Bots Now Account For More Than Half Of All Internet Traffic, Thales Report Finds

Automated bot traffic has overtaken human activity on the internet, with AI-driven bot attacks increasing 12.5 times year-on-year according to the 2026 Bad Bot Report published by Thales.

The report, subtitled Bad Bots in the Agentic Age, draws on full-year 2025 data and paints a picture of an internet that is now fundamentally shaped by machine-driven interaction rather than human browsing.

Bots accounted for more than 53 per cent of all web traffic in 2025, up from 51 per cent the previous year, while human activity dropped to 47 per cent. Of all bot traffic, 40 per cent was classified as malicious.

AI agents blur the line

One of the report’s central findings is that AI is not simply increasing the volume of bot activity but changing its nature. AI agents are now emerging as what Thales describes as a third category of internet traffic, sitting alongside traditional “good” and “bad” bots.

These agents interact directly with applications and APIs to retrieve data and perform tasks. The problem, according to the report, is that this activity is often indistinguishable from legitimate traffic, creating a visibility gap for organisations trying to assess risk.

Tim Chang, Global Vice President and General Manager of Application Security at Thales, argued the challenge has moved beyond simple identification.

“AI is transforming automation from something organisations try to block into something they must also manage,” Chang explained. “The challenge is no longer identifying bots. It’s understanding what the bot, agent or automation is doing, whether it aligns with business intent, and how it interacts with critical systems.”

APIs and identity systems under pressure

The report identifies APIs and identity systems as primary targets for automated attacks. It found that 27 per cent of bot attacks now target APIs, where bots can bypass user interfaces and interact directly with backend systems at machine speed.

These attacks often appear legitimate on the surface, using valid authentication and properly formed requests. However, they exploit business logic, extract sensitive data or manipulate workflows at scale.

Financial services bore a disproportionate share of the impact, accounting for 24 per cent of all bot attacks and 46 per cent of account takeover incidents. Thales pointed to this as evidence that automation is being used to directly monetise cyberattacks.

A structural shift, not a temporary spike

Thales characterised the growth in bot traffic as a structural change rather than a temporary trend. Bots are no longer tied to specific events like scraping campaigns or credential stuffing operations but instead operate as a persistent presence across digital environments.

The report argues that bots are now active participants in digital systems, shaping traffic patterns, influencing business metrics and interacting with infrastructure in real time.

Traditional defences falling short

The report concludes that security approaches focused primarily on identifying and blocking bots are no longer sufficient in an environment where automation is both widespread and often legitimate.

Thales recommends organisations move toward a governance-based model that combines visibility, policy enforcement and behavioural analysis to distinguish between acceptable and harmful automation.

This includes defining which AI agents are permitted to interact with systems, implementing controls at the API and identity layer and designing defences that can adapt as bots evolve.

The scale of the problem

The shift toward machine-dominated internet traffic raises questions for any organisation that relies on web-based services. If more than half of all traffic is automated and a significant portion of that is hostile, the assumptions underpinning traditional web security and analytics are increasingly unreliable.

The 2026 Bad Bot Report was compiled by Thales Threat Research and Security Analyst Services teams using data collected across 2025. The full report examines how AI-powered automation is reshaping application security, API exposure and digital infrastructure globally.

Last Updated on April 29, 2026 by Nick Ross