Thales Bad Bot Report exposes new attack patterns

The latest Thales Bad Bot Report points to a deeper shift in how the internet actually works today. What once felt like a human-driven space is now increasingly controlled by automation. The report shows that AI is not just adding more bots, it is changing how they behave, interact, and operate across digital systems. This is not a temporary spike. It signals a structural change in the way online activity is evolving.

At the centre of this shift is the rise of AI-powered automation that blends into regular traffic. Bots are no longer easy to spot or isolate. Instead, they are becoming part of the system itself, interacting with applications and APIs in ways that look almost human. This creates a new challenge for organisations trying to understand what is legitimate and what is not.

AI is blurring the line between good and bad bots

One of the key insights from the Thales Bad Bot Report is how AI is redefining bot behaviour. In 2025 alone, AI bot attack surge statistics show a 12.5x increase compared to the previous year. But the bigger shift is not just volume, it is complexity. AI agents are now emerging as a third category of traffic, sitting somewhere between good and bad bots.

These agents interact directly with systems to perform tasks and retrieve data, making it harder to judge intent. The traditional model of identifying and blocking bots is starting to break down. Organisations now need to understand behaviour, not just presence. This shift creates a visibility gap where many automated activities remain unverified or misunderstood.

Bots are now the majority online

The report highlights a simple but striking reality. Bots now account for more than 53% of all web traffic, while human activity has dropped to 47%. This is not tied to specific events or attack campaigns. Instead, bots have become a constant layer across digital environments, operating continuously in the background.

This change affects how businesses measure engagement, performance, and even user behaviour. When automation becomes the majority, the idea of “normal traffic” starts to change. For many organisations, this means rethinking how they monitor and manage their digital systems.

APIs and identities are the new targets

Another major shift highlighted in the Thales Bad Bot Report is where attacks are happening. API bot attacks 2026 trends show that 27% of bot attacks now focus on APIs. These attacks bypass user interfaces and interact directly with backend systems, often using valid credentials and structured requests.

This makes detection harder and impact more serious. In sectors like financial services, bots are being used for AI-driven account takeover attempts and data extraction at scale. The report notes that financial services alone accounted for 24% of bot attacks and nearly half of account takeover incidents, showing how automation is now directly linked to monetisation.

From blocking bots to managing automation

The report makes one thing clear. The old approach of blocking bots is no longer enough. In a world where automation is both useful and risky, organisations need a more balanced strategy. This includes defining which bots are allowed, setting clear policies, and analysing behaviour in real time.

The shift is toward governance. Instead of reacting to threats, businesses need to actively manage how automation interacts with their systems. This means focusing on visibility, control, and adaptability as bots continue to evolve.

A machine-driven internet

The Thales Bad Bot Report captures a turning point. The internet is no longer just a human space with occasional bot interference. It is a machine-driven environment where automation plays a central role. For organisations, the challenge is not stopping this change, but learning how to control it without losing security or trust.

Read More: 

Unleash Networks debuts Trisul AI assistant to streamline network intelligence

RAH Infotech appoints Mahesh Desai signalling deeper enterprise shift

NetSuite SuiteCloud Agent shifts how developers build

Cygnet.One EmaraTax portal integration reshapes UAE compliance