Every time someone opens a page, taps a link, or starts a video, they set off a small chain of economic events. Those events do not resolve into one outcome. They fork. One branch runs toward value: some reason a business will eventually be paid. The other runs toward cost: the compute, bandwidth, and fees it takes to serve, measure, and monetize the moment.
The opposite used to be true. The modern paradox is that the branches are not the same size. Online, there are always more ways to spend money than to make it, and the machinery that captures value also manufactures cost, faster as it grows. This briefing traces both branches, shows where they meet, and sets out the few measures that tell you which one is winning.
01Who actually pays for the internet
Almost nobody pays for the services they use. The consumer internet is overwhelmingly free at the point of use, which means it is paid for somewhere else: with attention, and with the data attention leaves behind. As Tim Wu documents in The Attention Merchants, businesses have spent a century capturing human attention and reselling it. The web did not invent that model, it industrialized it.
That leaves three ways to turn a web event into revenue:
- Charge for it. The rare case where the user is the customer, through a subscription or a purchase.
- Sell the attention. Advertising rented against the session and priced per thousand impressions (CPM).
- Sell the exhaust. The behavioral data a session leaves behind, aggregated and monetized at a scale no single user can agree to.
02The cost side is longer
Against those three value paths sits a longer list of cost centers:
- Compute and hosting to receive, process, and respond to requests.
- Tools and services layered on top: analytics, tag managers, verification, identity.
- Data platforms and pipelines that move, store, and process what is collected.
- Business overhead: ad operations, sales, and compliance.
And one cost the income statement tends to hide. Every bid request, API call, and pixel that fires has to be processed, and processing is not free. We call it infrastructure drag.
The volumes are industrial. A single exchange, PubMatic, reports coordinating more than 100 billion real-time auctions and nearly a trillion bids every day (2025 annual report). Each bid has to arrive inside a deadline the exchange sets per request, which on Google’s exchange typically ranges from 80 to 1,000 milliseconds. Every answer is a small charge for compute, and it lands whether or not the impression was worth anything.
“Online ad impressions are more like snowflakes than stocks: no two are exactly alike, and they melt.”
— George John, then CEO of Rocket Fuel, VentureBeat (2010): responding to a question comparing programmatic ads to high-frequency stock trading.
The snowflakes melt. The bill for making them does not.
Nor is that bill a fixed line. Compute is priced as a live market: on-demand against reserved capacity, with prices that move with demand. In January 2026, AWS raised the price of reserved GPU capacity by about 15% as AI workloads bid for the same silicon. The best operators push their unit costs down regardless. PubMatic, known in our work and by its own account for owning and operating its infrastructure rather than renting it from cloud providers, reports its cost of revenue per million impressions processed fell 20% in 2025. In its 2025 annual report, the company says owning its hardware “saves significant infrastructure expenditures as compared to public cloud alternatives.” But efficiency only moves the question from what compute costs to how much of it is spent on requests that never earn. Cost per request is a variable to manage, not a constant to ignore. When it rises faster than revenue per request, scale stops being growth and becomes a faster way to lose money.
03Where the advertiser dollar goes
Follow the money and the gap becomes visible. When ISBA and PwC traced UK programmatic spend end to end, publishers received about half of each advertiser pound. Identified fees, to agencies, demand-side platforms, ad tech, and supply-side platforms, took roughly a third. And 15% could not be attributed to anyone at all: the study called it the unknown delta (ISBA/PwC, 2020).
The US picture, measured differently, is no kinder. The Association of National Advertisers found that of each dollar entering a DSP, 29% goes to transaction costs, 35% buys inventory that is non-viewable, invalid, non-measurable, or made-for-advertising, and just 36% effectively reaches a consumer (ANA, 2023).
When ISBA repeated its study in 2023 with far better data matching, the unattributable share fell to 3%. That is progress, and it is also the point: a good part of the delta lived in records no one could reconcile. In a market this opaque, simply being able to see where the money went is a competitive advantage.
Tim Hwang gave the pattern its name in Subprime Attention Crisis. Programmatic advertising behaves the way the subprime mortgage market did: low-quality assets, in this case impressions, are bundled, resold through a stack of opaque intermediaries, and priced as if they were sound. Everyone trades on the volume. Almost no one checks the value underneath it.
04Two loops, one margin
Most of the industry still reasons about this linearly: an advertiser pays, a consumer sees an ad. Each participant reports its own slice of that line, and the slices rarely reconcile. It is a Rashomon effect, many plausible accounts of the same event and no shared truth. The system reads more clearly as two feedback loops that share a single output.
- R1, the revenue engine. More traffic produces more bid requests, more fill, and more revenue. This is the growth slope everyone plans around.
- B1, infrastructure drag. The same traffic produces more server load, more API calls, and more variable hosting cost. This is the slope almost no one plans around.
Read this way, the useful question is never whether traffic is growing. It is which loop is growing faster.
05The bot factor
Now add the input that turns a leak into a structural problem. Automated traffic accounted for more than 53% of all web traffic in 2025, according to the 2026 Imperva Bad Bot Report. Bots do two things to the system at once. They inflate the number of requests, which drives cost up, and they dilute the pool of real attention, which drives its price down. More cost and less revenue, from the same event.
Underneath sits the harder truth at the center of the paradox: it is easier to monetize a bot than a person. A bot does not churn, complain, install a blocker, or opt out. It produces clean, countable events on demand. In a system that pays on counted events, the frictionless synthetic user is the more convenient customer. The incentives do not merely tolerate fake traffic. They quietly reward it.
“It is easier to monetize a bot than a person. A bot never fusses.”
— Shailin Dhar
This is not theoretical. In one experiment, a site that drew a million visits, most of them fake, did more than inflate its vanity numbers. It ran up real infrastructure cost, because the machines still had to answer every request.
06From vanity metrics to sanity metrics
The way out starts with the scorecard. The industry optimizes for volume: impressions, visits, bid volume. In a system where volume and cost climb together, those are vanity metrics. Peter Drucker drew the distinction that matters in Management: Tasks, Responsibilities, Practices (1974): “Efficiency is concerned with doing things right. Effectiveness is doing the right things.” Volume measures neither. Four measures do.
| Measure | How to calculate it | What it tells you |
|---|---|---|
| Cost per request (CPR) | Variable infrastructure cost ÷ requests processed | What it physically costs to handle one opportunity, whether or not it earns anything |
| Request-to-render ratio | Bid requests received ÷ ads rendered | How many opportunities you process, and pay for, to deliver one ad |
| Human traffic rate | Verified human sessions ÷ total sessions | How much of the input is a real economic actor |
| Net RPM | (Revenue − variable cloud cost) ÷ (requests ÷ 1,000) | What a thousand requests are worth after the cost of serving them |
Net margin ties them together: total revenue minus the variable infrastructure cost that produced it. That one change reframes every decision. A million low-value, bot-heavy visits can post a bigger top line and a thinner margin than a hundred thousand verified human ones.
Two diagnostic questions follow. What does it physically cost to process one bid opportunity? And how many of the partners in your header-bidding wrapper ever bid at all? Endpoints that never bid still add latency and cost to every request. Removing them is often the cheapest margin available.
07Own the path, verify the human
The remedies are structural, and they point the same way: fewer, better-understood requests.
- Shorten the supply path. Supply path optimization cuts redundant exchange and reseller hops, prefers direct paths, and sets quality thresholds that partners must clear. Each hop removed takes a fee, some latency, and a source of noise with it.
- Filter at the input. If you do not filter before a request is processed, you pay for the process without the outcome. Verification before the bid is cheaper than regret after it.
- Change the default. Most detection is incrimination-based: traffic is treated as human until proven to be a bot, so anything new slips through. An exoneration-based posture inverts the burden: traffic is treated as automated until it passes a strict test of humanity.
08Volume is vanity, margin is sanity
The paradox is not that the internet cannot be monetized. It is monetized ferociously. The paradox is that the machinery that captures value also manufactures cost, and does both faster as it grows. Left alone, it keeps selling more choice to more people for a smaller sliver of real value.
“The goal was never to maximize the number. It was to keep the margin. Those are not the same system, and at scale they point in opposite directions.”
— Shailin Dhar
The businesses that come through the next decade intact will be the ones that learned to measure the margin, not the volume. They will know their cost per request, filter at the input, verify the human, and own their supply path.
09Sources
- Imperva (Thales), 2026 Bad Bot Report, April 2026. Automated traffic was more than 53% of all web traffic in 2025.
- ISBA and AOP, carried out by PwC, Programmatic Supply Chain Transparency Study, May 2020; and the second study, January 2023.
- Association of National Advertisers, Programmatic Media Supply Chain Transparency Study, December 2023.
- PubMatic, Form 10-K for fiscal 2025, February 2026; and fourth-quarter and full-year 2025 results.
- Google Authorized Buyers, real-time bidding latency guide; IAB Tech Lab, OpenRTB 2.6.
- The Register, “AWS raises GPU capacity block prices”, January 2026.
- George John, “You can’t manage online ad inventory like a stock market”, VentureBeat, February 2010.
- Tim Wu, The Attention Merchants, Knopf, 2016.
- Tim Hwang, Subprime Attention Crisis, FSG Originals × Logic, 2020.
- Peter F. Drucker, Management: Tasks, Responsibilities, Practices, Harper & Row, 1974 (attribution traced by Quote Investigator).
Futureproof TMT
Seeing something like this in your own data?
Our team advises enterprises, counsel, and families on the automated internet.