Imperva Says Automated Traffic Exceeded 53% in 2025

Imperva's 2026 Bad Bot Report says automated traffic represented more than 53% of web traffic in its 2025 observations, up from 51% the previous year, while human traffic declined to 47%. The company also reported that 27% of bot attacks targeted APIs and that financial services accounted for 24% of bot attacks and 46% of observed account-takeover incidents.

A machine-heavy internet changes the baseline

Automation is no longer an occasional anomaly around otherwise human traffic. Search crawlers, monitoring, aggregators, partner systems, AI agents, scrapers, fraud tools, and attack scripts all share the same web and API infrastructure. Security controls therefore need to answer whether the activity is known, permitted, proportionate, and safe for the requested action.

This also affects analytics and capacity planning. Automated requests can inflate page views, distort conversion funnels, consume API quotas, create artificial inventory demand, and trigger expensive downstream work. Even a non-malicious bot can create an operational problem when it acts without an agreed rate or scope.

APIs and identity systems deserve separate controls

The report's API and account-takeover findings point to workflows where valid-looking requests can still be harmful. Credential stuffing uses ordinary login requests. Enumeration uses valid search or recovery behavior. Automated agents can call application APIs directly and bypass browser-only controls.

• Apply rate and abuse controls to the API route that performs the action, not only the visible form.
• Correlate failures by account, device, network, session, and credential set to reduce simple IP rotation evasion.
• Use multi-factor authentication and secure recovery, while recognizing that phishing-resistant methods provide stronger protection than reusable codes.
• Protect authenticated actions from automation abuse; successful login is not proof that every later action is legitimate.
• Preserve decision reasons and API status so blocked traffic can be distinguished from integration or service failure.

Move from bot blocking to automation governance

A governance model gives each automated actor a scoped relationship with the application. Known search crawlers can access indexable content within crawl policy. Uptime monitors can reach dedicated health endpoints. Partners can use authenticated APIs with quotas. Unknown automation can be monitored or constrained. Malicious activity can be denied based on the strongest available evidence.

1. Inventory automated actors and the routes they use.
2. Verify identity where a trustworthy verification mechanism exists.
3. Define permission by action, purpose, rate, and data sensitivity.
4. Combine network, request, client, reputation, and behavioral evidence.
5. Apply a proportionate decision and document what happens during uncertainty or service failure.
6. Review allowed automation, false positives, and harmful outcomes on a recurring schedule.

Metrics that matter more than bot volume

The percentage of traffic labeled automated is useful context, but it does not show whether controls are working. Measure prevented account takeover, reduced fraudulent transactions, protected inventory, lower infrastructure waste, preserved search visibility, and legitimate completion rates. Track API latency and error handling alongside decisions so a protection layer does not become an invisible availability risk.