This year’s report from Thales, Bad Bots in the Agentic Age, highlights a fundamental shift in how the internet operates. AI-driven automation is reshaping the internet and security as machines, especially bad bots, outpace human online activity.

Bots now account for 53% of all internet traffic, up from 51% the previous year, with 40% classified as malicious, while human activity continues to decline.

Key findings include:

• Automated traffic now exceeds human activity for the second consecutive year
• Bad bots represent the majority of automated traffic
• AI-driven bot attacks increased 10x year over year
• Financial Services is the most targeted industry, accounting for 24% of attacks

“The challenge is no longer identifying bots. It’s understanding what the bot, agent, or automation is doing, whether it aligns with business intent, and how it interacts with critical systems.”
– Tim Chang, Global Vice President and General Manager, Application Security at Thales

Read the full report to understand what this shift means for your applications, APIs, and security strategy.