Get found: from SEO to GEO to AEO.

01Search stopped being a list of links.

For two decades, "ranking" meant earning a spot in ten blue links. That model is dissolving. A user asks a question and increasingly receives a synthesized answer — from Google's AI Overviews and AI Mode, from ChatGPT, Perplexity, or Gemini — often without ever clicking through to a website.

The takeaway is not that SEO is dead — it's that visibility now has two surfaces: the classic ranked results, and the AI answer. A modern website has to perform on both, and the technical foundation underneath them is largely the same. That is precisely where legacy sites quietly fail.

The shift is already measurable. Click-through for top-ranked content can fall by more than half where an AI Overview appears, and traditional search volume is projected to drop sharply through 2026 as users move to answer engines.

02Performance became a ranking signal.

Google's answer to a slow, clunky web was to make user experience measurable and bake it into ranking. The framework is Core Web Vitals, evaluated on real-world visits under mobile-first indexing — meaning the mobile experience is the one that counts.

• LCP ≤ 2.5s — Largest Contentful Paint.

  Main content must render fast. Beyond four seconds earns a "Poor" rating.

• INP ≤ 200ms — Interaction to Next Paint.

  The site must respond crisply to every tap and click.

• CLS < 0.1 — Cumulative Layout Shift.

  Content must stay visually stable as the page loads.

Performance alone rarely vaults a site to first place — but a genuinely slow site is held back, and there's a quieter second penalty: crawl efficiency. Google crawls fast-responding sites more thoroughly, so a sluggish server means fewer pages discovered and re-indexed. Most of the damage traces to the stack itself — slow time-to-first-byte, the hosting tier, the CMS and its database, render-blocking scripts, and heavy unoptimized images.

03The new layer — GEO and AEO.

Being visible inside AI answers has a name — two, now used alongside classic SEO.

• SEO + AEO — search & answer-engine optimization.

  Rank in the blue links, and win the featured answer and snippet boxes. Built on keywords, authority, and structure.

• GEO — generative-engine optimization.

  Get cited as a trusted source inside answers generated by ChatGPT, Perplexity, Gemini, and AI Overviews. The goal shifts from ranking to being referenced and reused by machines.

How do AI engines choose what to cite? They crawl, then at answer-time they retrieve and synthesize. The signals that win citations: crawlability — if AI bots can't read it, you are invisible, and many engines offer no "re-index" request — structured data that maps your content to known entities, clear neutral structure with logical headings, freshness, and E-E-A-T signals: experience, expertise, authoritativeness, trust.

AI search is less forgiving of legacy authority and more rewarding of clean structure.

Well-structured pages ranked twenty-first or lower in Google still get cited by AI engines a large share of the time — meaning a small, fast, cleanly-built site can be referenced where an old high-domain site is skipped. Google's own guidance is blunt: optimizing for its generative features is still, fundamentally, good SEO.

04Why legacy sites lose on both surfaces at once.

The same root causes that drag down Core Web Vitals also block AI citation. One aging platform produces a cascade:

• Slow hosting and TTFB.

  Fails LCP and wastes crawl budget. Shared or undersized hosting and a heavy database mean the server is slow before a single image loads.

• Outdated plugins.

  Bloat and breach risk together. Each plugin adds render-blocking code and a potential vulnerability — the vast majority of CMS breaches originate in plugins and themes.

• Heavy CMS and theme.

  Layout shift and poor INP. Page-builder markup and excess JavaScript hurt stability and interaction speed, especially on mobile.

• No structured data.

  Invisible to AI. Without clean schema and a logical hierarchy, answer engines can't confidently extract or cite the content.

• Insecure or no HTTPS.

  A trust penalty. Weak TLS, missing security headers, and an exposed admin surface erode the trust signals both Google and AI engines weigh.

• Mobile failure.

  Indexed at its worst. Under mobile-first indexing, a site is judged on its slowest experience — its mobile one.

05The compounding cost.

Left unaddressed, an old website doesn't just rank lower. It loses organic traffic as competitors pass it on Core Web Vitals. It disappears from the fastest-growing discovery channel because AI engines can't parse or trust it. It converts worse, since slow load and layout shift drive abandonment. And it carries security and hosting exposure — outdated plugins and unpatched stacks are a live breach risk that also depresses the external security ratings insurers now scan during underwriting.

Fast, structured, secure — the three properties that win classic SEO, AI citation, and a clean security scan simultaneously.

A modern site — lean code, fast hosting, clean structured data, a minimal attack surface, HTTPS by default — satisfies Core Web Vitals, gives answer engines content they can confidently cite, and presents a hardened face to the same external scans underwriters run. The marketing problem and the risk problem are the same problem. Modernizing the website is no longer a marketing line item; it's where visibility, conversion, and cyber-risk converge.

© Elephant · 2026 · elephant.ca · figures are industry-reported and illustrative; your results will reflect your own site and stack.