A new report released today by Thales SA had found that bot traffic now makes up nearly half of all internet traffic globally and that bad bots account for a significant number of those bots.

The details come from the 2024 Imperva Bad Bot Report, an analysis of automated bot traffic across the internet in 2023. Bot traffic was found to account for 49.6% of all internet traffic, up 2% from 2022 and the highest level Imperva has reported since it began monitoring automated traffic in 2013. Imperva has been owned by Thales since December last year.

The portion of internet traffic associated with bad bots also grew last year, coming in at 32% of all internet traffic, up from 30.2% in 2022. At the same time, traffic from human users fell to 50.4%. The report says automated traffic is costing organizations billions of dollars annually due to attacks on websites, application programming interfaces and applications.

The level of bad bot traffic varies between countries. Ireland surprisingly topped the list, with 71.4% of all internet traffic found to be bad bots, versus 26.6% human traffic and 2% good bots. In Germany, bad bots accounted for 67.5% of all internet traffic, in Mexico 42.8% and in the U.S. 35.4%, the latter up from 32.1% in 2022.

Artificial intelligence is noted in the report as being behind a rise in simple bots. The rapid adoption of generative AI and large language models is said to have resulted in the volume of simple bots increasing to 39.6% in 2023, up from 33.4% the year prior. The simple bots ranged from web scraping bots and automated crawlers to train models, along with automated scripts written by non-technical users for personal use.

Account takeover attackers were found to be up 10% in 2023, with 44% of ATO attacks targeting API endpoints, up from 35% in 2022. Of all login attempts across the internet, 11% were associated with account takeover attacks, with the highest volume of attacks targeting the financial services industry.

The gaming industry accounted for 57.2% of all bad bot traffic in 2023. Behind gaming, retail sat at 24.4%, travel at 20.7% and financial services at 15.7%. Advanced bad bots, those that mimic human behavior and evade defenses, were most targeted against law and government, followed by entertainment and financial services.

“Automated bots will soon surpass the proportion of internet traffic coming from humans, changing the way that organizations approach building and protecting their websites and applications,” warned Nanhi Singh, general manager of application security at Imperva. “As more AI-enabled tools are introduced, bots will become omnipresent. Organizations must invest in bot management and API security tools to manage the threat from malicious, automated traffic.”

Image: Thales