Bad Bots Overtake Humans in Surprising Digital Milestone
For the first time in a decade, automated bot traffic now accounts for more than half of all global web traffic, with the majority being malicious.
The internet has become a ghost town. For the first time in a decade, more web traffic comes from machines than from people. Bots now account for 51 percent of all global web traffic, while humans trail at 49 percent—and the majority of that machine traffic is malicious.
The shift marks a watershed moment in the evolution of the internet. Generative AI tools have lowered the barrier to creating sophisticated malicious bots, making attacks easier and more widespread. Criminals now use the same large language models that power consumer AI assistants to build and deploy automated systems capable of scraping content, stealing credentials and bypassing security measures.
This is the sixth consecutive year of growth in bad bot activity. The share of web traffic from malicious bots has climbed from 20 percent in 2018 to 37 percent in 2024, according to the 2025 Imperva Bad Bot Report from cybersecurity firm Imperva, a unit of Thales. The report, which analyzes 2024 traffic data, was published in 2025. As a vendor with commercial security products, Imperva has an interest in highlighting bot threats, though its findings are consistent with broader industry trends.
The scale of the problem is staggering. Imperva blocked 13 trillion bad bot requests in 2024 alone, averaging 2 million AI-enabled attacks per day. The surge in AI-driven bot creation has serious implications for businesses worldwide, said Tim Chang, General Manager of Application Security at Thales and Imperva. As automated traffic accounts for more than half of all web activity, organizations face heightened risks from bad bots, which are becoming more prolific every day, Chang said.
Bot operators now have AI to analyze where attacks succeed and where they fail, Chang said. They can use AI to adjust and refine the evasion techniques they build into their advanced bots, creating a self-improving adversarial loop that grows more dangerous with each iteration.
The nature of these attacks has evolved alongside the technology. Forty-four percent of advanced bot traffic now targets APIs rather than traditional web applications, exploiting the modern infrastructure that powers cloud-based services and microservices architectures. Account Takeover attacks jumped 40 percent year-over-year in 2024, with financial services most targeted.
The travel sector proved most vulnerable overall, accounting for 48 percent bad bot traffic overall and seeing 41 percent of its bot attacks classified as advanced—down from 61 percent in 2023, a shift Imperva attributes to AI tools lowering the barrier to entry for less sophisticated attackers deploying simpler, high-volume bots. Retail follows with 59 percent bad bot traffic and 15 percent of total bot traffic.
Publishers face a particular crisis as AI scrapes multiply but fail to deliver actual readers. Click-through rates from AI interfaces are 91 percent lower than top-10 organic search CTRs, according to tracking firm TollBit. It takes approximately 135 AI scrapes to produce a single human referral. Google delivers 831 times more visitors to publishers than AI systems combined.
The odds are very much stacked against publishers, said Olivia Joslin, Co-founder and Chief Operating Officer at TollBit. AI traffic will continue to surge and replace direct human visitors to sites. Ultimately, AI will become the primary reader of the Internet, she said.
The asymmetry of the battle favors attackers. If you're on the defensive side, you have to protect from all potential attacks, said Jeff Maxwell, Director of Computer Science and Mathematics at Oklahoma City University. If you're on the offensive side, you only have to find one vulnerability.
AI just makes it easier to put it all together, using the increasing number of AI sources, including ChatGPT, Grok, Google Gemini, Claude and others, Maxwell said. The more information that is fed into these systems, the more knowledgeable and better they get at doing those types of attacks.
As bot operators refine their techniques through AI analysis, defenders face an escalating arms race with no clear end in sight. The technology that powers AI assistants is simultaneously arming criminals with unprecedented capabilities.