Five Shifts We Heard at Pantheon GoLive 2026

Pantheon GoLive 2026 brought web teams, agencies, and technology leaders to Miami on October 6 and 7, and our team attended both days as a Pantheon partner. The message across sessions was consistent: discovery, security, and the way websites get built have all changed at once. Code is now abundant, so the limiting factor has moved to judgment, meaning how well a team decides what to build and checks what AI helps produce. Here are the five shifts we heard most often, and what Pantheon announced in response.

Pantheon P1: an AI-native layer for building websites

Pantheon’s headline announcement was P1, which the company calls an AI-native web composition layer. P1 lets people and AI agents build pages together from approved React components tied to a design system, with permissions, review, and versioned workstreams built in. It opened as a limited, paid beta at GoLive (Pantheon).

Teams work in P1 through a visual builder, a chat interface with comments, Zappy (an embedded agent for in-page tasks), or outside agents connected through MCP. Content can live in P1 or come from WordPress, Drupal, or other API-based sources, and the front end runs on Pantheon’s Next.js hosting (CMSWire). It sits alongside WordPress and Drupal and builds on tools many Pantheon teams already use, including Multidev, Upstreams, and Autopilot. Early examples included the San Diego Zoo Wildlife Alliance site, built by Stauffer.

The part that matters most to our clients is the governance model. Components come from a design system the organization approves, and AI works inside those limits. We left Miami with early ideas for how P1 could fit into our own products and services, and we will share more as that thinking matures.

Shift one: discovery now runs through AI recommendations

Pantheon’s product keynote put it plainly: people now ask questions in many more places, Google’s hold on search is over, and traffic metrics no longer predict results the way they once did.

Andy Crestodina of Orbit Media argued that appearing in AI answers is only the starting point. The goal is to be recommended, which means training AI to act as a sales rep for your brand. Across 97 B2B websites and 29 million visits, visitors who arrived from AI tools were about three times more likely to become leads than visitors from other sources, even though AI sent only about 1 in 200 visits (Orbit Media). Some AI traffic likely sits inside direct traffic numbers, since many AI apps pass no referral data. A separate Orbit study of 74 sites found that AI crawlers gave homepages about 15 times more attention than other pages (Orbit Media).

His side-by-side comparison of the two disciplines:

His advice was to find deficiencies before optimizing anything. Collect the questions prospects ask your sales team and answer them on your site. Find the gaps in your structured data. Build synthetic personas that describe how each buyer decides, who sits on the buying committee, and which objections need evidence. We saw the same pattern in a recent AI visibility audit for a credit union. The brand was cited often on questions about itself and far less often on the comparison questions that bring in new members (full write-up).

A CMO panel later asked whether AI search is the biggest growth opportunity or the end of the click. The answer was yes to both. Pages that still earn the click add context and get the reader to the answer quickly.

Shift two: most web traffic is now automated, and the web is moving toward allowlists

Cloudflare’s panelists estimated that bots now make up roughly 60% of traffic. Cloudflare’s published data for 2025 lands in the same range: people generated 43.5% of requests for web pages, and automated systems, including AI crawlers, generated most of the rest (Cloudflare Radar). A person researching a decision might visit 5 to 20 sites. An AI agent doing the same research might visit thousands.

Blocking everything is no longer practical, so the web is moving toward allowlists and verified identity. Cloudflare pointed to Web Bot Auth, a proposed standard that lets bots and agents sign their requests cryptographically, which allows a site to confirm who is asking (Cloudflare). The harder problem came up in discussion: if one company runs five bots, four helpful and one abusive, how do you allow the good ones without rewarding the bad one? Those visits also cost money. In Pantheon’s State of the Web 2026 survey, 42% of IT leaders had confirmed unexpected costs or billing disputes tied to AI crawler traffic (Pantheon).

Security timelines are compressing too, as Pantheon’s keynote stressed. Google’s M-Trends 2026 report puts the average time to exploit at negative seven days, meaning attackers typically move before a patch exists. In 2018 the window was 63 days (CERT-EU, citing M-Trends 2026).

Biltmore’s web team showed what preparation looks like. During a stretch when much of the surrounding region was offline, its site stayed up, serving 63 million visitors and 154 million pageviews with an 85% cache rate and zero deploy incidents. The team described a sequence worth adopting: a reliable platform leads to a repeatable process, which builds trust and collaboration, which produces speed and, over time, resilience.

Shift three: code is abundant, and judgment is the constraint

For most of the web’s history, the limiting factor was developer time. Pantheon’s keynote argued that code is now abundant, and the important part of product work is the thinking behind it.

Scott Brinker of chiefmartec made the same point from the marketing side. The marketing technology landscape grew from about 150 tools in 2011 to more than 15,000 in 2025 (chiefmartec), and he described vibe coding as the next step in making software creation available to more people. Cloudflare described rebuilding its product marketing function around AI-produced drafts that marketers review and approve. Stephanie Cohen, Cloudflare’s Chief Strategy Officer, summed it up: companies “have to redesign how work is done.”

Speakers added two cautions. Work charts, maps of how work moves through a team, now matter more than org charts. And AI layered on a broken process produces the broken result faster.

Shift four: faster output raises the stakes on validation

Faster production only helps if people can trust what comes out. Pantheon’s State of the Web 2026 survey of 1,000 marketing, engineering, and IT leaders found that manual validation (auditing, fact-checking, and correcting AI output) is the top barrier to scaling AI for 79% of marketing leaders, 78% of engineering leaders, and 83% of IT and security leaders. In the same survey, 51% of marketing leaders said AI and vibe coding tools have reduced their reliance on developers, while 68% of engineering leaders said they are reviewing and fixing AI-generated code from other teams.

Several speakers described the answer as a harness: the permissions, guardrails, and human approvals that keep people and AI working inside agreed limits. A harness also keeps your organization’s context in your hands. If you change AI vendors, that context goes with you.

Design systems came up repeatedly as the foundation. LACMA and Urban Insight described a relationship that had settled into complacency, with no technical owner on the museum’s side. It turned around through direct conversations about transparency and priorities, and by giving the client commit access to its own codebase. University teams, including Texas A&M and the University of Alabama, showed how shared design systems let many contributors publish without losing consistency.

This shift reflects how we already work. We have put significant effort into guardrails for our own AI use: error checking, fact verification, and sourcing requirements that keep us from drafting or specifying incorrect information produced by generative AI. A person on our team validates AI-assisted work before it goes out, and what reaches a client is what we would recommend as experts on the web. Validation is part of the work, and we plan for it.

Shift five: human connection is the competitive advantage

Nicholas Thompson, CEO of The Atlantic, opened the conference by arguing that the deepest moat an organization can build is around its product and the emotional connection people have with it. His view was that optimists will win.

The CMO debate panel reached a similar place from the other direction. If AI agents handle more of the research and early buying process, the remaining advantage is human. Websites still need to deliver the best answer, and they also need to make people feel something. Brinker listed trust and culture as two things AI cannot provide.

Speakers described the leader’s job in human terms too: define what good performance looks like, make it safe for people to raise a hand, and create new ways to train staff as roles change. On marketing and development, the CMO panel was direct. Marketers will not accept long timelines for page updates, and several argued that marketing teams need web development capacity of their own. Asked about the right tech stack, the panel pointed to the operating model and the outcomes it produces.

What we are taking back to our clients

GoLive confirmed a direction our clients already feel. Three steps are worth taking now:

1. Audit how AI describes you. Collect the questions your sales and member services teams hear, check your structured data, and find where your site leaves gaps. Start with the homepage, since AI reads it most.
2. Review your bot and security posture. Decide which automated visitors you want to allow, check that your firewall and caching rules reflect that decision, and confirm how quickly your platform can patch.
3. Write your AI governance model before tools spread. Define who approves what, where your organization’s context lives, how your design system limits what AI can publish, and who validates AI-assisted work before it goes live.

If your team is working through any of these, let’s talk.