Last week, I got back from Reykjavik, where the first Atlas Digital Summit ran on September 28-29. Two days in one Icelandic theater, with a room full of hosting, cybersecurity, and cloud people who were interested in what AI is doing to their business.
WebHosting.Today, one of the summit’s media partners, Natalia Nowak, walked through the program. This is the follow-up from the trenches: what hosters were worried about, and what I would do on Monday morning if I ran a hosting company.
I’m writing this event recap under the Chatham House Rule, meaning I’m sharing ideas and data points, not who said what. With one exception: the roundtable I co-hosted with Carolyn Shelby, regarding AI visibility for hosting companies.
Key information
- Dates: September 28-29, 2026
- Location: Gamla Bio, Reykjavik, Iceland
- Format: invite-only, aimed at C-level hosting, data center, and cloud leaders
- Program: one keynote, one fireside chat, and six roundtable blocks, each run in two parallel tracks: Hosting and Security
- Curator: Jason Nickerson
- Next edition: September 20-21, 2027, Reykjavik
The conference format that encouraged sharing
Organizer Jason Nickerson chose a format that’s rare in this industry: each day opened on the main stage with a keynote on how machines now browse, build, and buy, followed by a fireside chat on AI, regulation, and resilience. After that, everyone split into roundtables across the Hosting and Security tracks and picked a table per block.
For a hosting company, the Hosting track agenda was offering answers to the questions most hosting companies’ CEOs have nowadays:
- What customers expect from a host when vibe-coding platforms and AI-powered control panels change how sites get built and managed
- How to run agentic AI workflows with governance and guardrails
- Where AI agents help in support, and where they create new failure modes
- How to judge the open source projects underneath the AI stack, including new obligations under the EU Cyber Resilience Act
- How AI search visibility works for hosting brands, which was my table
- What makes a hosting company valuable in M&A right now
The people in the room were hands-on operators, and it showed in the questions, as nobody needed AI explained to them. They wanted to know what to do about it.
1. Bot traffic surpassed human one
According to a 2025 Imperva report, bot traffic makes up more than 53% of all website traffic, while Matthew Prince, CEO of Cloudflare, posted on X in June that automated traffic now accounts for 57.3% of worldwide HTTP requests to HTML content, compared with 42.7% for humans. Crawlers, scrapers, and a growing number of AI agents that browse on behalf of users drive most of it.
For a hosting company, that number is both a cost line and a security issue. One of the main issues for hosting providers and cybersecurity companies is classification. Security vendors in the room said they struggle to tell legitimate AI bots from malicious ones, because a well-behaved AI crawler and a hostile scraper can look the same at the request level. The old playbook of allowing known good bots and blocking the rest is under strain. Traffic that used to be clearly abnormal is now normal.
If you sell shared or managed hosting, expect this to show up in your resource limits, your abuse policy, and your pricing, in that order.
2. Vibe-coded apps are reaching production, and they do not look like WordPress
The pace of site creation is hard to overstate. According to the slides presented, more than 33,000 new WordPress websites and over 147,000 Lovable projects are created every day. Many hosting companies asked the same thing: how do we host these AI-built applications? They don’t fit the PHP and WordPress stack most platforms were designed around.
The question wasn’t whether this demand was real, because it’s visible, but what to sell to it. Node.js apps are arriving on shared and VPS plans. Customers expect to build and deploy in natural prompt language and to manage their account the same way. So we concluded that we must redesign onboarding, support, and trust around that customer.
There is the security side too. Every new runtime, framework, and deployment pattern brings its own attack surface. Hosts spent years building hardening, patching, and monitoring around WordPress, but now they face applications with unfamiliar structures, written by people with no security background.
3. AI writes the code, and you inherit the vulnerabilities
AI-generated code now makes up around 75% of Google’s new code. Across the industry, about 45% of AI-generated code fails security tests. The second figure also appears on the summit’s own site, which credits a Veracode Spring 2026 update and says the flaws persist across the latest models. Output is scaling faster than the verification that should come with it.
Put those two numbers side by side, and hosting providers sit directly downstream. People who didn’t write the code ship more of it than they can fully review, and it lands on your infrastructure.
One point from the security discussions was that finding vulnerabilities with AI is probabilistic, not deterministic, so security companies cannot rely on a single test or a single model.
They run multiple tests against the same model and code because results differ from run to run, and again when the model changes. One idea on the table was to give advanced models first to security companies and selected developers, so they can find and patch flaws before attackers do. It gives defenders a head start in a race where both sides have the same technology.
For a host, the conclusion is that a single clean scan of the code and traffic patterns tells you less than it used to.
4. AI support earns its keep at the spike, and costs you at 5%
One leading hosting company described its AI support deployment, and the value was clearest seen when the support department was under pressure. When a vulnerability is disclosed, or an outage hits, tickets can surge from dozens to thousands within minutes, but AI absorbs that spike in a way no human team can staff for. Communication speed during an incident shapes customer trust, and automation can keep customers informed while engineers work on the fix.
The same company reported a hallucination rate of around 5%. They monitor it closely and keep working to reduce it. One method is to write knowledge base content that AI can read and interpret easily, which is a useful reminder that your documentation now has two audiences.
A 5% error rate is fine for some questions and unacceptable for others. When an assistant advises a customer on a security configuration or an active incident, a confident wrong answer is a risk in itself. For a host, that means routing: let AI take the volume, and decide in advance which topics always go to a person. Monitoring is not optional.
5. The traffic hosts lose, and the customers who leave with it
I opened the AI Visibility roundtable with the numbers I keep seeing in AI Visibility audits and in my study of 100 business blogs: organic search traffic is down 60-75% since 2022. In the hosting industry specifically, Semrush estimates that brands that had large informational content clusters (ex what is WordPress, what is shared hosting, how to configure your SPF and DKIM records, etc.) lost 77-85% of their organic traffic in the last year alone.
The cause is the search results page itself: AI Overviews now push the blue links people used to click below the fold, then show YouTube videos, Reddit threads, and forum discussions for these informational queries. SparkToro’s June 2026 analysis of Similarweb data found that 68% of US Google searches between January and April 2026 ended without a click. Carolyn Shelby noted that the decline didn’t start with AI Overviews. She traces it to Google’s Helpful Content Update, which AI Overviews then accelerated.
There is a second-order effect that matters to anyone selling hosting. Many sites on low-price plans exist to earn ad revenue and affiliate commissions from informational content, so if that model stops paying, those sites get abandoned, and owners no longer pay the hosting bill. We discussed this at the table as likely churn in the cheapest tiers.
The other side of the same picture benefits hosters. Transactional queries still send people to websites, and small businesses still need a web presence they own, so SMB-focused hosts stay relevant. The customer who disappears first is the publisher whose business was borrowed traffic.
6. How a hosting brand gets recommended by AI
I co-hosted this table with Carolyn Shelby, and it went differently than I expected: I walked in prepared to convince executives that search had changed, but everyone in the room already knew it and accepted it. So we spent 75 minutes on a better question: how does a hosting company improve its chances of being cited, mentioned, and recommended when a buyer asks an AI which provider to choose?
Here is what I would take back to a hosting company:
Treat your website as the authoritative source about your brand, and make it accessible and clear
Carolyn’s advice was the most practical. Put essential facts in plain text that stays clear without styling, JavaScript, or clicks. Be specific and back claims with evidence, because vague claims tend not to get cited. Name your brand in headings, titles, and body copy. Cover topics by meaning, not by exact-match phrases, and add content that matches how people phrase conversational queries.
Consistency matters; independent proof matters more.
Keep your entity data aligned across your site, Wikidata, LinkedIn, and third-party listings. But repetition doesn’t equal evidence. You need mentions from sources that stand apart from you. Audit what AI says about your brand, trace any wrong answer to its source, and fix it there, quickly, because contradictory data accumulates. And a caution from my own tests: you can nudge an AI’s narrative for a short time with fast positioning, but it reverts as more data comes in. There are no durable shortcuts.
Stop publishing self-serving listicles.
I said it bluntly at the table: “best hosting” lists that crown your own brand erode credibility. In the cases I have looked at, they often end up helping competitors. In one example I showed, Google recommended Bluehost but cited a page from InstaWP, a competitor, as the source. I cannot prove causation, but AI seems to prefer larger, corroborated entities that appear across comparison pages. Carolyn’s alternative is honest comparison content that names the competitors, says where you fit, and lets the evidence do the work.
Do not build on Reddit alone.
One participant pointed out an 86% drop in Reddit citations in ChatGPT, so it is volatile. Authentic user-generated content from real customers, affiliates, and clients is in. Black-hat seeding is out. Video is worth a look too, since AI products often recommend videos and real transcripts are easy to extract.
Measure direction, not traffic.
An AI-driven brand recommendation often comes with no link, or with a link that doesn’t go to your site. The visit may show up later as direct or referral traffic, and analytics will not tell you AI was the source. So run a repeated prompt panel, sampled many times because answers are probabilistic, and count mentions, citations, and recommendations separately.
Compare it with spikes in direct and referral traffic, and watch revenue. Build buyer personas, such as photographers or publishers, and prompt the AI as each of them. A query like “best WordPress hosting in Europe for photographers” is how your next customer actually searches.
When choosing publishers for third-party placements, Carolyn offered a simple rule. New entities should prioritize quantity to build presence. Established entities should prioritize quality. My addition: expand in steps, measure the effect on citations after each batch, and only then scale.
7. The question that remained unanswered: machine-first or human-first?
One question stood out in one presentation, and the audience didn’t give a sharp answer. Will the web be rewritten to be machine-first, or will it stay human-first while machines adapt?
The market is split right now; for instance, Amazon blocks Muse AI shopping assistants for the moment, while Shopify fully embraces agentic commerce. Both are rational bets for different reasons, and in my opinion, neither can be right in the long run.
The opening keynote framed it as a question about trust, and I think that is the right lens for hosts. The answer will shape bot management, authentication, and fraud prevention. It will also determine liability when an agent transacts on a person’s behalf. Those are commercial questions as much as technical ones, and the people who run the servers will be asked to answer them first. The industry has not settled any of it.
I think we’ll transition to a machine-first web where agents can create, read, and buy things online, but traditional e-commerce will still exist. Just as e-commerce didn’t replace traditional shops.
What I suggest hosting companies should do next.
If I ran a hosting company, this is the list I would bring back to the team:
- Measure the share of bot traffic on your own platform and what it costs you per plan. Then write a clear policy for AI crawlers instead of improvising one.
- Decide what you will sell to customers who build with AI tools: which runtimes, what isolation, what onboarding.
- Stop treating a single clean vulnerability scan as proof. Run repeated tests and accept that results vary between runs and between models.
- Put AI support on the spikes, define the topics that always go to a human, and track your hallucination rate.
- Rewrite your help content so a machine can read it as easily as a customer and use it to train your agents.
- Audit what AI says about your brand and trace every wrong answer to its source.
- Replace self-serving listicles with honest comparison pages that name competitors.
- Set up a repeated prompt panel with buyer personas, and count mentions, citations, and recommendations separately.
Final impressions
If one message came through in both tracks, it is that AI is increasing the attack surface, code volume, and traffic volume at the same time, while the tools to verify and defend are still catching up. Hosting companies sit at the point where all three land.
Those that treat AI as both an opportunity and a risk to be measured will be better placed than those that treat it as only one. Most of what I heard during Atlas Digital Summit came down to measuring: bot share, scan results, hallucination rate, citations. Start counting.
Thanks to Jason Nickerson for building a format that gives people a room to talk, and to everyone who participated. The second edition is already set for September 20-21, 2027.
