Analysis by cybersecurity firm Imperva and its parent Thales Group reports that bots represented 49.6 per cent of all internet traffic in 2023, growing from 47 per cent the year prior. In its 2025 update the number nudged past the 50 per cent mark. The shift reflects intensified automation in web operations, scraping, digital attacks and artificial-intelligence indexing systems.
One key driver is the rise of generative AI. Bot activity linked to AI training and automated scripting rose to 39.6 per cent of traffic in 2023, up from 33.4 per cent the previous year. These bots harvest data, mimic human behaviour and enable fraud, demonstrating that automation is no longer limited to benign tasks such as search engine indexing but is integral to malicious operations. For example, account takeover attacks increased 10 per cent in 2023, with 44 per cent of those targeting APIs instead of traditional web interfaces.
Industries are being hit hard. The gaming sector saw the largest proportion of bad-bot traffic at 57.2 per cent, followed by law-and-government at 75.8 per cent vulnerability for advanced bot incursions. Retail, travel and financial services also faced significant impacts with 24.4 per cent, 20.7 per cent and 15.7 per cent bad-bot traffic respectively. These intrusions affect not only infrastructure integrity but also brand trust, consumer experience and financial metrics.
More than just volume, the nature of bot traffic is evolving. Sophisticated ‘good-looking’ bots are designed to evade detection by mimicking human patterns, using residential IP proxies and mobile user-agents. Some bots are operating at levels that make human behaviour a minority. This supports theories such as the so-called “dead internet theory,” under which human presence online is significantly diminished and much content is generated automatically.
For businesses, what was once a peripheral threat is now a core operational concern. The blurring of traffic origin renders analytics unreliable, complicates digital marketing and undermines revenue models that assume human interaction. One expert warned: “As automated traffic accounts for more than half of all web activity, organisations face heightened risks from bad bots.” Cybersecurity units emphasize the need for layered defences, improved bot-management tools, and strengthened API security to control the flood of non-human access.
Yet the surge in bot traffic is not entirely negative. Automated web crawlers power search indexing, data collection for AI and legitimate monitoring. The challenge lies in distinguishing benevolent bots from malicious ones, and ensuring that human-centric digital space remains vibrant. Reports suggest that good bots may account for a substantial portion of non-human traffic, even though the line between benign and harmful is increasingly blurred.
Significantly, the economic consequences are tangible. The Imperva report estimates that bot-driven automation costs organisations billions of dollars annually through service degradation, fraud and inflated infrastructure requirements. This has drawn attention from policymakers and regulators, who are beginning to examine how to ensure transparency in digital metrics and protect consumers from bot-driven manipulation.
Research also points to generative AI as a force multiplier. The emergence of large language models and AI content tools has expanded the reach and capability of bots. Analysts note the correlation between these advances and the steep rise in automated traffic—not just in numbers but in strategic sophistication.
From the perspective of internet users, there is growing concern that human interaction is being relegated to niche corners of the web, while mainstream channels are dominated by algorithmic traffic and automated content echo-chambers. This has implications for discourse, the reliability of online measurements and digital business models built around human engagement.
In the face of these developments, organisations are adapting. Businesses are investing in bot-detection software, API gateways, anomaly analytics and identity verification to reduce non-human traffic. Governments and industry bodies are exploring regulatory frameworks that force disclosure of bot prevalence and more accurate metrics. The nature of the internet is undergoing a shift in which oversight of automated traffic may become as crucial as ensuring network uptime.