495 unique visitors. 1,290 page views. Both up 100 percent on the period before.

I had nothing to do with it.

That is the bit I keep turning over. I did not open a single tab. I did not spend a Saturday morning in a keyword tool. I set an agent running on a schedule a couple of months ago and then got buried in client work and genuinely forgot about it.

It just kept going. Every month it looked at the site, changed things, waited, checked whether the changes worked, and adjusted.

Those are not big numbers, by the way. I know. That is sort of the point, because most small businesses are sitting on numbers like these and nobody ever talks about them out loud.

This is one or two cycles. That is a small sample and I am not going to pretend otherwise.

It could be seasonality. It could be noise. Two months is not proof of anything, and anyone telling you a two month result is a system is selling you something.

What I can tell you is that the loop ran unattended, it did not break, and the number went the right way. Ask me again at the end of September and I will tell you whether it held.

1.    Analyse the site, and analyse it against its competitors.

2.    The AI implements the changes through MCP.

3.    Trigger it again a month later and see whether anything actually moved.

Most SEO work is a PDF someone hands you, and then nobody ever finds out if it worked. This one marks its own homework. If last month's change did nothing, it sees that next cycle and tries something else.

Nobody has to remember to check. That is the part I would not have predicted mattering as much as it does.

Passive scanners for the technical side. TLS, security headers, DNS records, broken pages, exposed files. Nothing gets probed or attacked, it just looks at what is already public.

Then DataForSEO for the interesting half: organic traffic, ranked keywords, top ten positions, backlinks, and how you compare to the three competitors you actually care about.

Kimi does the bulk of the analysis passes because it is cheap and it is fine at this kind of work.

Scanning one domain costs about 1.2 cents in data.

DataForSEO has an API that measures how often ChatGPT, Perplexity and Google AI Overviews mention a given domain.

Not how you rank on Google. How often an AI names you when someone asks it a question in your category.

Almost nobody I have shown this to has ever measured it. Most did not know it was measurable.

If your customers are asking ChatGPT for a recommendation instead of Googling, that number matters more than your keyword rankings, and right now it is close to a blind spot for everyone.

I started security-first. Breaches, DMARC, SPF, headers. It made a great report.

Then it clicked that security is a one-off. You fix DMARC once and it is fixed forever. There is no month two.

Traffic, rankings and AI mentions change every single month.

So it got rebuilt to lead with the traffic gap, and the security findings moved down the page. Same system, completely different business behind it.

On Thursday and Friday I built the front end: the part that takes everything the loop already knows and turns it into a readable email I can send to someone about their own site.

It lands in my inbox first. I read it, then decide whether to send it. It never sends on its own.

Then I pointed it at four businesses I work with. I am not naming them, because we are talking about their security posture and that is not mine to publish.

• A bookkeeping firm: 14 data breaches tied to staff emails, and no SPF or DMARC records at all. Anyone could send email as them.

• A funds management business: zero breaches, genuinely locked down. But 70 of 70 images had no alt text.

• A fractional CFO: clean across the board, with four broken pages quietly sitting there.

• A building inspection company: the best on-page SEO of the four by a distance. 54 visits a month. Their main competitor gets 13,740.

That last one is the one I keep thinking about. They did the work. They wrote the pages. They are better than the competitor on almost every on-page measure, and they are getting about 250 times less traffic.

Being good is not the same as being found.

Reply to this email with your domain and I will run it and send you what comes back. No pitch attached, I am genuinely still testing it on different kinds of businesses and the odd ones teach me the most.

Fair warning: some of you are not going to enjoy the breach section.

Keep an eye out. I will report back at the end of September on whether cycle three actually holds up, and I will tell you either way.

Daniel