AI Bots are Changing the Rules
AI-driven automation is no longer emerging; it is becoming embedded in internet traffic. The 2026 Thales Bad Bot Report explores how AI-driven automation is transforming the way applications and APIs are accessed, with bots now accounting for the majority of global web traffic. As agentic AI introduces a new class of automated traffic, organizations must navigate an increasingly complex environment where intent is harder to detect, distinguish, and control.
Based on analysis of full-year 2025 bot activity, this report combines insights from Thales Threat Research and Security Analyst Services (SAS) teams, who investigate and mitigate bot attacks across industries worldwide.
Protect against bad bots
Organizations can no longer afford to ignore bots. Most are not benign; they are abusing your business. Any functionality on your website is a potential target of malicious bots. Imperva Advanced Bot Protection protects from all OWASP Automated Threats. By blocking bad bots, Imperva helps reduce fraud and business abuse.
How advanced bot protection works
Multi-layered approach to detect malicious bots, combining direct client interrogation, behavior analysis, machine learning (ML), connection characteristics, and threat intelligence feeds. This comprehensive approach lets us detect over 700 dimensions to separate between human, good, and bad bot traffic, creating a unique fingerprint that withstands even the most sophisticated evasion techniques.
Imperva’s detection capabilities provide unparalleled precision and accuracy in identifying malicious bots. They are backed by rigorous testing and validation against historical data and hundreds of browsers to ensure accuracy. Our post-deployment feedback loops and metadata replay help minimize false positives and negatives, ensuring that our detections are consistently precise and reliable.
Stay ahead of evolving threats with superior adaptability that goes beyond “risk scores”. Unlike black box solutions, our platform offers full visibility and granular tuning, allowing you to customize defenses to your specific needs. This transparency ensures higher efficacy, minimizes false positives, and enhances incident response capabilities.
Analyze trending data across applications or in detail by path or rule. Identify targeted applications and paths, and optimize mitigation strategies. Imperva offers advanced reporting capabilities tailored to address organizations’ unique and varying needs. Leverage hundreds of unique dimensions to create customized dashboards and reports that meet your organization’s requirements.
Advanced Bot Protection empowers customers with robust reporting and real-time testing tools. These provide a clear guide for policy creation, false positive analysis, and strategy refinement. Real-world testing in a production environment ensures accurate configurations and effective bot-blocking, giving customers confidence in their bot management strategy.
Being in the airline and travel industry, we're aware of the importance of safeguarding our online platforms and booking engines from the diverse traffic we receive. The online landscape is filled with potential threats, particularly bot attacks. Recognizing this challenge, our quest was to find a solution that consistently delivers value. Imperva has not disappointed in meeting those expectations."
Learn about the growing threat of bad bots