For the first time, automated programs, or bots, now represent the majority of internet traffic, driven by a surge in artificial intelligence-powered activity, according to a new report from cybersecurity firm Imperva. The findings highlight a significant shift in the digital landscape, with implications for online businesses, cybersecurity, and the user experience.
Bot Traffic Reaches Majority
The 2025 Imperva Bad Bot Report, which analyzed data from 2024, revealed that bots account for more than half of all internet traffic. It marks a notable increase from previous years and signifies a tipping point where artificial traffic outweighs human activity.
Rise of Malicious Automation
Of this automated artificial traffic, 'bad bots' – those used for malicious purposes such as data scraping, credential stuffing, spreading rumors, and launching denial-of-service attacks – constituted a significant 37%. This is a considerable increase from 32% in the prior year. However, it's important to note that not all bots are bad. 'Good bots,' which perform legitimate functions like search engine indexing, website monitoring, and customer service chatbots, comprised only 14% of total traffic.
AI Fuels Bot Proliferation
The proliferation of sophisticated AI tools is a key driver behind this growth in bot traffic. These tools have lowered the barrier to entry for creating and deploying bots, enabling even less technically skilled actors to launch automated campaigns at scale. "The surge in AI-driven bot creation has serious implications for businesses worldwide,” said Tim Chang, General Manager of Application Security at Thales, which acquired Imperva. “As automated traffic accounts for more than half of all web activity, organizations face heightened risks from bad bots, which are becoming more prolific every day,” he added.
Industry Impact and Evolving Threats
The report indicates that industries such as travel, retail, and financial services are particular targets of malicious bot activity. These automated attacks can lead to significant economic losses, compromised user accounts, skewed analytics, and severe damage to brand reputation. Account takeover attacks, often facilitated by bots testing stolen credentials, saw a 40% year-over-year increase, underscoring the gravity of the evolving threat.
Calls for Advanced Security Measures
Experts strongly urge businesses to adopt more adaptive and intelligent security measures to differentiate between human and bot traffic and to mitigate the risks posed by malicious automated programs. The increasing sophistication of AI-powered bots, capable of mimicking human behavior more convincingly, presents an ongoing challenge for detection and prevention. This new reality of a bot-majority internet requires a proactive re-evaluation of online security strategies and a greater awareness of the automated interactions occurring across the web.
