The proportion of web traffic associated with bad bots grew to 32 percent in 2023. This was up from 30.2 percent in 2022, while traffic from human users decreased to 50.4 percent. Automated traffic is causing substantial financial loss to organizations due to attacks on websites, APIs, and applications. When looked at by country, Ireland, Germany, and Mexico saw the highest levels of bad bot traffic in 2023.

The US also experienced a slightly higher ratio of bad bot traffic at 35.4 percent compared to 2022 (32.1 percent). In terms of industry, gaming saw the largest proportion of bad bot traffic, while retail, travel, and financial services experienced the highest volume of bot attacks. Advanced bad bots, which closely mimic human behavior and evade defenses, were most prevalent on law and government, entertainment, and financial services websites. Nanhi Singh, general manager of application security at Imperva, a Thales company, noted that bots are increasingly posing a threat to every industry.

They negatively impact an organization’s bottom line by degrading online services and requiring more investment in infrastructure and customer support. Organizations must proactively address the threat of bad bots as attackers sharpen their focus on API-related abuses that can lead to account compromise or data exfiltration. The rapid adoption of generative AI and large language models has led to the volume of simple bots increasing to 39.6 percent in 2023, up from 33.4 percent in 2022. This technology uses web scraping bots and automated crawlers to feed training models, and enables non-technical users to write automated scripts for their own use.

Singh added that automated bots will soon surpass the proportion of internet traffic coming from humans, leading to changes in the way organizations approach building and protecting their websites and applications. As more AI-enabled tools are introduced, bots will become omnipresent.