CyberSecurityMag – Cybersecurity Magazine CyberSecurity Magazine for Small and Medium Businesses
Notes from Reykjavik on AI-driven traffic, insecure code, and the infrastructure industry’s hardest open question by Daniel Stanica
I just returned from Reykjavik, Iceland, where the first edition of Atlas Digital Summit took place on September 28-29, 2026. It was a private, invite-only gathering for hosting, data center, and cloud infrastructure leaders, with one subject running through every session: how AI is reshaping the industry.
Organizer Jason Nickerson [LinkedIn], a veteran of the web and hosting industry, chose a format that is rare in this space. Instead of a stage-and-expo model, the summit centered on roundtables across two parallel tracks, Hosting and Security, framed by a keynote on how machines now browse, build, and buy, and a fireside chat on AI, regulation, and resilience. The venue was Gamla Bió Theater, in a country whose fully renewable grid made it a fitting backdrop for a conversation about AI and sustainable infrastructure.
This report is conducted under the Chatham House Rule. I’m sharing the ideas and the data points that surfaced, not who said what.
Eight themes stood out. Several have direct consequences for anyone responsible for securing web infrastructure.
1. Bots have overtaken humans
Bot traffic now accounts for more than 53% of total website traffic, surpassing human visitors. The drivers are crawlers, scrapers, and a growing population of AI agents that consume content on behalf of users.
For security teams, this is more than a statistic. The challenge raised repeatedly was classification: security companies are struggling to distinguish legitimate AI bots from malicious ones. A well-behaved AI crawler and a hostile scraper can look similar at the request level, and the old model of allowing known good bots and blocking the rest is under strain. Traffic that was once clearly abnormal is now a normal part of the web.
2. Vibe-coded apps are reaching production, and hosts must catch up
The pace of site creation is staggering. Every day, more than 33,000 new WordPress websites and over 147,000 Lovable projects are created. Many hosting companies are asking how to host these AI-built applications, because they don’t fit neatly into the PHP and WordPress stack that most platforms were designed around.
This matters for security because every new runtime, framework, and deployment pattern brings its own attack surface. Hosts that built mature hardening, patching, and monitoring around WordPress now face applications with unfamiliar structures, and authors who may have little security background.
3. AI writes more code, and a lot of it fails security tests
AI-generated code now makes up around 75% of Google’s new code. Yet industry-wide, about 45% of AI-generated code fails security tests. Output is scaling faster than the verification that should accompany it.
Put those two numbers side by side, and the risk is clear. As models write more production code, the volume of potentially vulnerable code entering the ecosystem grows, and hosting providers sit downstream.
4. Finding vulnerabilities with AI is not deterministic
One of the most useful insights came from the security discussions. Security companies cannot rely on a single pass when testing for vulnerabilities. They have to run multiple tests against the same model and code because results differ from run to run. They differ again when a different model is used.
That has practical consequences for how vulnerability testing should be designed. One proposed approach was to give advanced models first to security companies and selected developers, so vulnerabilities can be found and patched before malicious actors discover them. It is an attempt to give defenders a head start in a race where attackers have access to the same technology.
5. AI support earns its keep under pressure
On the operational side, one leading hosting company described its AI support deployment. The value is clearest at peak moments: when a vulnerability is disclosed, or an outage hits, support tickets can surge within a very short time. AI absorbs that spike in a way human teams cannot staff for.
This scenario matters most for security incidents. Communication speed during a disclosure or outage shapes customer trust, and automation can help keep customers informed while engineers work on the fix.
6. Hallucinations remain a managed risk
The same company reported that its AI support still has a hallucination rate of around 5%. They monitor it closely and keep working to reduce it. One method is to write knowledge base content that AI can easily read and interpret.
A 5% error rate is acceptable for some questions and unacceptable for others. When an AI assistant advises a customer on a security configuration or incident, a confident wrong answer is a risk in itself. Monitoring is not optional.
7. Zero-click search is changing discovery
According to a June 2026 report by SimilarWeb and SparkToro, more than 68% of Google searches now end without a click. People increasingly get answers directly from search results and AI assistants, which is rewriting how products and services are discovered.
For security vendors and hosting providers alike, the question is no longer only how to rank, but whether AI systems cite and recommend your brand when a buyer asks for a provider. That is the subject of my roundtable, and I’ll cover it in depth in the follow-up piece.
8. The question without an answer: machine-first or human-first?
One question stood out because it never got a sharp answer: will the web be rewritten to be machine-first, or will it stay human-first while machines adapt to it?
The market is currently split. Amazon blocks assistants like Muse for now, while Shopify fully embraces agentic commerce. The answer will shape bot management, authentication, fraud prevention, and how liability works when an agent transacts on a person’s behalf. These are as much security questions as commercial ones, and the industry has not settled them.
Final impressions
Atlas Digital Summit [Website] was well organized, and its mix of keynotes, debate-driven roundtables, and generous networking time worked. The attendees were curious, sharp, and clearly hands-on operators, and the quality of the questions showed it.
If one message came through across both tracks, it is that AI is increasing the attack surface, the volume of code, and the volume of traffic at the same time, while the tools to verify and defend are still catching up. The organizations that treat AI as both an opportunity and a risk to be measured will be better placed than those that treat it as only one of the two.
Daniel Stanica is a digital entrepreneur, AI Visibility advisor, and CEO of CyberSecurityMag.
