Neither one builds a brand. Neither one helps a CISO who just heard about us from a colleague decide whether to talk to us.

That's a real cost. Not theoretical. Not a future risk. A today cost. Every minute that audit sat unfixed was a minute someone might be deciding we weren't real.

Why The Models Are Wrong

The models aren't lying. They're answering with the data they have, and the data they have is bad.

GPT-4o and Claude have a knowledge cutoff. We're a 6-month-old company that filed its LLC December 1, 2025 and didn't really start publishing until January. Our blog has grown from 70 posts to 1,655 in three months. Most of our content is too new to be in their training sets. They're not wrong; they're just behind.

Gemini, Mistral, and DeepSeek do live retrieval. They're going out to the web in real time. They should know us. They don't, because they're falling for the most basic possible failure mode in 2026 search: there is no structured data on www.dugganusa.com telling them who we are.

We have a Wix-hosted blog. Wix sites do not, by default, ship Schema.org Organization markup. They do not declare their legal name in JSON-LD. They do not list services. They do not link to credentials. The crawlers land on our site, see a bunch of blog posts about threat intelligence, and have to guess what kind of company would publish them. The guesses are: a metal shop, a gun store, an HVAC contractor.

There are hundreds of small businesses named "Duggan" doing all three of those things. Without explicit disambiguation, "Duggan USA" is just an ambiguous string that crawlers route through their statistical priors. Gun shops get the .com. HVAC companies get the local SEO. We get the bad reputation that someone else earned.

The fix is exactly the thing AIPM has been telling other companies to do for a month: ship structured data. Tell the crawlers explicitly who you are, what you do, and what you are not. Stop letting them guess.

The reason I was avoiding the audit is that fixing this on a Wix site is not a Wix problem. Wix is the origin. We don't control its HTML output. There is no plugin marketplace entry for "tell the world I'm not a metal shop." If we wanted Schema.org Organization markup on www.dugganusa.com, we had to inject it from somewhere upstream of Wix.

Upstream of Wix is Cloudflare. Upstream of Cloudflare is our edge worker. The edge worker is mine.

The Fix: HTMLRewriter at the Edge

We already operate a Cloudflare Worker called dugganusa-edge-shield. It's open source. It runs on every request that hits our marketing site, our analytics dashboard, and security.dugganusa.com. Until tonight it did three things: detect scanner traffic and return HTTP 418 ("We see you. We indexed you."), block known IOCs from a 1M-indicator feed, and add geographic enrichment headers for the origin to consume.

I added a fourth layer. I called it LAYER 5 because that's where it slotted in the worker's pipeline. LAYER 5 uses Cloudflare's HTMLRewriter API to parse every HTML response on the way out, find the head tag, and append six things into it before the browser ever sees the page.

One Schema.org Organization JSON-LD block. Four Schema.org Service JSON-LD blocks. Three meta tags. The Organization block declares our legal name (DugganUSA LLC), our DUNS number (14-363-3562), our SAM.gov UEI (TP9FY7262K87), our founding date (October 7, 2025), our address, and seven hasCredential entries documenting our compliance posture (CMMC L2, SOC 2 Type 2, GovRAMP Foundation Ready, CISA AIS Data Aggregator, DNSSEC, security headers, cosign-signed container images). It also includes a knowsAbout array listing the actual technical domains we work in, and a sameAs list pointing at our GitHub, Bluesky, LinkedIn, and OTX profiles.

The four Service blocks describe our actual products: Butterbot (the agentic AI platform), AIPM (the audit tool you're reading about), Edge Honeypot Network (the canary path system), and Exploit Harvester (the GitHub CVE detection cron). Each one has a description, a URL, a service type, and explicit attribution to the parent Organization via @id reference.

The three meta tags are for the AI crawlers specifically. ai-purpose says "Cybersecurity threat intelligence at the Cloudflare edge. Not Duggan Manufacturing. Not a firearms company. Not an HVAC company." ai-credentials lists the same compliance shorthand. ai-services names the four products. The whole thing is 4 kilobytes of structured data injected into every page on the marketing site by 12 lines of Cloudflare Worker code.

I deployed it tonight. Worker version 1f64f0e4. Verified on the wire — curl https://www.dugganusa.com now returns 6 application/ld+json blocks where there used to be one (Wix's default), the ai-purpose meta tag is present, the disambiguation copy is in the page source, and the DUNS number is right there for any crawler that wants it.

The Receipt

The audit score from before the fix is captured at compliance/evidence/aipm-baselines/dugganusa-com-baseline-2026-04-07.json in our enterprise repo. The audit score from five minutes after the fix is at dugganusa-com-post-ldjson-2026-04-07.json in the same folder. They are 56 out of 95 and 56 out of 95 respectively. Identical.

That is not a defeat. That is the AIPM scoring methodology working correctly. Council scores are a lagging indicator. Foundation models like GPT-4o and Claude do not see today's HTML changes — they see whatever was in their training data. The models that do live retrieval (Gemini, Mistral, DeepSeek) cache aggressively and re-index on a schedule that's measured in weeks, not minutes. The structural fix is a leading indicator. The structural fix is in production right now and has been verified live. The lift will show up in the council score in 2 to 8 weeks.

This is the same thing we tell every AIPM customer. Ship the structured data first. Wait for the crawlers. Re-audit at intervals. Measure the delta against your baseline. We just ate our own dog food in front of you.

The other thing we did tonight, incidentally, is solve the same problem on security.dugganusa.com — which had been stuck at a B+ on its content security policy for unrelated reasons because a Cloudflare Transform Rule was overwriting the strict Express headers our security team had shipped two days ago. One CF API call narrowed the rule's scope and security.dugganusa.com instantly became A+ on securityheaders.com. Different bug, same kind of fix: stop something at the edge from trampling something good at the origin. There's a separate post coming on that one.

What This Means For Anyone Running A Company

Three things, none of them complicated.

One: audit yourself. Go to aipmsec.com and run your own domain. It is free and it takes 90 seconds. If your AIPM score is below 70 and your NPS is negative, the AI models have a wrong answer about you and that wrong answer is being served to humans every day. You will not see this in your traffic dashboards. You will see it in the deals that don't happen.

Two: ship structured data. If your site is on Wix or Squarespace or another CMS that doesn't expose Schema.org markup, your options are: install a third-party app (Wix has a couple, mostly unmaintained), inject the markup via a Cloudflare Worker the way we did, or move to a CMS that does this natively. The injection path is the cheapest because it works regardless of what your CMS does. Our worker is open source at github.com/pduggusa/dugganusa-edge-shield if you want a starting point.

Three: do not wait for the models to figure it out. The models will not figure it out. They will keep serving the wrong answer until you give them the right one in a format they can actually parse. Schema.org JSON-LD is the format they parse. There is no shortcut. There is no marketing campaign that fixes this. There is no PR firm that gets you into the LLM training data. There is structured data, and there is letting the crawlers guess.

We let the crawlers guess for six months. The crawlers guessed sheet metal. Tonight we stopped guessing.

Postscript

The council audit ran at 03:30 UTC on 2026-04-07. The Cloudflare Worker deployment landed at 03:42 UTC. The post-deploy audit ran at 03:44 UTC. The blog post you are reading was committed at the end of the same session, after we also closed 208 Dependabot alerts, hardened Judge Dredd to zero vulnerabilities, deployed a new Butterbot heartbeat endpoint to the analytics brain, and got security.dugganusa.com from B+ to A+ on its CSP. The whole arc is in commits c08670e6, df731ba0, b709e01a, and 0c2a69a across two repositories.

If you want to verify any of this independently, the worker is open source, the audit is free, the JSON evidence is in our compliance folder on GitHub, and the headers we ship are visible to anyone who curls the site. The point of writing this down is not to brag about the fix. The point is that the boring architecture is the safe architecture, and the boring architecture is also the architecture that AI models can actually understand.

We will not be sheet metal forever.

---

Her name was Renee Nicole Good.

His name was Alex Jeffery Pretti.