This is our fourth certification in a row.

Like every year before it, this recognition comes straight from our own people. The answers are anonymous, which makes the result a genuine reflection of what it feels like to work here, not a badge we awarded ourselves.

How the Certification Works

The certification is based on the Great Place To Work Trust Index Survey®, which examines employees’ experiences of trust, respect, fairness, leadership, and collaboration. Nothing in it is self-reported by management: the result comes from what people said anonymously about working here.

said Alex Vasekin, CEO of AdTech Holding.

What Stands Behind The Certification

A certification is only as good as what sits behind it. For us, that’s professional learning opportunities, hybrid work, health support, language courses, and additional time off.

Our first Great Place To Work® Certified™recognition

Around those sit the working habits that are harder to put on a benefits page: open communication, teamwork, and individual ownership of what you do. They are what let teams spread across different countries build the same product without tripping over each other.

It’s the same principle every time: trust people to know what they need, then back them.

More Than the Job Description

Some of what happens here has nothing to do with anyone’s job description.

Our second certification in 2024

For years, our teams have been planting trees across Cyprus and clearing rubbish from its beaches, together with the Limassol municipality and City Friends Club. Then wildfires tore through the hills of the Limassol district in July 2025. Our office turned into a collection point for essentials while the fires were still burning; afterwards, we joined TechIsland and more than 50 local tech companies in prevention work, backed a hackathon with the Cyprus Deputy Ministry of Research, Innovation and Digital Policy on the same problem, and spent the autumn and the following spring in the burnt areas putting the tree line back. 

Nobody was assigned to any of it. People gave up their weekends and brought their kids, partners, and dogs along. Not all of it takes weekends. We put money behind public spaces as well — the island’s first skate park among them — and try to keep our own footprint in check, from waste sorting to how the office is powered.

Other things run quietly alongside. The office becomes a blood donation point. We support local animal shelters, and colleagues go and spend time there. Inside the company, people train in first aid, run marathons, and fill the office with their children for their own parties. Our corporate celebrations often take the whole company abroad.

The 3rd recognition in a row in 2025

And some of it is aimed at whoever comes next. Our AdStep internship brings people in at the start of their careers, and three of them stayed on this year. We are the exclusive AdTech partner of Youth Tech Fest Cyprus.

None of this is why we are certified. That comes from what people said about trust, fairness, and leadership in an anonymous survey. But the two are related: people who feel heard at work are the ones who get involved when nothing requires them to.

Most of this never turns into a blog post — it lives on our Instagram, where the photos do a better job than we would. You can also hear from colleagues on the initiatives they value most.

AdTech Holding Recognized with Brandon Hall Group Gold HCM Excellence Award

Looking Ahead

We’ll keep investing in our people, building on the trust we’ve earned, and protecting the culture that got us here.

Our people are our greatest strength, and this certification is proof that growing together is what makes AdTech Holding what it is. If that sounds like a place you’d want to be, visit our careers page and take a look at what’s open.

The post Four in a Row: AdTech Holding Is Great Place To Work® Certified™ Again appeared first on AdTech Holding.

That no longer works. Brand protection teams are now expected to justify budgets in the same language finance uses for everything else: revenue recovered, risk reduced, outcomes demonstrated. The challenge is that some of what brand protection delivers is genuinely measurable, some requires modeling with assumptions, and some is still an educated guess dressed up as a metric.

Knowing which is which is where a mature program starts.

Key Takeaways

• Brand protection KPIs fall into three layers: operational metrics you can measure directly, financial metrics that require modeling, and soft metrics that remain largely estimated.
• Takedown count measures activity, not outcome. A program filing 2,000 notices a month on a flat threat volume is running a removal machine, not reducing risk.
• The operational standards (MTTD, time-to-takedown, enforcement success rate, channel coverage) are now widely adopted and form the baseline of any credible report.
• Financial KPIs (recovered revenue, fraud losses prevented, legal cost reduction) are calculable but depend on assumptions that need to be made visible.
• Attack decay rate is the single metric that most directly shows whether a program is shrinking the problem or just managing it.
• 2026 introduced a new challenge: measuring brand presence in AI-generated answers. The KPIs for this do not yet have industry consensus.

Why Brand Protection Spent Decades Without Real Metrics

Brand protection grew out of legal and enforcement work where success looked obvious. You removed the counterfeit or you did not. The idea that you needed to measure what happened downstream, in revenue or customer behavior, felt overly complicated when the immediate output was visible.

Two things changed that. First, the threat surface expanded from a few high-volume counterfeit hubs to a fragmented landscape covering marketplaces, social media, domains, ad networks, app stores, and now AI-generated content. Volume scaled past what anyone could track intuitively. Second, the budgets got large enough to attract scrutiny. A seven-figure brand protection program needs a performance story that goes beyond “we filed a lot of notices.”

What followed was an industry that developed operational metrics over the past five years, layered financial calculations of varying quality on top, and then made soft claims about trust and reputation that most programs assert but few can actually demonstrate. A 2026 peer-reviewed study interviewing practitioners from 35 multinational firms found that the two biggest impediments to adequate brand protection investment are indifferent leadership and the inability to quantify ROI from protection activities.

Layer One: The Four Operational KPIs That Are Now Standard

These measure what your operation is doing, how fast, and how broadly. Netcraft’s 2026 brand protection guide describes the same four as its measurement baseline. They do not tell you whether the business outcome improved, but they are the foundation everything else builds on.

Mean Time to Detection (MTTD)

MTTD measures how long a threat exists before your monitoring finds it. A phishing site can convert victims within hours of going live. A counterfeit listing starts diverting purchase intent the moment it appears. Every hour between “threat goes live” and “threat is detected” is a window where damage accumulates with no intervention.

Tracking MTTD requires timestamping threats at discovery and tracing back to when they were created. This is straightforward for domains (WHOIS records have registration timestamps) and marketplace listings (creation dates are usually available), but harder for social media impersonation where account creation dates may not be accessible.

One useful approach: benchmark MTTD by threat type rather than as a single average. Phishing needs detection within 24 hours. Counterfeit listings carry a longer harm window because the damage accumulates over weeks of diverted sales. Your target should reflect how fast each threat type actually causes harm.

Time to Takedown

Time to takedown measures the gap between detection and confirmed removal. It is the operational KPI that legal and IP teams have tracked the longest, and the one where the platform matters more than your own process. 

In its 2025 Review of Notorious Markets for Counterfeiting and Piracy, published 3 March 2026, the Office of the United States Trade Representative reported that while some e-commerce and social commerce platforms have taken positive steps to implement anti-counterfeiting policies, “many others still lack adequate anti-counterfeiting policies, processes, and tools such as identity verification, effective notice-and-takedown procedures, proactive anti-counterfeiting filters and tools, and strong policies against repeat infringers.” 

That is the gap a per-channel takedown time actually measures: it reflects platform compliance infrastructure and evidence quality, not just your team’s speed.

The metric is more useful when segmented by channel. Social media platforms often respond to well-documented impersonation within a few days, though the spread between platforms is wide enough that a per-channel figure from your own logs beats any published average. Domain registrars using UDRP procedures take weeks to months. A single average number hides those differences and makes it harder to identify where your enforcement pipeline is actually slow.

Enforcement Success Rate (ESR)

ESR is the ratio of threats successfully removed to threats detected. It is the closest thing brand protection has to a hit rate. Many brands track it as their primary effectiveness metric, though no independent benchmark exists – your own trailing average is the target that matters. Below that, the problem usually traces to one of three things: insufficient IP registration in the relevant jurisdiction, incomplete evidence packages, or an unresponsive platform that needs a different escalation path.

One limitation worth knowing: ESR can be gamed unintentionally. Teams that only submit high-confidence cases before actioning them will show excellent ESR while leaving a significant share of threats unaddressed. A stricter version tracks all confirmed threats in the denominator, not just the ones that seemed winnable.

Channel Coverage

Channel coverage measures whether your monitoring is looking where your threats actually are. It is the most underreported of the four operational KPIs, and the most revealing one about whether a program’s architecture reflects current threat reality.

A program monitoring Amazon, eBay, and a list of known counterfeit domains may show excellent metrics on those channels while missing most of the actual threat volume on social commerce platforms, regional marketplaces, or paid ad networks running impersonation campaigns. The way to audit this is a quarterly threat mapping exercise: where were confirmed threats found, including those flagged by customers, partners, and internal teams? Any channel that shows up consistently there but not in your standard monitoring is a gap.

The Metric Everyone Reports and Why It Misleads

Takedown count measures activity, not outcome.

A brand running 500 takedowns per month on a marketplace where 500 new listings appear every month has not reduced the threat. It is sustaining a steady state. Reporting that volume as a success metric is accurate as a count of work done and misleading as evidence that the program is working.

The difference between a vendor reporting activity counts and one providing audit-trail-backed outcome data is exactly the gap between a brand protection report that gets filed and one that gets funded.

Takedown volume is still useful as an operational input. It feeds into ESR and informs recovery calculations. The problem is treating it as the primary outcome metric. A program whose takedown volume is falling because the underlying threat population is shrinking is performing better than a program where volume keeps rising.

Layer Two: Financial KPIs – Turning Enforcement Data Into Revenue Numbers

Financial KPIs are where brand protection programs earn budget credibility. They require modeling rather than direct measurement, which means the assumptions behind them need to be explicit. A number that looks like revenue recovered is often revenue recovered multiplied by a conversion assumption (and the assumption is doing a lot of work).

Recovered Revenue

The standard calculation: take the volume of confirmed infringing inventory removed, apply a conversion assumption (what share of customers who bought the fake would have bought the genuine product instead), and multiply by your average selling price.

The conversion assumption is where most programs get vague. There is no published industry figure to fall back on, so pick a rate you can defend rather than one you found in an article. A commodity brand can defensibly assume a higher rate than a premium brand, because the price gap between fake and genuine is smaller and the buyer could have afforded the original.

Fraud Losses Prevented

For brands dealing with phishing, account takeover, or fake advertising rather than counterfeits, the financial metric is fraud loss prevented. This comes from confirmed fraud incidents intercepted before completion, documented through platform case records or support tickets resolved as fraudulent.

How Ad Tech and Payment Platforms Fight Financial Crime Together

The difference between a loss-prevention figure backed by case-level documentation and one derived from estimated exposure multiplied by probability is significant. Finance treats the first as evidence and the second as a projection.

Legal Cost Reduction

Programs that intercept threats before they reach formal legal proceedings generate measurable cost reduction in outside counsel fees, filing costs, and case management time. The data source is your legal department’s billing records, segmented by brand protection matters. It requires coordination between teams, which is why it is underused, but it is not difficult to produce once that reporting relationship is established.

Layer Three: What You’re Estimating – Trust, LTV, and Reputation

These metrics are real in terms of business impact. They are also largely impossible to measure directly at the program level with current standard tools.

Customer Trust and NPS

NPS moves in response to too many variables simultaneously for brand protection activity to be cleanly attributed. What you can do is track customer complaints specifically attributed to suspected counterfeit or impersonation incidents and show a reduction in that category as enforcement increases. That is a proxy, not a direct measurement, but it is defensible.

The measurement gap here is not permanent. It reflects the current state of attribution methodology, not a hard limit on what is knowable. 

KYC and New Fraud Threats in 2026

LTV of Recovered Customers

The theory is sound: a customer who encounters a counterfeit and has a bad experience either churns or permanently shifts perception of the brand. A program that removes the counterfeit before that customer is harmed preserves that LTV. The problem is that you cannot observe the counterfactual.

Some programs model this by estimating how many customers would have encountered the removed inventory, applying a harm probability, and multiplying by average LTV. Present it as a modeled estimate with visible assumptions, not as a measured outcome. The number is useful for illustrating program value; it should not be presented as verified data.

Reputational Impact

Share of voice and brand sentiment are useful brand health metrics, but they respond to too many variables to be attributed to enforcement activity. The honest position is that brand protection preserves the conditions under which brand investment can work. Measuring that preservation is not yet standardized.

The KPI That Separates Mature Programs From Busy Ones

Attack decay rate is the single metric that most directly answers the question a board actually wants answered: is this program making the problem smaller, or just managing it at a steady state?

The metric tracks the lifecycle of a threat class over time. Plot the volume of active threats in a given category from the point your program starts targeting them. A working program shows a decay curve: high initial volume, declining as enforcement pressure builds, settling at a lower baseline. A program that is not working shows a flat or rising line despite removal activity.

The 2026 Frontier: Measuring Brand Presence in AI-Generated Answers

AI assistants and generative search features have introduced a brand protection problem the industry has not solved. When a user asks an AI system whether a product is genuine, who the authorized resellers are, or what a brand’s return policy is, the answer may come from training data that is out of date, from a third-party source with inaccurate claims, or from content a bad actor deliberately introduced to influence AI outputs. AI summaries can repeat incorrect information quickly, and systematic detection and correction is not yet standard practice.

The measurement challenge is structural. A counterfeit listing has a URL, a seller account, and a removable artifact. AI-generated misinformation about a brand exists as an output of a probabilistic system that produces different responses to the same query across different sessions, models, and regions. There is no single thing to take down. Two categories of KPIs are emerging, though neither has reached industry consensus:

Presence metrics: Is the brand surfaced in AI-generated responses to category queries? Tracking this requires systematic querying of major AI systems across target markets and logging mention frequency over time.

Accuracy metrics: When the brand is mentioned, is the information correct?
This requires sampling AI outputs and scoring them against a maintained ground truth: product details, authorized reseller lists, pricing, policy information.

Both are currently tracked manually by the brands that track them at all. Automated tooling is early-stage. Programs already running actor-level threat intelligence and infrastructure mapping, the kind of domain abuse investigation work that feeds detection today, are better positioned to extend into AI-generated content monitoring than programs running keyword scanning alone. 

How to Build a Brand Protection Dashboard That Finance Will Actually Read

Most brand protection dashboards are built for the brand protection team. They show operational throughput. Finance wants to see business impact. That translation is where most programs lose budget arguments.

A dashboard that works for both layers has three things:

Top line: 2 or 3 outcome numbers
Revenue recovered or at-risk eliminated, fraud losses prevented, and attack decay rate trend for the program’s primary threat class. These answer the question:
“Is this working and what did it return?”

Middle: operational performance
MTTD trend, time-to-takedown by channel, ESR by platform. These answer the question:  “How efficiently is the operation running?” and give context to the outcome numbers.

Bottom: coverage audit
Channel coverage map updated quarterly, showing monitored channels versus confirmed-threat channels. This answers the question:

“Are we looking in the right places?”

One practice that consistently improves finance reception: label your numbers by confidence level. A revenue recovery figure built on a conversion assumption should say “modeled recovery, 15% conversion assumption, methodology on file.” A figure pulled from fraud case records says “verified prevented loss.”

That distinction matters. Modeled estimates are necessary in brand protection reporting. But numbers backed by case-level audit trails carry more weight with finance than projections. Platforms that produce aggregated reports per traffic source, with detailed reports available on request, give brand protection teams more numbers in the verified column and fewer in the modeled one. That is what turns a cost-center report into a renewal case.

FAQ

What is the most important brand protection KPI?

It depends on the program’s primary threat type. For marketplace counterfeiting, enforcement success rate and revenue recovery matter most. For phishing and impersonation, MTTD and fraud losses prevented are more relevant. If you can only track one metric that speaks to effectiveness rather than activity, attack decay rate is the most informative.

Is takedown count a useful KPI?

Yes, as an operational input. No, as a primary outcome metric. It feeds ESR and informs recovery calculations. But a high takedown count with flat threat volume means you are maintaining a steady state, not reducing risk.

How do you calculate enforcement success rate?

Divide confirmed threats removed by confirmed threats detected and actioned. The targets in circulation come from vendors rather than an independent body, and the rate varies enough by channel that a single figure would mislead. Track it per channel against your own trailing average to find where your enforcement pipeline is weakest.

Can brand protection ROI be measured accurately?

The hard components (legal cost reduction, verified fraud loss prevention, marketplace-data revenue recovery) can be measured with reasonable accuracy when the methodology is documented consistently. The soft components (trust, LTV effects, reputational impact) can be modeled but not directly measured with current standard tools. Present each with its appropriate confidence level rather than combining them into one ROI figure.

What are the emerging KPIs for AI-generated content?

There are no established standards yet. The emerging approach tracks presence (whether the brand appears in AI-generated responses to category queries) and accuracy (whether information about the brand in those responses is correct). Both currently require manual sampling. Programs running actor-level threat intelligence are better positioned to extend into this area as tooling develops.

How often should brand protection KPIs be reviewed?

Operational metrics monthly. Both financial metrics and channel coverage are advised to be reviewed quarterly. Last but not least, attack decay rate should be reviewed at the end of each 12-month period.

Final Thoughts

Brand protection has historically undersold itself by reporting activity as if it were an outcome. Thankfully, the frameworks for doing it properly now exist!

Programs that want to move from cost-center to value-generating need three things: a data infrastructure that categorizes threats consistently enough to track lifecycle curves, a financial methodology that labels hard numbers and modeled estimates separately, and the discipline to report attack decay alongside removal volume.

The AI measurement problem adds a layer no program has fully solved yet. Brand presence in AI-generated answers is a real and growing concern, and the KPIs are nascent. The programs that are ahead of this in 2027 will be the ones measuring it in 2026.

The post Can You Measure Brand Protection? The KPIs That Actually Exist appeared first on AdTech Holding.

The award recognizes our “AdTech Holding Becomes Strategy-First Organization” program, which we ran together with business strategy consultancy SOTA.

The Brandon Hall Group HCM Excellence Awards are decided by a panel of independent senior industry experts, analysts, and executives. They judge against a published evaluation framework rather than popularity or nomination alone.

That independent validation strengthens both our employer brand and the confidence our partners place in us, across AdTech Holding, SOTA, and PropellerAds.

About the Brandon Hall Group HCM Excellence Awards

For more than 30 years, the Brandon Hall Group HCM Excellence Awards have recognized organizations that turn workforce strategy into measurable business results.

The program is widely regarded as the Academy Awards of Human Capital Management.

What makes a Gold here worth having is how entries are judged. Brandon Hall Group describes the process this way: every submission is reviewed by a panel of veteran independent industry experts, its own analysts, and executives, against the same four published criteria:

• Alignment to the business need and environment
• Program design, functionality, and delivery
• Adoption, integration, user experience, innovation, and creativity
• Overall effectiveness, impact, and measurable benefits

In other words, recognition is earned on demonstrated results rather than on popularity or a nomination alone. A program has to show what it changed, not just that it happened.

The Winning Program

The winning entry, AdTech Holding Becomes Strategy-First Organization, reshaped how the company sets direction and turns strategy into everyday practice. We designed and delivered it alongside SOTA, whose expertise helped us build a working system that teams across the organization now use.

The results show up in how leaders read the strategy and work with it. In our leadership pulse survey, OKR effectiveness came in at 88%, and 94% of leaders said the strategy is clear to them.

Gold in this category recognizes that the way AdTech Holding is run, from how decisions get made to how strategy reaches the teams delivering on it, meets the standards this program measures against.

In Their Words

Brandon Hall Group put it this way when announcing the 2026 winners: 

Every year, the HCM Excellence Awards® remind us that innovation is ultimately about impact. The organizations recognized this year have demonstrated that great HR and learning strategies don’t just improve programs; they strengthen organizations, empower people, and deliver measurable business results. We are honored to celebrate their achievements,

said Rachel Cooke, COO of Brandon Hall Group™ and HCM Excellence Awards® Program Leader.

Becoming strategy-first means turning direction into a shared operating discipline. We have built a system that helps our teams make clearer choices, stay aligned and translate priorities into measurable action. This recognition reflects the commitment of everyone who made that change part of how we work every day,

said Elena Dolya, Chief Administrative Officer at AdTech Holding.

Looking Ahead

The Gold will be presented in person at the Brandon Hall Group HCM Excellence Conference on January 26 to 28, 2027. Winners walk across the stage during the Awards Ceremony to receive the trophy from Mike Cooke, Rachel Cooke, and Michael Rochelle.

An award like this belongs to a lot of people. Thank you to the teams across AdTech Holding who did the work, and to SOTA, whose partnership shaped the program from the start.

AdTech Holding is a Deloitte Fast 50 Winner

We take recognition like this as a checkpoint rather than a finish line. The strategy-first way of working is now part of how we operate, and we’ll keep building on it, for our people, for our projects, and for the partners who grow with us.

The post AdTech Holding Recognized with Brandon Hall Group Gold HCM Excellence Award for Excellence in Best Business Strategy appeared first on AdTech Holding.

When people picture financial crime, they usually think of stolen card numbers and disputed charges first. What’s less visible is that a huge part of this fraud starts earlier in advertising, long before any payment happens.

A fraudulent transaction is frequently just the last visible step in a chain that starts with fake traffic: a bot clicks an ad, a compromised device generates a fraudulent lead, or a fake user profile completes a sign-up flow built purely to be monetized later. Seen from the ad tech side, fraud isn’t two separate problems split neatly between ‘advertising’ and ‘payments.’

It’s one criminal economy moving through whichever checkpoint is weakest. Ad platforms simply sit at an earlier checkpoint than payment providers, which means they often see the same bad actors before those actors ever reach a checkout page.

That’s the core argument for treating fraud prevention as a shared discipline rather than two parallel industries, and it’s the idea behind this joint piece from AdTech Holding and Nuvei.

What ad fraud actually looks like

Ad fraud comes in different variations, and each has a different relationship to the financial crime that follows it downstream:

• Bot traffic and click farms. Automated scripts or human-operated device farms simulate genuine engagement  – clicks, impressions, app installs – to drain advertiser budgets or manufacture fake performance data.
• Fraudulent lead generation. Fake or incentivized sign-ups are built to pass basic validation checks. These often feed directly into payment fraud: a fake account exists specifically to test stolen card details or absorb a promotional credit.
• Device and identity spoofing. Fraud rings mask device fingerprints, IP addresses, and user-agent strings to bypass detection filters and appear as unique, legitimate users.
• Domain and SDK spoofing. Bad actors misrepresent where an ad actually appeared, redirecting advertiser spend toward fraudulent inventory instead of real audiences.

The detail that matters most here is that several of these tactics rely on the exact same infrastructure – device farms, spoofed identities, scripted behavior – that later resurfaces in account takeover, promo abuse, and payment fraud. A bot network built to fake ad engagement rarely gets thrown away after one use. It gets repurposed.

How AdTech Holding detects and prevents it

In 2025 alone, PropellerAds — one of AdTech Holding’s flagship advertising platforms — banned 1,676 advertiser accounts for fraud-pattern violations – cloaking, confirmed fraud, fake identity, multi-accounting, carding, and scam landing pages – with cloaking as the single largest category, at roughly 78% of those bans. The first half of 2026 is already on a comparable pace.

Artificial Intelligence in AdTech: Trends and Predictions

As one example of scale: on a single vertical alone, PropellerAds’ real-time systems flag and redirect confirmed fraudulent traffic continuously – roughly 1 in every 35,000 impressions over a recent 30-day window. That’s a high-confidence redirect layer sitting on top of, not instead of, earlier pre-bid scoring and blocklist filtering further upstream.

Fraud on the ad tech side rarely looks dramatic in the moment. It’s a cloaked domain, a device farm running the same script a thousand times, an account that keeps coming back under a new name. What changes the economics for fraud rings isn’t catching one instance; it’s making the pattern expensive to repeat. That’s what real-time scoring and cross-referencing with partners like Nuvei actually buys us.’

— Farukh Rakhimov, Head of Finance Operations and Compliance Group, AdTech Holding

Traffic quality enforcement at scale depends on layering multiple types of defense, because no single signal catches everything on its own:

• Real-time traffic scoring, which evaluates clicks and impressions against behavioral, technical, and historical signals before advertiser spend is finalized – not after the fact.
• Device and IP reputation systems, cross-referencing traffic sources against known fraud patterns and continuously updated blocklists.
• Behavioral analysis, looking for patterns real humans don’t produce: impossible click speeds, unnatural session paths, or geographic and time zone mismatches.
• Post-click and conversion validation, checking whether ‘engaged’ traffic actually behaves like genuine users further down the funnel – which is exactly where overlap with a payment partner’s fraud signals becomes valuable.
• Alignment with industry verification standards, such as MRC/IAB invalid traffic (IVT) definitions and independent third-party verification, so fraud rates aren’t a metric platforms grade on their own homework.

AdTech Holding Project Update: ADEX Joins IAB

None of these methods work in isolation. A device that looks slightly suspicious on one signal but clean on the rest needs to be evaluated as a pattern, not a single red flag – which is the same logic payment risk teams apply to transactions.

The other half of the chain: fraud at the point of payment

If ad platforms are the earlier checkpoint, payment infrastructure is where the same fraud economy tries to cash out. Nuvei has built one of the world’s most connected payments infrastructures around that premise, connecting businesses to their customers in more than 200 markets, over 720 alternative payment methods and 150 currencies, all through one integration – with fraud and risk management running inside that same infrastructure rather than alongside it.

‘Businesses face substantial financial losses due to fraud, which can amount to billions of dollars annually.’

— Laura Miller, Chief Revenue Officer and Global Head of eCommerce, Nuvei, in an interview with PYMNTS 

Holding those losses down isn’t the job of one fraud check at the end of the flow. It’s built into a few concrete layers:

• Network tokenization. Replacing static card numbers with dynamic, scheme-issued tokens and one-time-use cryptograms means stolen card data has a shorter shelf life: tokens survive card reissuance and expiry, which improves authorization rates while shrinking fraud exposure and the merchant’s PCI scope.
• Regulatory-grade screening. Real-time sanctions and PEP screening, multi-language name matching, adverse media scoring, and perpetual KYC monitoring sit underneath every transaction, with automated SAR and STR workflows feeding regulator-specific reporting.
• Fraud thresholds tied to regulation, not just risk appetite. Under PSD2’s Strong Customer Authentication rules, Nuvei manages Transaction Risk Analysis exemptions for qualifying transactions – but only by holding fraud rates at the levels regulators require to qualify for that exemption in the first place. Compliance and fraud prevention aren’t separate workstreams here; the second is a precondition for the first.

None of this runs as a separate module bolted onto payment processing. Nuvei’s Payment Orchestration hub evaluates every transaction against risk, cost, and compliance criteria in the same real-time decision sequence, before choosing a route, retrying a failed attempt, or stepping up authentication.

Fraud scoring isn’t a checkpoint a transaction passes through; it’s one input the routing engine weighs alongside everything else, on every single transaction. 

The Future of KYC: How to Respond to New Fraud Threats in 2026

Nuvei has also held PCI DSS Level 1 certification, the highest tier of the standard, since 2007, validated annually through independent security audits. Merchants routing payments through Nuvei inherit that certification, meaning it materially reduces their own compliance burden instead of adding to it.

Where the two sides of the ecosystem meet

This is the part that makes a joint analysis more useful than two separate ones: fraud signals detected in advertising traffic often resurface, sometimes days or weeks later, as fraud signals in a payment flow.

A device flagged for bot-like ad engagement is a meaningfully higher-risk device when it shows up at checkout. A user acquired through a fraudulent lead campaign is statistically more likely to be involved in a chargeback dispute or promo abuse further downstream.

Right now, most of the industry treats these as separate detection systems that simply don’t talk to each other. In practice, for shared clients, AdTech Holding and Nuvei already compare notes at the data level – client information collected via API on our side is matched against Nuvei’s own records.

That said, this remains two parallel detection processes today, not a unified system – which is precisely the gap this partnership is pointing at.

This is where transaction-side expertise – the kind reflected in Nuvei’s work on chargeback fraud, dispute automation, and real-time risk scoring – becomes the natural counterpart to traffic-side fraud detection at the holding’s advertising platforms. The two data sets, viewed together, tell a more complete story than either does alone.

Why this partnership itself is the point

Fraud prevention runs on trust, and trust is hard to fake at scale. AdTech Holding and Nuvei didn’t choose each other by accident: both operate in categories – advertising and payments – where a single weak link in fraud controls becomes everyone’s liability.

A holding whose advertising platforms take ad fraud seriously and a payment provider that takes chargeback fraud seriously are, by definition, more compatible partners for clients who need both.

This piece is itself a small proof point of that: two companies willing to put their fraud posture in writing, side by side.

The systemic case

Ad fraud and payment fraud are both symptoms of the same underlying economics: fraud follows wherever verification is weakest, and the payoff is fastest. Solving it at only one layer – blocking bad clicks but not bad transactions, or vice versa – doesn’t eliminate the fraudulent actor. It just pushes them one step further down the funnel, into whichever system hasn’t caught up yet.

The more the ad tech and payments industries share pattern-level insight – not necessarily raw data, but a common understanding of what fraudulent behavior looks like at each stage – the harder it becomes for the same bad actors to keep exploiting the gap between ‘before the click’ and ‘after the charge.’

The post Fraud Without Borders: How Ad Tech and Payment Platforms Fight Financial Crime Together appeared first on AdTech Holding.

That shift matters more than any individual technique, because brand protection was built around the old economics. Legal-led takedown processes assume a small number of infringements worth pursuing individually. When generation is effectively free, and enforcement still runs at legal speed, the arithmetic stops working.

This piece covers three challenges that did not meaningfully exist before AI: impersonation at industrial volume, synthetic content that carries the brand’s likeness, and a new layer sitting between the brand and the customer where the model itself can send people to an attacker.

Key Takeaways:

• AI changed the economics of brand abuse rather than the categories. The defensive question is throughput.
• Netcraft’s research found that 34% of login URLs a large language model suggested for 50 well-known brands were not controlled by those brands, and roughly 29% pointed at domains that were unregistered or parked and therefore available to claim.
• Gartner reported in September 2025 that 62% of surveyed organizations had experienced a deepfake attack involving social engineering or automated process abuse in the preceding year.
• Defensive domain registration does not scale against hallucinated domains, because the variation space is unbounded and regenerates.
• The practical shift is organizational: brand protection behaves like a monitoring and response function, measured in time to detection and time to takedown.

What Actually Changed: The Economics

It is worth being precise here, because ‘AI changed everything’ is the kind of claim that sounds informative and is not.

The attack categories are largely stable. Domain spoofing, fake social profiles, counterfeit listings, phishing pages, and impersonation of named executives were all mature techniques before generative models were widely available. What AI removed was the labor cost at each step: writing convincing copy in the target’s voice, reproducing a visual identity, localizing into a dozen languages, and generating enough variation to survive pattern-based detection.

Remove that cost and two things follow: the volume of attempts rises, and the marginal attempt becomes worth making even when the expected return is small. A campaign that would not have justified a week of work justifies an afternoon, so brands that were previously too small to target profitably now get targeted.

The defensive consequence is that enforcement capacity becomes the binding constraint. A brand protection function that could handle forty cases a quarter is not failing when it handles forty; it is failing because the input queue now has four hundred.

Challenge One: Impersonation at Industrial Volume

The first challenge is straightforward to describe and unpleasant to manage. Clones, lookalike domains, fake profiles, and scam ads wearing the brand’s identity now appear faster than a manual process removes them.

Netcraft documented one version of this at scale, finding more than 17,000 AI-generated phishing pages hosted on a documentation platform and styled as legitimate product documentation and support hubs. The pages were clean, fast, and written in fluent product-marketing English.

That combination is the point: the volume is machine-scale, and the individual quality is high enough that a human reviewer cannot triage by looking. The consumer-side cost is measurable. The FTC reported that people lost $3.5 billion to imposter scams in 2025, a category that includes business and government impersonation. Not all of that traces to AI-generated infrastructure, and the FTC does not break it out that way. It does establish the scale of the surface that cheap generation is now feeding.

The shift most teams underestimate is what this does to prioritization: when the queue was small, every case got attention. When the queue is large, someone has to decide which infringements are worth enforcement, and that decision is now the job. 

How Programmatic Auctions Changed: New Bid Models, AI, and a Cleaner Supply Chain

Challenge Two: Synthetic Content That Wears the Brand

The second challenge is content that carries the brand’s likeness without touching the brand’s infrastructure at all. Deepfake video and audio of named executives, AI-generated product reviews, and synthetic influencers promoting counterfeits all sit outside the traditional brand protection perimeter –  on a social platform, inside a messaging app, or in a video call.

Gartner’s September 2025 survey found that 62% of the organizations it surveyed had experienced a deepfake attack involving social engineering or the exploitation of automated processes in the prior twelve months. As an exposure signal, it is high.

The part that is genuinely hard is that detection and enforcement live with third parties. A brand can prove a video is fabricated. It cannot remove the video, which means response time is bounded by a platform’s review process rather than by the brand’s own capability. Building relationships and reporting paths with the platforms where the brand’s audience actually is turns out to matter more than any detection tooling, because detection without a route to removal produces a well-documented problem.

Challenge Three: The Model Sitting Between You and Your Customer

The third challenge is the one with no pre-AI equivalent, and it is where the interesting failure lives.

When a customer asks an assistant where to log in to a brand, the assistant answers with a URL. Netcraft tested this directly: across natural-language login queries for 50 well-known brands, the model returned 131 unique hostnames, and 34% of them were not controlled by the brand in question. Roughly 29% pointed at domains that were unregistered, parked, or otherwise inactive. About 5% pointed at unrelated legitimate businesses. In one live case the researchers documented, an AI search product answered a Wells Fargo login query with a phishing page hosted on a free site builder, ranked above the real domain.

Sit with the second number for a moment, because it is the one that changes the threat model. An unregistered domain that a widely used model confidently recommends is not a mistake sitting harmlessly in an output. It is a lure with pre-attached traffic, available to anyone willing to spend registration fees.

Data Pipeline Security in High-Volume Ad Impression Processing

That inverts the economics of phishing. The classic problem for an attacker was distribution: build a convincing fake, then find a way to get people in front of it through email, ads, or search manipulation. Traffic acquisition was the expensive, detectable step. When a model reliably points at a domain that nobody owns, the attacker skips that step entirely. The traffic arrives because a trusted interface sent it, and the interface will keep sending it, because the behavior producing the recommendation has not changed.

There is a second-order version documented in the same research: attackers seeding fake developer resources, repositories, and tutorials so that AI coding assistants recommend a malicious API. In that case, the poisoned code made it into real projects, some of which appear to have been built with AI coding tools, which feeds the pattern back into the next round of training data.

Why Defensive Domain Registration Stopped Working

The obvious response to hallucinated domains is to register them. It does not hold up.

Netcraft’s own conclusion on this is blunt, and the reasoning is sound: the variations are effectively unbounded, and models will produce new ones. Defensive registration is a finite budget applied to an infinite set. It also degrades in a specific way that is easy to miss. Buying the fifty most likely variants raises the attacker’s search cost slightly and does nothing about the fifty-first, while creating an internal impression that the problem is handled.

Registration still has a role for the small number of variants that are genuinely high-traffic and predictable, particularly exact-match typos of the primary domain. Treating it as the strategy rather than as one narrow tactic is what fails.

What works better is unglamorous: monitoring for newly registered domains that resemble the brand, watching for the specific hallucinated variants that models are currently producing, and having a takedown route that runs in hours rather than weeks. That is a detection and response capability, which is a different organizational thing from a trademark portfolio.

The Speed Problem Nobody Solves With Tooling

Every part of this comes back to one asymmetry: generation runs in minutes, and enforcement runs at the speed of whoever has to approve it.

A typical takedown path involves identifying the infringement, confirming it internally, drafting a notice, sending it to a registrar or platform, and waiting. Each of those steps is reasonable in isolation. Together they produce a response measured in days at best, against an attack that was assembled in an afternoon and may have already collected what it came for.

Compressing that is mostly a permissions question rather than a technology question. Who can authorize a takedown without a legal review, for which categories of infringement, up to what threshold? Brands that have answered those questions in advance respond in hours. Brands that have not will discover the answer during an incident, which is the expensive time to discover it.

This is also where the limit sits: faster response reduces exposure duration. It does not prevent the attack, and it does not recover the customers who were caught in the window before detection. Any framing that presents monitoring as prevention is overselling it.

What Brand Protection Looks Like as a Security Function

The change worth making is less about tools than about where the function sits and what it is measured on.

A legal-led brand protection function measures cases filed, notices sent, and domains recovered. Those are outputs of a process designed for a small, high-value caseload. A security-led function measures time to detection and time to removal, treats the infringement queue as a monitoring surface, and accepts that most items will be handled by rule rather than by judgment.

That reframing changes a few concrete things:

• Triage criteria get written down, so that the team is not re-deciding priority per case. 
• Takedown authority gets delegated for defined categories. 
• Monitoring extends past domains to the surfaces where synthetic content actually appears, including the AI interfaces customers now use as a first stop. 
• Detection signals get treated as probabilistic inputs to a decision rather than as verdicts.

What Detection Can and Cannot Confirm

A few limits are worth stating plainly, because vendor material in this space tends to blur them.

• Deepfake detection is probabilistic and adversarial. Detectors score likelihood, not truth, and they degrade as generation models improve. A detector that performs well on today’s outputs is making a claim about today’s outputs. Human review stays in the loop for anything consequential, and any tool presented as a binary authenticity verdict should be treated with suspicion.

• Monitoring coverage is partial by construction. A monitoring service sees the surfaces it has access to. Closed messaging platforms, private groups, and regional apps outside its coverage are blind spots, and a clean report from a monitoring vendor means nothing was found in the monitored set rather than that nothing exists.

• Takedown success rates vary enormously by platform and jurisdiction, and vendors quoting a single global rate are averaging across conditions that do not resemble each other. The number that matters for a specific brand is the rate on the specific platforms where its audience lives.

FAQ

What are the main AI brand protection challenges in 2026?

Three that did not previously exist in this form: impersonation produced at machine volume, synthetic content carrying executive or brand likeness on third-party platforms, and AI assistants directing customers to domains the brand does not control. The underlying change is cost, which turns a manageable caseload into a throughput problem.

Can we just register the domains AI models hallucinate?

Not as a strategy. The set of plausible variants is unbounded and regenerates as models change. Defensive registration is worth it for a small number of high-traffic exact-match typos and is not worth treating as coverage.

How do we find out what AI assistants say about our brand?

Query them directly, from a clean session, using the phrasings a customer would use: where to log in, where to get support, where to download the app. Repeat across the assistants your audience actually uses and across several phrasings. This is a manual check that most teams have never run.

Is a deepfake detection tool worth buying?

It depends on what you expect from it. Detectors give a probability, not a verdict, and their performance moves as generation improves. They are useful as a triage input inside a process that includes human review. They are not useful as an authenticity guarantee.

Who should own brand protection now?

Wherever it reports, it needs to operate like a monitoring and response function: measured on time to detection and time to removal, with pre-delegated takedown authority for defined categories. Legal ownership without delegated response authority produces the speed problem described above.

Wrapping Up

The uncomfortable part of this is that none of the three challenges are solved by working harder at the old model. Filing more notices does not close a gap created by generation cost falling to near zero, and buying more domains does not close a gap created by an unbounded variation space.

What does change the outcome is response time, and response time is mostly a set of decisions made before anything happens. So the concrete thing to take from this: find out what the assistants your customers use say about your brand today, and find out who in your organization can authorize a takedown at 9 pm on a Friday without a meeting. Those two answers will tell you more about your actual exposure than any threat report will.

The post AI Brand Protection Challenges: What Changed When Faking a Brand Got Cheap appeared first on AdTech Holding.

That second effect used to be an argument, but it is now closer to a measurement. In November 2025, the ANA added Brand Safety and Suitability metrics to its Q3 2025 Programmatic Transparency Benchmark, reporting that 99.1% of programmatic spend ran in low-risk environments. That is a genuinely good number, and it also quietly relocates the problem. When almost all inventory clears the safety bar, the damage that remains is happening somewhere the safety bar does not look.

This piece covers four buying decisions that cost brand equity without ever showing up as a policy violation: what sits next to the ad, where cheap impressions actually come from, how often the same person sees the same creative, and whether the creative belongs on the surface it landed on. 

Key Takeaways:

Brand safety in media buying is largely governed by campaign configuration: exclusions, frequency rules, inventory selection, and creative routing. Those are controllable inputs.

• Made for Advertising (MFA) inventory is the clearest example of the gap between safe and suitable. The joint trade-group definition notes MFA sites typically show good viewability and low invalid traffic, which means a verification stack can mark them clean while the brand still sits in a low-value context. What defines MFA is the site’s purpose.

• Frequency damage is usually a measurement failure before it is a creative failure. Caps are enforced within the systems that set them, and a user reached through several paths can exceed the intended ceiling without any single system registering it.

• Creative mismatch reads as a media quality problem in reporting, which sends teams to fix the wrong layer.

• The buyers who avoid most of this are making fewer, tighter inventory decisions and reviewing them on a schedule.

Why Brand Safety in Media Buying Is a Buying Problem

The phrase ‘brand safety’ carries a legacy meaning: keep the ad away from violence, hate speech, and adjacent categories nobody wants to fund. That layer is now largely automated. Category filters that block obvious unsafe content run by default on most buying platforms, and the ANA benchmark figure above reflects how well that baseline works at scale.

What the baseline does not cover is suitability, which is the harder question of whether a specific environment fits a specific brand at a specific moment. The Brand Safety Institute’s framework separates the two deliberately: the floor is the universal set of content nobody should advertise against, while suitability is brand-specific and sits above it. A news site covering a disaster is not unsafe, but it may still be the wrong place for a cheerful product launch.

Adjacency: What the Reader Carries From the Page to Your Ad

Readers do not evaluate an ad in isolation – they evaluate it inside whatever they were already feeling when it appeared. An ad served next to a distressing article inherits some of that distress, and the association attaches to the brand rather than to the page. This is why suitability cannot be solved with a single global exclusion list. The same publisher can be the right environment on Tuesday and the wrong one on Wednesday, depending on what is on the page. Keyword-level and topic-level controls exist for exactly this reason, and they are the part of the setup most likely to be configured once at launch and never revisited. 

Open Web vs. Walled Gardens: Where Is AdTech Headed

The practical version of the problem is narrower than the theoretical one. Most brands do not need a sophisticated sentiment model. They need someone to decide, before launch, which three or four topics genuinely do not work for this campaign, and then to check quarterly whether that list still matches what the brand is doing. Teams that skip the second half end up with exclusion lists that describe a campaign from two years ago.

When Price Is the Only Constraint

A bid strategy optimized purely for low cost per thousand impressions will find low cost. The question is what else it finds on the way there.

Two things get collapsed here that are worth keeping apart. A low CPM is a price. A low-value environment is a context. They correlate often enough that the industry uses one as a proxy for the other, but they are not the same fact, and treating them as one produces a conclusion that does not hold: that the way out is to pay more. Plenty of inventory clears at a low CPM for reasons that have nothing to do with quality – format, geography, device mix, or simply a shorter supply path with fewer intermediaries taking a margin. Paying a higher CPM into an unconstrained auction buys more expensive drift, not less of it. What creates the drift is that price ends up as the only constraint in the auction. A strategy with a ceiling on cost and a floor on context behaves differently from one with a ceiling on cost alone, at identical CPMs.

The clearest illustration of what an unconstrained auction finds is MFA inventory. In September 2023, the ANA, 4A’s, WFA, and ISBA published a joint definition of Made for Advertising websites: sites built primarily to buy and sell advertising inventory, typically carrying low-quality content and heavy ad density. The detail that matters for buyers is in the same definition. MFA sites generally show high measurability, good viewability, and low levels of invalid traffic, and they usually sit in brand-safe content categories.

Read that again from the point of view of a verification dashboard:

• Viewable: yes;
• Measurable: yes;
• Invalid traffic: low;
• Content category: safe.

Every signal the standard stack checks comes back green, because MFA inventory is engineered to pass those checks. The thing that is wrong with the placement is not any single measured attribute: it’s the environment as a whole, and no individual metric captures it. 

The good news is that this is getting caught. The ANA’s Q3 2025 benchmark we mentioned before put MFA exposure at 0.39% of spend, roughly half the previous quarter’s level, which is a meaningful drop from the double-digit percentages of impressions the earlier ANA work reported. The less comfortable news is why it took a coordinated industry effort with log-level data to find something that every viewability report had already marked as fine. The controllable variable in all of this is not the CPM. It is whether any suitability constraint is competing with the price constraint at the moment of the bid. When nothing is, the auction resolves in one direction, thousands of times per second, and does so correctly by the only rule it was given.

Frequency: When Repetition Stops Building Recognition

Frequency is the scenario where the failure is most visible to the audience and least visible in reporting.

The mechanism is well understood. Repeated exposure builds recognition up to a point, then continues past it into irritation, and irritation attaches to the brand rather than to the placement. Where teams go wrong is assuming the cap they set is the ceiling the user experiences.

A frequency cap is enforced inside the system that holds it. If a campaign runs through more than one buying path, each path enforces its own cap against its own view of the user. The same person reached through two paths can see the creative twice as often as intended, and neither system reports an error, because neither system exceeded its own limit. Identity fragmentation makes this worse rather than better: the less reliably a user is recognized across environments, the more likely they are to be counted as several different people, each with a fresh allowance.

Creative Mismatch: The Failure That Looks Like a Media Problem

The fourth scenario is the one most likely to be misdiagnosed. A creative built for one surface and served on another performs badly, and the reporting attributes the result to the inventory.

A message written for a considered, long-attention environment will underperform in a fast, high-turnover one. It is a statement about fit, and the IAB’s attention measurement guidelines exist because the industry needed a common vocabulary for exactly this distinction rather than treating every impression as equivalent. The brand cost is subtle. A creative that lands wrong does not just fail to convert but it teaches the viewer something slightly off about what the brand is, and it does so at whatever scale the campaign is running. Then the team sees weak numbers, blames the placement, adds the source to a blocklist, and repeats the mismatch somewhere else.

Cyber Threat Intelligence in the AdTech Product Lifecycle

What makes this hard to catch is that the fix and the misdiagnosis produce similar short-term data. Cutting the source improves the average. So does fixing the creative. Only one of them is repeatable.

Where the Controls Actually Sit

Two buying models are in play here, and mixing up their control surfaces is a common source of wasted effort.

On transparent programmatic paths, where a buyer sees individual domains and apps, the controls are inclusion lists, domain and app exclusions, supply path choices, and pre-bid category filtering.

On performance networks, which sell against zones and traffic segments rather than named placements, the equivalent controls are zone and subzone exclusions, vertical and format selection, audience tier settings, and the network’s own quality framework. Advice written for one model does not transfer cleanly to the other, and a buyer applying transparent-programmatic tactics on a network path will conclude, incorrectly, that the controls do not exist.

Ad Tech Security for Brands and Advertisers: A Practical Checklist

There is also a layer of control that sits upstream of both, and buyers tend to treat it as invisible. By the time inventory reaches a bid request, the exchange or network has already made decisions about it: which publishers were admitted and what they had to document, whether the seller declares itself in sellers.json so the path can be audited against the publisher’s ads.txt, what monitoring runs post-onboarding, and what threshold removes a zone or a domain rather than flagging it. 

On a network path, the artifacts are different rather than absent: what a publisher had to document to be admitted, whether the network is itself the accountable seller of record rather than one hop in a chain, and what behaviour pulls a zone out of rotation without a buyer having to ask. Those are answerable questions, and a supplier who cannot answer them is telling you something either way.

Those decisions determine the shape of the pool a buyer’s own exclusion list is filtering. The list is the last filter, and it cannot recover quality that was never admitted.

What holds across both is the shape of the routine:

• Define suitability before launch, in writing, at the level of three or four specific topics or environments that do not work for this campaign;
• Set frequency intent as a number the team agrees on, then verify what is actually being enforced rather than what was requested;
• Consolidate buying paths where the same audience is reachable through several, because every additional path is another cap that enforces independently;
• Treat the supply path as part of the configuration: an undeclared or unnecessarily long path is a quality signal before any placement-level data arrives;
• Review exclusions on a fixed schedule instead of after an incident;
• Route creative by surface, and keep at least one variant per major surface type rather than one universal asset.

None of that is expensive. All of it is the kind of work that gets postponed when a campaign is performing acceptably.

FAQ

What does brand safety mean in media buying specifically?

It covers two layers. The floor is the universal exclusion set: content categories no advertiser should fund, which most platforms filter by default. Suitability is the brand-specific layer above it, covering environments that are permitted but wrong for a particular campaign, product, or moment.

How do I actually tell MFA inventory apart from cheap inventory?

By intent. An MFA site exists in order to arbitrage ad inventory; the content is there to justify the page. Heavy ad density and low prices are things MFA sites usually have, but they are not what makes a site MFA – the same two symptoms describe a great deal of legitimate supply, including free-to-read publishers, mobile games, and utility apps that are entirely reasonable environments for most brands. A screen that flags density or CPM alone will flag all of them and still miss a well-built MFA site. The question that separates the two is simpler than most detection heuristics: if you removed the advertising, would there be any reason for this page to exist? For a game or a utility app, obviously yes. For MFA, there is nothing underneath.

How do I know if frequency is hurting my campaign?

Look for creative performance decaying faster than impression volume explains, alongside rising cost per action on a stable audience. Frequency reports from a single buying path will not show the problem if the same user is being reached through more than one path.

Can verification vendors solve this for me?

They can confirm what they measure, which is a real and necessary layer. They cannot define suitability for your brand, and they do not report on creative-to-surface fit. Those decisions stay with the buying team.

Does this apply differently on ad networks versus programmatic?

The principles are identical; the control surfaces differ. Networks give you zone, subzone, vertical, format, and audience tier controls plus their published quality framework. Transparent programmatic paths give you domain and app level lists and supply path choices. Use the controls the model actually exposes rather than the ones an article assumed you had.

Wrapping Up

The useful reframe is this: every campaign has a brand safety configuration, including the campaigns where nobody configured one. Defaults are a decision. A campaign optimizing purely on cost has decided that price outranks context, and it will act on that decision thousands of times per second without asking again.

So the question worth taking into your next campaign review is not whether your verification reports are clean. They probably are. It is narrower and more uncomfortable: which three environments would genuinely embarrass this brand, are they actually excluded in the platform right now, and when did someone last open that list and read it? Most teams cannot answer the third part, and that gap is where the equity goes.

The post Brand Safety in Media Buying: How Careless Buying Damages Brand Equity appeared first on AdTech Holding.

The problem is that viewability became a floor, and the industry started treating it as a ceiling. A viewable impression in a fast-scrolling social feed, with the sound off and three other content pieces competing for attention, is not the same as a viewable impression on a high-quality editorial page where someone is reading. Both count as “viewable” under the standard.

From a buying perspective, what teams see in practice is campaigns hitting 70-80% viewability while brand recall numbers stay flat. The metric confirmed delivery. It said nothing about whether the ad actually landed.

That gap is what attention metrics are designed to close.

Key Takeaways

• Viewability tells you an ad could have been seen. Attention metrics try to measure whether it actually was.
• IAB and the Media Rating Council (MRC) released formal Attention Measurement Guidelines in November 2025, the first industry-wide standard for this space.
• Those guidelines define attention as a complementary signal, not a replacement for CTR, viewability, or conversion metrics.
• For brand campaigns, attention data improves the prediction of recall and lift. For performance campaigns, CTR and CPA remain the right primary signals.
• The biggest remaining challenge is vendor fragmentation: attention scores are not yet reliably comparable across measurement providers.

What Attention Metrics Actually Measure

Attention metrics shift the question from “was the ad on screen?” to “did someone likely notice it?”

The signals that feed into attention measurement vary by vendor and method, but the core categories are:

• Active dwell time: How long the ad was in genuine view, not just technically on-screen. An ad scrolled past in 200 milliseconds is not the same as one held in view for 8 seconds.
• Audibility signals: For video, whether the sound was on and at what level.
• Screen position and competition: Whether the ad was placed where users look, or buried under other elements.
• Interaction signals: Hover behavior, cursor proximity, or scroll deceleration near the ad unit.
• Eye-tracking data: In panel-based measurement, the user’s gaze actually fell on the page.

No single signal is sufficient on its own. The vendors building attention products (Adelaide, IAS, DoubleVerify, Lumen Research, among others) combine proxy signals from publisher environments with panel-based calibration data to produce an attention score. The quality of the calibration and the transparency of the methodology differ considerably by provider.

The table below compares what each metric actually covers and when to use it as a primary signal.

Table: Viewability vs. Attention vs. CTR

The Evidence: What the Research Shows

The case for attention metrics is stronger than most new measurement categories can offer at this stage.

Predicting User Behavior: Challenges and Opportunities

A 2024 study by Lumen Research and Ebiquity covering six major media types found a near-perfect correlation between attentive minutes per thousand impressions and incremental profit across those channels. DoubleVerify reported in its annual Global Insights Report that adoption of its DV Authentic Attention tripled in adoption over the past yeartripled year-over-year among its advertiser base. Adelaide, one of the leading attention measurement vendors, reports that campaigns optimized toward attention signals delivered an average of 41% higher brand lift and 55% improvement in lower-funnel outcomes compared to viewability-optimized campaigns. These are vendor-reported figures and should be treated as directional benchmarks, not as independently verified numbers.

The directional finding across multiple independent studies is consistent: attention data predicts brand recall and awareness better than viewability alone. The finding for direct-response performance campaigns is less settled. Research mostly shows attention’s strength in brand and awareness contexts, where there is no direct behavioral signal to rely on.

How Attention Gets Measured in Practice

There are four main approaches, and they are not interchangeable.

1. Panel-based eye-tracking is the most direct: recruit participants, use eye-tracking technology, and observe exactly where the gaze falls. Accurate, but expensive and hard to scale. Results represent a sample, not your actual campaign audience.

2. Proxy signal models use publisher data (viewability signals, audio state, scroll depth, cursor proximity) to estimate attention without direct observation. These scale across the open web but depend on model quality and cannot be directly validated against what any individual user actually noticed.

3. Physiological measurement (biometrics, galvanic skin response, facial coding) is used in research contexts, mostly for creative testing and format evaluation. It is not a live campaign measurement tool.

4. Survey-based methods measure recall and recognition after exposure. Useful for brand impact studies, but introduces a gap between the moment of exposure and the moment of measurement.

Most attention products available in programmatic environments today use proxy signal models, often calibrated against panel data. That calibration gap matters when you are comparing scores across vendors or making buy decisions based on attention scores from a source you have not validated.

AdTech Myths That Still Exist in 2026

The IAB/MRC Standards Moment: November 2025

For most of the attention measurement’s short history, there was no standard. Each vendor defined attention differently, used different signals, and reported scores that could not be meaningfully compared.

That changed, at least partially, in November 2025 when the IAB and the Media Rating Council published the Attention Measurement Guidelines, developed with input from more than 200 experts across brands, agencies, publishers, and measurement companies. The guidelines define core terminology, methodological requirements, and disclosure expectations across four measurement approaches. They also form the basis for MRC accreditation audits of attention measurement services.

This is a meaningful step. It does not eliminate vendor fragmentation overnight, but it gives buyers a framework to evaluate providers against shared criteria rather than comparing proprietary systems with no common reference point.

The guidelines also include a clarification that gets lost in much of the industry coverage: attention is explicitly positioned as a complementary signal, not a replacement for delivery or outcome metrics. The IAB/MRC framing is careful here: attention helps you understand whether an exposure likely translated into engagement, but it is not an outcome measure on its own.

Where Attention Metrics Fall Short

Any honest reading of the space has to include the limitations, and they are real.

• Measurement inconsistency across vendors is still a problem. Even with the November 2025 guidelines in place, different vendors produce different scores for the same inventory. Until MRC accreditation is widely adopted and buyers can evaluate providers against the same criteria, attention data is most reliable when used within a single vendor’s system over time.
• Format coverage is uneven. Attention measurement for display and video is relatively mature. For audio, digital out-of-home, and connected TV, the methods are less developed, and the calibration data is thinner. A mixed-media buy means accepting that some channels are measured well and others are not.
• Panel data does not represent your audience. Panel sizes are in the thousands, not millions. The calibration is useful, but it is a model of attention behavior, not a direct measurement of your specific audience on your specific placement.
• Close attention does not automatically mean high conversion. An attentive impression from someone with no interest in your product is still a wasted impression. Attention gets you closer to measuring exposure quality, but it does not replace audience targeting or offer relevance.

What teams optimizing across programmatic environments usually underestimate is the distance between an attention score and an outcome. Attention is a signal that the ad had a real chance to work. Whether it worked depends on everything that comes after the exposure: the message, the offer, the creative, the landing experience.

Attention vs. CTR: Not a Competition

CTR and attention metrics measure entirely different things, for different campaign types. Treating them as rivals misframes the question.

CTR is a direct signal for direct-response campaigns. If the campaign goal is a click and a conversion, CTR is your primary signal. Attention data adds limited predictive value there. Your conversion metrics already tell you what you need to know.

Where attention metrics earn their place is in brand and awareness campaigns, where CTR is a poor KPI. A high-quality video ad on a premium editorial page may drive very low CTR and very high brand recall. CTR would flag that campaign as underperforming. Attention data would tell you it is working.

The practical implication for product and media teams: attention metrics and CTR belong in different parts of your measurement framework. They answer different questions.

So Will Attention Replace Traditional Metrics? A Direct Answer

No, and the organizations that built the industry standards say so clearly.

The IAB and MRC’s November 2025 guidelines describe attention as “a complementary signal that, when combined with delivery and outcome metrics, helps marketers understand how media and creative influence business results.” 

Artificial Intelligence in AdTech: Trends and Predictions

Some of the industry coverage has framed attention metrics as the next viewability, the single number the ecosystem will eventually converge on. That is not what the evidence or the standards support. What the evidence supports is that attention data, applied alongside existing metrics, improves your ability to evaluate inventory quality and predict brand outcomes for campaigns where no direct behavioral signal exists.

For advertisers running brand campaigns, attention metrics have earned a place in your measurement stack. The November 2025 standards give you a more credible framework for evaluating vendors than existed a year earlier. For performance-focused advertisers: attention data is useful for assessing inventory quality, but your conversion data still drives optimization.

The hype-or-future framing presents a false choice: attention metrics are neither a revolution nor a fad. They are a measurable improvement to a specific part of the measurement problem, applied to a specific category of campaigns.

What Product and Media Teams Should Do Now

Ask your current measurement vendor or DSP whether they surface attention data, and if so, which methodology they use and whether they are pursuing MRC accreditation under the November 2025 guidelines. That question alone filters out vendors whose attention products are mostly marketing language.

If you run brand campaigns, run a parallel test: one flight optimized to viewability as normal, one optimized to attention score. Compare brand recall outcomes. The test will tell you more than any benchmark report.

If you evaluate new inventory, use attention data as a quality filter rather than a performance signal. High attention scores on an unfamiliar placement are a useful indicator that the placement is worth the risk. Low attention scores on the inventory you assumed was premium are a useful flag to look closer.

Do not replace CTR or conversion tracking with attention as your primary KPI. Attention is a signal, not a strategy.

The Hidden Cost of Overexposure: A New Look at Frequency Capping

FAQ

Is attention measurement the same as viewability?

No. Viewability confirms that an ad had the opportunity to be seen: 50% of pixels on screen for at least one second. Attention measurement goes further, using behavioral signals and, in some cases, panel-based eye-tracking data to estimate whether the ad was actually noticed. The two are related but measure different things.

Which campaigns benefit most from attention metrics?

Brand awareness and recall campaigns benefit most. For direct-response campaigns where CTR and conversion rate are the primary signals, attention data adds limited predictive value. It is most useful as an inventory quality filter regardless of campaign type, but its strongest case is in contexts where no direct behavioral signal exists.

Are attention scores comparable across vendors?

Not reliably, as of mid-2026. The IAB/MRC November 2025 guidelines provide a standardized framework and the basis for MRC accreditation, which will improve comparability over time. Until accreditation is widely adopted, treat attention scores from different vendors as directional within each vendor’s own system, not as directly comparable numbers.

Will attention metrics eventually replace viewability?

The IAB and MRC explicitly position attention as a complementary signal, not a replacement for delivery metrics. The more likely trajectory is that attention data becomes a standard additional layer in measurement frameworks for brand campaigns, rather than displacing existing metrics.

What is the simplest way to start testing attention data?

Most major verification vendors and larger DSPs now offer attention measurement as part of their standard toolset. Starting with proxy-signal-based attention scores costs nothing extra if you already use their platform. Panel-based measurement (such as Lumen Research) requires a separate engagement but provides more direct observation data.

Attention Data Is a Better Question, Not a Final Answer

The case for attention metrics is not that they solve the measurement problem. It’s that they let you ask a better version of the question. Viewability asks: did this ad load where someone might have seen it? Attention asks: did someone likely notice it?

That shift is meaningful, with real research behind it and a formal industry framework to support it now. The limitation is that attention still tells you about the exposure, not about what happened after. Whether a noticed ad becomes a recalled brand, a considered product, or a conversion depends on everything the attention metric does not measure.

Use it where it improves your predictions. Know where it does not.

The post Attention Metrics in Advertising: Hype or the Future of Measurement? appeared first on AdTech Holding.

This piece covers the specific set of shifts that changed how auctions actually behave: the move to first-price bidding, the rise of AI-driven optimization, the consolidation of supply paths, and the transparency push that has pulled industry heavyweights into a formal governance structure.

Key Takeaways:

• First-price auctions are now the standard across most major exchanges, which has changed what it takes to bid efficiently.
• Bid shading – algorithmically reducing bids toward the likely clearing price – became essential once first-price became dominant, and AI is what makes it work at scale.
• Supply path optimization (SPO) has moved from a cost-cutting exercise to a quality discipline: industry research shows the average DSP now works with around 12 SSP partners instead of 18.
• AI does not just help buyers bid. In 2026, it will make thousands of real-time decisions per second that human teams could not execute manually, even if they wanted to.
• Industry bodies are responding to scale and opacity: IAB Tech Lab launched a Programmatic Governance Council in April 2026, with Dentsu, Omnicom, WPP, Disney, and a dozen others at the table.

What Actually Changed, and Why It Took Time to Show Up in Results

Programmatic advertising has been “evolving” as long as it has existed. But the past two or three years produced genuine structural changes, not incremental feature updates. Three things happened in rough sequence: most major exchanges switched from second-price to first-price auctions; AI moved from an optimization layer to the primary bidding engine; and buyers responded to efficiency pressure by consolidating their supply paths.

Each shift affected the others. The move to first-price required smarter bidding, which accelerated AI adoption. AI adoption created efficiency pressure that made bloated supply paths more visibly wasteful. SPO pressure made supply chain transparency more urgent. These changes are easier to understand separately, but they reinforce each other in practice.

First-Price Auctions Are Now the Standard: What That Means for What You Pay

In a second-price auction, the winning bidder pays one cent above the second-highest bid, not their own bid. The rational strategy is simple: bid your actual value, and let the auction settle the price. Google Ad Manager and most major exchanges ran this way for years.

In a first-price auction, the winner pays exactly what they bid. If you bid $8 CPM (cost per thousand impressions) and win, you pay $8. This sounds like a minor mechanical change, but it is not. It changes the entire logic of how a buyer should set bids. In second-price, you could bid aggressively because overbidding was self-correcting – the auction handled the pricing. In first-price, overbidding costs real money. A buyer who bids $8 when the clearing price is $4.50 overpaid by nearly double. At the campaign scale, that inefficiency adds up fast.

The shift also eliminated a particular kind of hidden arbitrage. SSPs (Supply-Side Platforms, the technology layer that connects publishers to buyer demand) running second-price auctions had been using bid floors in ways that generated margin for the exchange without buyers fully understanding the mechanism. First-price made the price you pay visible. It did not automatically make it fair, but it made it legible.

The practical consequence for buyers: bidding strategy became a competitive skill again. Teams that figured out how to estimate the right bid started seeing meaningfully better cost-per-win outcomes. Most did it with AI.

Data Pipeline Security in High-Volume Ad Impression Processing

Bid Shading: The Fix That Kept Buyers from Overpaying

Bid shading is the practice of submitting a bid below your maximum willingness to pay, based on a model that estimates what the clearing price is likely to be. The goal is to win the impression at a price closer to market value rather than at your ceiling.

In second-price auctions, bid shading was mostly irrelevant. In the first-price, it became the difference between efficient and expensive spending.

The challenge is that you need a lot of data to shade well. Clearing prices vary by placement, audience segment, time of day, device type, and dozens of other factors. A human buyer setting bid adjustments manually has no realistic way to track all of those signals. A machine learning model can.

Most DSPs (Demand-Side Platforms, the buying interfaces that let advertisers bid on inventory across exchanges) now include some form of bid shading as part of their standard bidding logic. It runs automatically, evaluating historical win rates and clearing prices to adjust bids on every impression. The buyer sets the target – a CPA (Cost Per Acquisition) goal, a CPM ceiling, and an ROAS target – and the AI manages the shading.

What this means operationally is that buyers who have not reviewed their bidding model configuration since their exchange moved to first-price may be spending more than necessary. The tool is there. The question is whether the campaign objective is configured in a way that lets the model optimize toward something meaningful.

Supply Path Optimization: Fewer Hops, Better Inventory

Before SPO became a buying-side discipline, a single impression request could travel through three or four intermediaries before a DSP saw it. The same inventory would often appear across multiple SSPs, meaning a buyer’s DSP was bidding against duplicate requests for the same placement. It inflated apparent competition and made pricing harder to read.

SPO addresses this by having buyers evaluate their supply paths – the routes from a DSP through SSPs and exchanges to publisher inventory – and consolidate around the ones that deliver clean inventory, transparent pricing, and measurable value. According to industry research, the average number of SSP partners per DSP dropped from around 18 to around 12 in two years, a significant consolidation in how tightly the supply chain is managed.

The initial driver was cost. Fewer hops means lower fees. But the practice evolved into something broader. SPO in 2026 is as much about inventory quality and accountability as it is about intermediary reduction. Buyers are asking: which supply paths produce outcomes, not just clicks? Which SSPs provide enough data to evaluate what you are actually buying? Which ones are transparent about auction dynamics?

For performance networks operating outside the open exchange, SPO looks less like partner audits and more like zone and format-level exclusion logic. The principle is the same: direct spend toward inventory that performs, and cut the paths that do not.

How AI Took Over Real-Time Bidding

The arithmetic of programmatic bidding makes human decision-making inadequate at scale. A campaign running across display, video, and push notifications in five markets will process several million bid requests on a typical working day. Each one requires a decision in under 200 milliseconds. The number of variables in play – placement, audience signal, competitive pressure, time of day, creative performance history – runs into the hundreds per impression.

AI handles this not by following rules but by recognizing patterns. Models trained on historical campaign data learn which combinations of signals predict a conversion, then adjust bids dynamically to favor those combinations. The buyer sets the objective. The AI figures out how to hit it.

AdTech Holding at ML Conference Serbia: How We Automate AdTech from the Inside

Among marketers already using AI, 77% employ it for campaign management automation – a signal of how central it has become to day-to-day buying operations. These numbers reflect a practical reality: teams that tried to manage first-price auction bidding manually through bid adjustments and rules found themselves consistently outperformed by campaigns where the bidding model had autonomy to optimize.

From a buying-side perspective, what we see most often is that the hardest transition is not technical. It is organizational. Buyers who spent years building manual optimization workflows often resist handing that control to a model, even when the model is demonstrably better. The campaigns that perform best in 2026 are the ones where the buyer’s job shifted: less bid management, more objective-setting and data quality work.

AI bidding is not without limits. It needs data to learn from, which means it underperforms on new campaigns before it has enough conversion history. It optimizes toward what you measure, which means poorly defined objectives produce poor outcomes. And it does not catch fraud on its own – that requires a separate detection layer.

Agentic Advertising: When the Machine Starts Negotiating

Beyond automated bidding, a newer development is worth watching: agentic advertising, where AI systems do not just execute decisions but make them. This includes budget reallocation across channels, creative selection, audience segment expansion, and, in early implementations, negotiation of programmatic guaranteed and preferred deal terms via API.

IAB Tech Lab formalized its work on this in 2026, publishing standards for agentic advertising signals and launching an Agent Registry – a tool that lets buyers and sellers register and authenticate the AI agents operating in their programmatic stack. The concern behind the registry is straightforward: as AI agents become more autonomous, it matters that both sides of a transaction can verify who – or what – is acting on behalf of a buyer or publisher.

This is early-stage infrastructure, but it reflects a real directional shift. The programmatic supply chain is becoming less a set of human-operated platforms and more a set of machine-to-machine interactions, with humans setting objectives and reviewing outcomes rather than managing individual transactions.

The Hidden Cost of Overexposure: A New Look at Frequency Capping

Why the Whole Industry Is Talking About Transparency Right Now

In April 2026, IAB Tech Lab launched the Programmatic Governance Council, a formal industry body with Dentsu, Omnicom Media Group, WPP, Disney, Magnite, PubMatic, The Trade Desk, Amazon Ads, and others as founding participants. The stated goal: address transparency gaps in how auctions operate, how transaction signals are handled, and how buyers and sellers can verify that programmatic execution is trustworthy.

“Programmatic grew incredibly fast, but the governance around how that market should operate has not kept pace with its scale, complexity, and automation,” said Anthony Katsur, CEO of IAB Tech Lab.

The council’s existence is itself a signal. When organizations of this size commit to formal governance work, it reflects accumulated frustration that voluntary coordination was not resolving practical problems. The specific issues named – auction transparency, transaction signal consistency, bid duplication – are downstream effects of the shift to first-price auctions and the growth of AI-driven bidding. When machines are making millions of decisions per second and auction mechanics are complex, small inconsistencies in how signals are handled have large aggregate effects.

For buyers, the transparency push matters because it creates pressure on SSPs and exchanges to document their auction mechanics more clearly. That documentation is what makes SPO and bid shading strategies defensible: you need to understand the auction you are bidding into before you can optimize intelligently for it.

What to Prioritize in Your Programmatic Stack

Not every change in programmatic requires action right now. Some things have already settled into your workflow without you noticing. Others need a deliberate decision.

First-price auctions are standard infrastructure at this point – but that doesn’t mean your bidding model is set up for them. If you haven’t checked whether bid shading is enabled on your DSP campaigns, that’s the first thing worth looking at. AI bidding is only as good as the objective you give it. A campaign pointed at clicks will chase clicks – including bad ones. The more valuable work is defining what you actually want the model to go after, and making sure your tracking is clean enough that it can learn from real conversions, not noise.

Supply path is worth a deliberate look if you’ve never actively chosen which SSPs and exchanges you buy through. The efficiency gains from consolidating around quality paths are real, but they don’t happen by default.

For campaigns on performance networks rather than the open exchange, the levers are different: zone and subzone exclusions, format selection, optimization settings at the campaign level. The logic is the same, though – point spend at what works, and give the algorithm something accurate to learn from.

FAQ

What is a first-price programmatic auction?

In a first-price auction, the winning bidder pays exactly what they bid. This is the standard model on most major ad exchanges today. It replaced second-price auctions, where the winner paid one cent above the second-highest bid. The shift to first-price made bid strategy more important and helped drive adoption of AI bidding tools.

What is bid shading in programmatic advertising?

Bid shading is the practice of submitting a bid below your maximum willingness to pay, based on a model that estimates the likely clearing price. It became critical when first-price auctions became dominant, because consistently winning at your ceiling price is expensive. Most DSPs now include bid shading as part of their AI bidding models.

What does supply path optimization mean?

Supply Path Optimization (SPO) is the practice of choosing which supply paths to buy through – routes from a DSP through SSPs and exchanges to publisher inventory – and which to exclude. The goal is to concentrate spend on paths that deliver quality inventory, transparent pricing, and measurable outcomes, rather than spreading budget across every available route.

Why is AI so central to programmatic bidding now?

The volume of bid requests in a modern programmatic campaign exceeds what any human team can evaluate manually. A campaign running across multiple formats and markets processes millions of bids per day, each requiring a decision in under 200 milliseconds. AI models handle the pattern recognition and real-time adjustments this requires. Human buyers set objectives and evaluate outcomes; the model manages execution.

What is the Programmatic Governance Council?

The Programmatic Governance Council is an industry body launched by IAB Tech Lab in April 2026. Its founding participants include Dentsu, Omnicom Media Group, WPP, Disney, The Trade Desk, and Amazon Ads, among others. Its mandate is to address transparency in auction mechanics, transaction signal handling, and accountability in programmatic trading.

Wrapping Up

Programmatic auction mechanics have genuinely changed – and the changes require different skills, not just different tools. First-price auctions rewrote the logic of efficient bidding. AI became the only practical way to execute that logic at scale. SPO is thinning out the supply chain, cutting the paths that can’t prove their value. And IAB Tech Lab’s governance push signals that the industry knows it needs to get its house in order.

None of this makes programmatic simpler. What it does is shift where the complexity lives. The buyer’s job is no longer about managing bids manually – it’s about understanding what the AI is optimizing toward and making sure that the target is the right one. Less mechanical work, more strategic thinking. The teams that make that shift will find it easier to defend their spend. The ones that don’t will keep wondering why the results don’t match the budget.

The post How Programmatic Auctions Changed: New Bid Models, AI, and a Cleaner Supply Chain appeared first on AdTech Holding.

But ad pipelines are built for one thing: speed. Shave a few milliseconds off an RTB response, and you win more auctions. Add a five-millisecond security check, and you can lose more money than any breach would cost.

That tension: speed vs. security – is what makes pipeline security in AdTech hard. Below: the threat model, architecture patterns that scale, controls that won’t kill your p99, and how compliance fits in.

Why Ad Impression Pipelines Are a Special Case

Before we talk about controls, here’s what makes ad pipelines different from a typical enterprise data pipeline.

Scale and Velocity

One impression generates 5–15 downstream events: bid request, bid response, win notice, render, viewability ping, click, post-click. Multiply by hundreds of thousands of impressions per second, and you’re looking at tens of millions of events per second at peak. 

Controls that work in fintech: scoring every request, deep packet inspection, full audit logs on the hot path, are breaking at this scale.

Latency Constraints

OpenRTB – the protocol behind programmatic ad auctions – gives you 100 milliseconds or less for a full round trip. 

That covers the whole conversation: the supply-side platform (SSP, where publishers sell ad space) sends a bid request, the demand-side platform (DSP, where advertisers bid for it) decides what to offer, and the response comes back. Inside the DSP, the budget for actually deciding the bid is under 50 milliseconds.

A lot has to happen in those 50 milliseconds. 

The DSP has to confirm the request came from a trusted partner, parse the incoming data, pull every signal it has about the user and the page, run a machine-learning model to predict whether the ad will perform, filter out suspicious traffic, and assemble the bid response. 

Any security check that needs more than a few milliseconds can’t live here. It has to run in the background after the bid is sent, or at the network edge before the request reaches the bidder at all. Not on the hot path – the time-critical flow where every millisecond translates directly into revenue.

Multi-Party Data Flows

Data crosses company boundaries at every hop: publisher SDK → SSP → ad exchange → DSP → DMP → measurement vendor → advertiser. 

You don’t control upstream sources. You don’t control downstream consumers. And even a trusted partner can be compromised, misconfigured, or unknowingly forwarding traffic from sub-sources it hasn’t fully vetted.

Consent and Identity Complexity

Every impression now carries a consent payload – a small piece of data that records whether the user agreed to tracking and what kinds of processing they allowed. 

The EU uses TCF v2.2 (the Transparency & Consent Framework), the US uses GPP (the Global Privacy Platform), and India and Brazil have their own local equivalents. 

A missing consent string for an EEA user isn’t just a data quality issue. It’s a compliance liability. While pipeline security is more about making sure the right data flows.

The Threat Model: What You’re Defending Against

Most AdTech security incidents fall into one of four categories. Build controls without picturing each one, and you end up with defenses that look great on slides and fail in production.

External Attackers

The classic case is exfiltration. Someone wants your user-level data – device IDs, IPs, browser fingerprints, behavior history. Pipelines that dump raw events into cloud object storage (S3), analytical databases (ClickHouse), or data warehouses (BigQuery) are prime targets, especially as permissions drift over time.

The other pattern is pipeline injection: forged events pushed into the pipeline to inflate counters, skew reports, or trigger payouts. If your ingestion endpoint trusts anything with a roughly correct schema, you’re exposed.

Insider and Misconfiguration Risks

These incidents rarely make headlines, but they’re a recurring source of exposure. An engineer with broader access than they actually need exports a query result to a personal account. A service role accumulates permissions over the years until it can read every table. Combine that with the multi-month retention windows that AdTech analytics often still requires, and the blast radius grows fast.

Adversarial Traffic (Fraud)

Sophisticated invalid traffic – bots, click farms, device spoofers, header manipulators – is a security problem dressed as a measurement problem. 

To the pipeline, fraud is an auth failure: events claim to come from a real human session, and they don’t. Anti-fraud and pipeline security sit in the same layer and should be designed together.

Supply-Chain Compromise

Compromised publisher SDKs. Malicious bid responses with embedded scripts. Third-party tags that exfiltrate data. The supply chain is where modern AdTech bleeds. 

MFA on your control plane doesn’t help if a compromised partner SDK is quietly shipping consent data to an unaffiliated server.

Cyber Threat Intelligence in the AdTech Product Lifecycle

Architectural Foundations That Hold Up at Scale

Three patterns emerge in AdTech pipelines that withstand both growth and audits.

Hot Path vs. Cold Path Separation

The hot path: bid requests, real-time decisioning, win notices, stays lean. The cold path: analytics, ML training, reporting, carries the heavier security machinery.

In practice: personally identifiable information (PII) – anything that can identify an individual user, from device IDs to IP addresses – never sits on the hot path longer than it has to. 

The hot path uses tokens (random, opaque values that stand in for the real identifier). The cold path can re-link to raw values, but only under strict controls. The two paths never share credentials, queues, or service accounts.

Defense in Depth at Every Hop

A bid request travels through a chain of services – an edge proxy at the front, an ingestion service that validates incoming data, a message broker (Kafka or similar) that buffers events, a stream processor that transforms them on the fly, an enrichment service that adds context like audience or geo signals, a sink that writes events to storage, and finally the analytics warehouse. 

Each hop is a security boundary. Each one should authenticate the previous hop, validate the payload, and re-encrypt for the next leg.

When teams skip a hop (“the broker is inside the VPC, we don’t need mTLS”), one breach in any adjacent service becomes a breach in the pipeline.

Zero-Trust Service Identity

In a high-volume pipeline, you can’t trust IP addresses or network topology as identity. Every service needs a cryptographic identity issued by a workload identity system – examples include SPIFFE/SPIRE, AWS IAM Roles Anywhere, or GCP Workload Identity.

Every call between services authorizes against that identity, not against network position. Sounds heavy until you realize that without it, one compromised stream-processor pod is enough to own the whole pipeline.

Securing the Ingestion Layer

The ingestion edge is where most attacks start, and where most defenses earn their keep.

TLS, mTLS, and Request Authentication

Every connection at ingestion uses TLS 1.3 – the standard encryption protocol that protects data in transit. 

Partner-to-partner traffic adds mutual TLS (mTLS): both sides present a certificate that proves their identity, both sides validate the other’s, and the certificate identity goes into the request log. 

That alone kills whole classes of bid request forgery.

Schema Enforcement and Sanitization

Treat every incoming OpenRTB request as untrusted input – not because the partner is suspect, but because the data has crossed networks and devices outside your control. 

Use a strict schema – a precise definition of what each field must look like, written in something like Protocol Buffers (Protobuf) or JSON Schema – and reject malformed payloads at the edge. Strip unknown extension fields instead of passing them through. 

Those fields are the most common way unexpected data ends up flowing where it shouldn’t, often through outdated integrations or compromised intermediaries, not through deliberate action.

Rate Limiting and Behavior-Based Throttling

Capping requests per second per partner is the easy part, but a cap alone doesn’t tell you when something has actually gone wrong.

You also want to watch for sudden shifts in how a partner’s traffic behaves. If their device-OS mix flips overnight, or click-through rates jump from 4% to 18% in an hour, something is usually off – a compromised SDK, a buggy release on their side, or fraud entering their inventory. When that happens, the safer move is to temporarily slow their traffic to a fraction of normal volume, without cutting them off, until your team has had a chance to look into it.

Edge Fraud Filtering

The cheapest fraud is the kind you reject before it enters the pipeline. Keep a tight blocklist of bot IPs, data-center ranges, and bad device fingerprints, and apply it at the edge. 

Even cutting 5% at the ingest reduces downstream load and the blast radius of any later breach.

Streaming Layer Security: Kafka, Pulsar, Kinesis

Message brokers – Kafka, Pulsar, Kinesis, Pub/Sub – sit at the load-bearing middle of most modern impression pipelines. They take events from upstream services, hold them briefly, and stream them to downstream consumers. 

In practice, they tend to get less security attention than the ingress edge or the warehouse, even though everything in the pipeline flows through them.

Broker Authentication and ACLs

Every service connecting to the broker,  whether it writes events or reads them, has to prove who it is first. The usual ways: a password over an encrypted channel, an OAuth token, or a TLS certificate. 

On top of that, each topic gets its own read/write rules. The bid-event topic only accepts writes from the ingestion service. The audit topic is only readable by the agent that ships logs to your security monitoring system (the SIEM).

Encryption in Transit and at Rest

Every connection between the broker and a client should be encrypted with TLS – this part isn’t optional. 

When events sit on disk in the broker, encrypt them too, with keys managed by a key management service (KMS, for example, AWS KMS, Google Cloud KMS, or HashiCorp Vault). That protects you if someone walks off with a disk, and turns key rotation from a multi-week project into a routine operation.

For the most sensitive fields – raw user IDs, exact GPS coordinates, IP addresses – encrypt them at the field level before they reach the broker. 

That way, if someone breaches the broker, they see encrypted blobs, not real personal data. It also makes user-deletion requests genuinely workable: throw away that user’s key, and the encrypted data becomes unreadable immediately.

Audit Logging and Lineage

Log everything that happens around the broker – every connection, every config change, every time someone resets where a consumer is reading from. 

Write those logs to a separate write-only stream that your security monitoring system reads in near-real time. Tag each event with where it came from: which service produced it, which partner, which version of the data format. 

When something breaks, those tags are the difference between a quick investigation and a multi-week dig through old logs.

Protecting PII and Sensitive Identifiers

This is where AdTech engineering and compliance most often collide. Here’s what works in practice.

• Tokenization. Replace raw user IDs with random-looking tokens as early in the pipeline as possible, ideally before the first internal broker. The same user always gets the same token, so analytics still works. 

Keep the table that maps tokens back to real IDs in a tightly locked-down vault. Most services work only with tokens. Only the small handful that genuinely need real IDs – the service that handles deletion requests, the one that feeds advertiser measurement – get to query the vault.

• Hashing. Where you don’t need to link a user’s events together across time (you just need to count them, say), hash the ID instead, and mix in a salt (a short random string) before hashing.

Rotate the salt on a schedule, so that if a dataset leaks, it goes stale rather than staying useful forever.

• Carry consent with every event. Don’t just attach the raw consent string from the user – also include the parsed result, so every downstream service can see exactly what’s allowed (advertising? measurement? analytics?). 

If a service’s use case isn’t covered, it drops the event.

• Data minimization. The cheapest personal data to protect is the kind you never store. Drop fields that no downstream service is actually using. If a measurement vendor stopped using device IDs two quarters ago, stop writing them in logs and the pipeline.

• Aggregated, noise-added analytics (differential privacy). For internal reporting, provide analysts pre-aggregated views with minimal random noise, rather than raw event tables. 

The math still works for the questions the business actually asks, and the risk of any one analyst walking out with raw user data drops sharply.

Ad Tech Security for Brands and Advertisers: A Practical Checklist

Access Control and Identity

Your pipeline is only as secure as the humans and services allowed to touch it.

Service Identity and Workload Isolation

Every service in the pipeline should run with a short-lived credential issued by an identity system, not a long-lived password or API key sitting in a config file. 

Each credential gets only the permissions that one service actually needs, and you review those permissions every quarter. “That service used to need warehouse write access two years ago” is not a reason to keep it.

Human Access and Just-in-Time Elevation

Permanent access to raw impression data goes to a short, documented list of people. 

Everyone else gets access only when they actually need it. If an engineer needs to query raw logs to debug something, they request access, a teammate approves it, every query gets logged, and the access drops away automatically within a few hours.

Phishing-Resistant Auth and Break-Glass Paths

Admin-level access requires login methods that phishing can’t beat – WebAuthn, hardware security keys, passkeys. 

The emergency “break-glass” paths into production – the ones you only use when something is on fire- should always page an on-call human. “The alert was noisy, so we silenced it” is a recurring root cause of major incidents.

Detection and Response in Real-Time Systems

Detection in AdTech can’t rely on the same patterns a typical enterprise security tool watches for. The volumes are bigger, the signals are noisier, and you have less time to respond.

A few things that work in practice. Watch for sudden changes in the shape of a partner’s traffic: geographic mix flipping overnight, device-OS mix shifting dramatically, click-through rates jumping from 4% to 18% in an hour. 

Those are usually the first sign of fraud, a compromised SDK, or a bad release on the partner’s side. Watch for unusual spikes in unique identifiers: if one partner suddenly sends ten times as many distinct device IDs as yesterday, that’s often SDK compromise or fingerprint spoofing. Watch for services that start reading data they haven’t touched in a while — if a downstream service starts pulling from a topic it hasn’t read in 30 days, treat it as a possible compromise until verified.

Detection only gets you halfway. You also need response plans specific to AdTech: what to do if a partner’s API key is compromised, what to do if an analyst pulls more data than they should, what to do during a fraud-driven impression flood, what to do if malicious code is found in a creative payload. 

Generic enterprise incident-response playbooks miss the point – the attackers in AdTech have a different economic model from the ones hitting typical enterprise IT.

Compliance and Cross-Border Data Flows

Several major privacy laws touch AdTech impression data: GDPR (the EU’s General Data Protection Regulation), CCPA/CPRA (California’s Consumer Privacy Act and its Privacy Rights Act amendment), India’s DPDP Act (Digital Personal Data Protection Act, 2023), Brazil’s LGPD (Lei Geral de Proteção de Dados), and a growing patchwork of US state laws. Security architecture has to support compliance by design — not just coexist with it.

• Data residency by design. Data on EEA (European Economic Area) users shouldn’t leave EEA infrastructure. Enforce the geographic split at the network routing level, not in your application code. If you rely on application code to decide where data goes, one config mistake can leak the entire EU dataset to a US warehouse.
• A working deletion pipeline. When a user asks you to delete their data (GDPR, DPDP, and others give them this right), you need a documented, tested process for actually doing it – across the hot path, the cold path, backups, partner reports, and your ML training data – within the time limit the law gives you. This is much harder than it sounds when the pipeline writes to dozens of different downstream systems. Build it before you actually need it.
• Logs you can show a regulator. Regulators increasingly want proof that you respected each user’s consent – not just an assurance that you did. The credible answer is persistent, tamper-proof logs that link every event to the consent it was processed under.
• A real list of every third party that touches your data. Every partner SDK, every measurement vendor, every cloud service that touches impression data should be documented, covered by a contract, and reviewed once a year. (Privacy regulators call these your sub-processors.) The list grows faster than people expect.

Common Pitfalls

Recurring failures across AdTech pipeline security programs:

• Treating encryption as the whole answer. Encryption in transit and at rest is necessary, not sufficient. Most breaches involve credentials and access patterns, not broken ciphers.
• Logging too much personal data into your monitoring tools. Logs and traces are often the least-secured part of the system — and they routinely end up containing exactly the personal data your production database was carefully guarded against leaking.
• Skipping validation on partner traffic. Bid requests are external input – they’ve crossed networks and devices outside your control before arriving. Treat them like any other external input: validate, sanitize, and constrain at the edge.
• Permissions slowly getting bigger over time. The cleanest access-control setup decays into a swamp within 18 months if you don’t actively prune it. Build a regular review schedule from day one.
• Treating fraud and security as separate functions. The fraud and security teams usually fight the same adversary from different angles. Shared signals and joint detections beat parallel efforts.

A Practical Maturity Model

A simple maturity model helps teams accurately position themselves.

• Level 1 — Ad hoc. TLS at the edge, basic access control, occasional penetration tests. Most early-stage AdTech businesses live here. Fine for now, dangerous at scale.
• Level 2 — Hardened. Mutual TLS between services, read/write rules on every topic, structured audit logging, documented data flows, and basic consent handling. Where mid-sized SSPs and DSPs need to be.
• Level 3 — Mature. Short-lived service identities, tokenization at ingest, separated hot and cold paths, just-in-time access for humans, and real-time anomaly detection. Required for major exchanges and global ad networks.
• Level 4 — Defensible. Field-level encryption for sensitive identifiers, differential privacy for analytics, lineage-aware monitoring, tested deletion pipelines, joint fraud-and-security operations. Where most regulated AdTech needs to be by 2027.
• Level 5 — Adaptive. Controls are continuously tested in production, common issues are fixed automatically, partner SDKs come with cryptographic proof of integrity, and every new product launch goes through a formal threat-modeling exercise. Few platforms operate at this level today. More will need to.

Closing Thought

The teams that get pipeline security right treat it as a feature of the product, not a tax on speed. It’s what lets them sign enterprise advertisers, expand into regulated regions, integrate with cautious publishers, and survive the kind of incident that ends competitors.

Throughput and latency constraints are real. They’re not an excuse. The patterns in this article are how the best AdTech engineering teams hold the line: at two million events per second, with a 50-millisecond decision window, under three overlapping privacy laws. It’s possible. It just has to be designed for from the start.

The post Data Pipeline Security in High-Volume Ad Impression Processing appeared first on AdTech Holding.

No futuristic roadmaps or theoretical concepts: just real systems, real numbers, and honest lessons learned.

Sergey Kozlov: AutoLaunch – From Jira Ticket to Live Campaign in 10 Minutes

Sergey Kozlov, Head of RNA (Rotation & Ad Ranking) at AdTech Holding, presented ‘Automating Ad Operations: Where to Use LLMs, and Where to Keep the Code’. This is a story about removing a critical bottleneck between the speed of algorithms and the speed of human operations.

The Problem Nobody Questioned for Years

AdTech Holding’s PropellerAds, a multichannel advertising network, serves more than 2 billion ad impressions daily, manages 40,000 active campaigns, and operates across 195+ geographies. 

Many clients use PropellerAds SSP to launch campaigns on their own. But for managed-service clients, the process is different: they send their campaign requirements to an account manager, who then coordinates the launch with other teams. At that scale, getting such campaigns live was taking too much time and effort.

Turning such a request into a live campaign could take up to five hours, involving six handoffs between teams and a significant amount of repetitive manual work for four specialists.

It could take five hours to turn a client brief into a live campaign, with six handoffs between different teams along the way. Four specialists spent much of their time on repetitive manual work.

How Professionals at AdTech Holding Use ChatGPT in Their Work

The biggest challenge was the input. Campaign briefs arrived in Jira as unstructured text, often mixing Russian and English, using internal industry slang, and containing implicit requirements.

For example, there were abbreviations such as ‘SCPM (‘SmartCPM)’  or ‘push’ (push notifications), as well as vague instructions like ‘Android is mandatory, iOS by exception’.

Regular expressions couldn’t handle these cases well, so the system needed to understand the meaning of the text.

Architecture: LLMs Only Where They Add Value

The solution became a six-stage pipeline orchestrated by an Airflow DAG. The key architectural decision was identifying exactly where an LLM should and should not be used. And, the LLM was responsible for a single task: extracting structured information from unstructured text. 

So, the pipeline works like this:

The LLM is responsible for:

• Understanding mixed-language briefs
• Interpreting industry jargon and abbreviations
• Extracting campaign settings from unstructured text
• Identifying likely targeting options mentioned in the brief, such as ISPs, regions, or other targeting parameters

The code is responsible for:

• Matching extracted values to the correct IDs in the system
• Applying business rules and validation checks
• Selecting the final campaign settings
• Deciding whether a campaign can be launched automatically or requires review
• Creating the campaign through the Campaign API

The team initially tried including large reference lists directly in prompts, but this quickly became expensive and reduced accuracy. Instead, the LLM only identifies likely matches, while the final selection is handled by code.

Another important principle was keeping humans in control. The system never launches campaigns blindly. If the model is confident and the campaign meets predefined business rules, it can be launched automatically. However, campaigns from new advertisers, those with large budgets, or those in highly regulated verticals are always sent to Draft status for manual review by the AdOps team.

Results

• Campaign launch time reduced from several hours to 10 minutes
• 300+ campaigns per week processed through AutoLaunch
• 95% field extraction accuracy on semantic evaluation datasets
• 90% successful launches without AdOps corrections
• Approximately $0.10 LLM cost per campaign
• The equivalent of two full-time roles was freed up for higher-value work

Today, roughly 70% of campaigns follow the fully automated path, while the remaining 30% are intentionally routed for review.

Sergey’s comment

What stood out most during the Q&A was how many teams are facing the same challenge: deciding where AI should stop and traditional software engineering should begin. It’s tempting to push more responsibilities into the model, but our experience shows that the best results come from clearly separating interpretation from execution. If I had ten more minutes, I would have gone deeper into how we evaluate confidence thresholds and design safety mechanisms for production systems.

Ekaterina Orlova: Smart BI: An AI Detective for Performance Anomalies

Ekaterina Orlova, Middle Data Scientist at AdTech Holding, presented ‘Smart BI Platform: Building an AI Detective for Performance Anomalies’, a practical look at how the team reduced investigation time from 30 minutes to just a few minutes through AI-powered diagnostics.

A typical Monday morning

Imagine opening a dashboard and seeing an alert:

Advertiser revenue dropped 40% compared to yesterday.

What happens next? An analyst starts investigating:

• Checking whether the data is complete
• Reviewing CRM logs for recent changes
• Looking at performance by GEO
• Сhecking traffic quality metrics
• Reviewing network incidents
• Considering external factors such as holidays, sporting events, or other events that could affect traffic

One investigation can easily consume 30 minutes: there may be 1,000 such signals every day across the network. Manual investigations covered only about 5% of them, while the remaining 95% often went unexplored.

Two Agents, One Infrastructure

The Smart BI platform is built around two specialized agents that share a common tool layer, including Stats API, CRM Audit, SQL, charting services, Jira, and Slack integrations.

The ReAct agent handles open-ended analytical questions such as:

‘Show the top five advertisers by revenue growth in the US yesterday.’

It works iteratively, selecting tools, reviewing results, and continuing its reasoning process. This makes it effective for exploratory analysis.

The Detective agent operates autonomously.

Triggered by an anomaly signal, it receives structured input such as:

{ advertiser_id, day, metric }

and executes a predefined investigation workflow.

The system performs nine checks in parallel – including seasonality, campaign pauses, targeting changes, bid modifications, budget limits, and several additional diagnostics, followed by sequential analysis of zones, auctions, and competitive activity.

Only after all evidence has been collected does the LLM get involved to synthesize the final report.

Example output:

Four Things That Broke in Production

Ekaterina openly shared the challenges the team encountered while building the platform:

• Context explosion in ReAct agent. After ten or more tools, APIs could return thousands of rows of data, quickly exhausting available context windows. The scallsolution was a dataset storage layer. Instead of passing raw data back into the model, agents receive dataset schemas and representative samples.
• LLMs are bad at math. The team discovered that arithmetic performed directly by the model could not be trusted. The fix was straightforward: all calculations are delegated to a dedicated Python-based data tool. The LLM never performs computations itself.
• The detective was too slow. Early versions allowed the LLM to orchestrate every investigation step. This dramatically increased execution time. The final architecture moved data collection into a deterministic pipeline running checks in parallel, while the LLM is only used for decision-making at pipeline nodes and final synthesis.
• Fifteen years of internal jargon. Terms such as ‘pre-lander,’ ‘smartlink,’ or ‘rotator’ are familiar within the company but unfamiliar to foundation models. The solution combined a glossary tool with a knowledge base powered by semantic search across historical investigations.

How Sumsub and PropellerAds Respond to New Fraud Threats in 2026

Building Trust

Solving technical challenges was only part of the job. The team also had to answer a more important question: how do you get managers to trust an AI system that investigates revenue anomalies and recommends actions?

According to Ekaterina, trust depends on two factors.

First, every investigation is fully logged. Teams can see which tools were used, which datasets were created, how many tokens were consumed, and how much each analysis cost.

Second, managers provide direct feedback on investigation quality. Their ratings feed evaluation datasets, while comments become part of the knowledge base used to improve future investigations.

Results

With investigation time reduced from 30 minutes to just a few minutes, managers can now focus on making decisions instead of spending their mornings collecting data from different dashboards.

Ekaterina’s Perspective

For Ekaterina, Smart BI is not just a conference topic, but one of her main projects this year. That made ML Conference Serbia a good place to share what the team has already learned while building an AI agent for analytics and anomaly investigation.

The topic turned out to be very relevant for the audience. Ekaterina says she received more questions than expected, mostly about the challenges the team faced and how they solved them. She also noted that the AI landscape is changing very quickly. Looking back, she would have liked to spend more time on plans and new ideas, because even during the Smart BI project, many AI tools and approaches had already evolved.

One idea from another conference talk especially resonated with her: companies should use AI to create more value, not just to cut costs.

The goal shouldn’t be to replace people, but to help them achieve more with new tools and new skills.

Ekaterina also highlighted one important lesson from working with AI inside an AdTech company. Modern models are good at general tasks such as coding, content generation, search, and summarization. But they do not know the company’s internal context, terminology, or past cases.

What they lack is domain-specific company knowledge. That’s why internal knowledge bases and good documentation are becoming so important.

Beyond the talks, the conference was also a great opportunity to meet people from different industries, discuss common problems, and exchange practical ideas.

Conclusion

Although the two presentations covered different systems, they shared a common challenge and a common answer.

Both teams found that modern models perform well at general reasoning. However, they have no access to the company’s internal context: its terminology, its history, its business rules. Sergey’s pipeline ran into this when campaign briefs arrived full of internal shorthand that no base model could parse. Ekaterina’s Detective hit the same wall with 15 years of AdTech jargon that foundation models had simply never seen.

Both teams solved it the same way: not by stuffing more context into prompts, but by building external structures the model can reach when it needs domain knowledge: knowledge bases, glossaries, fuzzy matchers, and semantic search over past investigations.

This is probably the most important lesson from both talks: the model is the reasoning engine, but the company’s knowledge has to live somewhere it can actually reach.

At AdTech Holding, we continue to share what works in production – including the successes, the failures, and the lessons learned along the way – because practical experience is ultimately more valuable than hype.

The post AdTech Holding at ML Conference Serbia: How We Automate AdTech from the Inside appeared first on AdTech Holding.