Balancing lead generation, growth, and security in the age of AI search

COMMENTARY: A profound shift is rewriting the rules of digital consumer behavior. We are all watching traditional Google searches lose ground to conversational AI platforms like ChatGPT, Claude, and Gemini. For marketing and growth development teams, the mandate is clear: if someone asks ChatGPT for a product or service your company provides, your company absolutely has to be the answer they get. To make that happen, we have to let AI “bots” into our website to read, index, and understand our content.

But here is the catch that keeps me up at night.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

This commercial race for visibility introduces a critical corporate threat vector. For the last decade, our collective cybersecurity strategy has relied on a very simple, rigid rule: Humans are good, automated bots are bad. Humans have spent millions building digital walls to block automated traffic because bots are usually trying to steal our data, crash our systems, or hack into customer accounts. By opening our doors and allowing the “good” AI bots in so that we can rank well, we risk creating a backdoor for the bad actors. It is a classic business dilemma: how do we welcome the right guests without leaving the front door unlocked for criminals? How does an organization continue to defend its web applications against automated internet threats while systematically enabling generative AI platforms to traverse its digital real estate?

Resolving this tension will require us, as a collective, to shift from a legacy mindset of “human versus bot” to an advanced framework of intent-based bot governance.

Here is how I am trying to approach this challenge, broken down into the key distinctions and decisions ahead of us.

1. Not all AI bots are created equal

We cannot just flip a switch and let all AI traffic in. We need to divide AI visitors into three distinct buckets and treat them based on the value they bring to our bottom line:

2. The risk of “ID forgery”

The biggest security risk we face here is identity theft at scale. Bad actors know that companies are opening up their websites for ChatGPT and Claude. Consequently, hackers are now disguising their malicious attack bots to look like legitimate AI tools.

If our security systems blindly trust a visitor just because it claims to be “ChatGPT,” we are exposing our businesses to major vulnerabilities. Hackers will use this trick to scrape intel like pricing, copy proprietary data, or try to guess customer passwords.

Our security teams cannot rely on trust; we have to enforce a strict “show me your ID” policy. Every time an AI bot visits, our systems must verify behind the scenes that the traffic is actually coming from the official server networks owned by OpenAI, Microsoft, or Anthropic. If the ID doesn’t check out, we drop them immediately.

3. Creating a “visitor’s center” (air-gapping)

When we invite AI bots into our digital house, they only need to see our public-facing information — our blogs, documentation, and product catalogs. They have absolutely no business being near our transactional systems.

I like to think of this as building a secure “visitor’s center.” We need to configure our networks so that verified AI bots are physically isolated. They can read our public content all day, but they are strictly blocked from the sensitive pathways — like our checkout pages, login screens, and financial databases.

4. Limit the traffic speed and volume

Traditional security tools act like an aggressive speed trap — if any system makes too many requests too fast, it gets pulled over and blocked. But with AI, we need a more flexible approach depending on the situation.

Think of it like managing traffic on a highway:

4. Avoiding the trap of “one-click” security eixes

Many of our primary security vendors now offer a tempting, simple checkbox on their dashboards that says something like, “Allow AI Services.” While that sounds easy, relying on such a blunt tool is highly risky.

These one-click toggles lack nuance. They typically treat the highly valuable AI search bots and the predatory data scrapers exactly the same — either letting everyone in or locking everyone out.

We can’t manage a nuanced business risk with a blunt on/off switch. Our engineering team needs to write precise, customized rules. Our policy should always follow a common-sense checklist:

This allows us to protect our infrastructure while fully supporting our growth.

Remember to strategically gatekeep

The shift from traditional search bars to AI assistants is an irreversible reality. We cannot afford to hide behind a wall and block the future just to stay safe. But we also cannot afford to be naive.

The path forward isn’t about blocking all bots, nor is it about a free-for-all. It’s about smart gatekeeping. By knowing exactly who is knocking on our digital door, verifying their identity, and limiting exactly where they can walk on our site, we can ensure our business is highly visible to new customers while keeping our core assets entirely secure.