Thales 2026 Bad Bot Report: Malicious Bots Made Up 40% of Observed Web Traffic
Report discovered via Awesome Annual Security Reports.
Summary
Thales reports that bad bots generated 40% of observed web traffic in 2025, while 27% of bot attacks targeted APIs. Daily blocked AI-driven requests rose to 25 million, though expanded detection coverage complicates year-over-year comparisons.
Key points
- Thales' full-year 2025 analysis puts automated traffic at 53% of observed web traffic, with malicious bots accounting for 40%, up from 37% in 2024.
- Blocked AI-driven bot activity increased 12.5-fold to a daily average of 25 million requests. AI coverage expanded during 2025, and the analysis covers only detectable or declared AI clients.
- APIs received 27% of bot attacks. Analysts observed bots bypassing user interfaces and abusing backend workflows through well-formed, often authenticated requests.
- Financial services attracted 24% of bot attacks and 46% of account takeover attacks; retail and travel led targeted business logic abuse.
- Analysts observed adaptive fingerprint manipulation, residential and mobile proxies, session reuse and AI-assisted CAPTCHA solving, making surface-level identification less reliable.
- An insurance case study describes bots abusing SMS authentication APIs to generate approximately $300,000 in messaging charges over 20 days, without compromising customer data.
- The report recommends governing AI-agent access, continuously inventorying APIs, monitoring behavior across sessions and workflows, and applying layered authentication and OTP abuse controls.
Article Details
- Publisher
- Thales
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Web application and API bot activity across industries, based on Thales Threat Research and Security Analyst Services data and mitigation observations.
- Key Statistics
- Thales blocked 17.2 trillion bot requests in 2025.
- Bots accounted for 53% of observed web traffic in 2025: 40% bad bots and 13% good bots. Bad bot traffic increased from 37% in 2024.
- Reported average daily AI-driven bot attacks blocked increased 12.5-fold, from 2 million to 25 million. AI bot coverage expanded in 2025, and the analysis covers only detectable or declared AI traffic.
- API endpoints received 27% of bot attacks in 2025.
- Financial Services accounted for 24% of bot attacks and 46% of account takeover attacks in 2025.
- Recommendations
- Define permitted AI-agent access by application and workflow, allowlist trusted agents, and continuously monitor approved and unverified automation.
- Use adaptive behavioral detection and persistent bot identification rather than relying solely on IP reputation, user-agent strings, static thresholds, or CAPTCHA challenges.
- Continuously discover APIs, enforce strong authentication and authorization, and monitor business workflows for sustained machine-speed abuse.
- Layer MFA with behavioral monitoring of authentication and session activity; rate-limit OTP generation and block disposable-email registrations.
- Keep baseline protections active, continuously review mitigation effectiveness, and combine AI-driven detection with experienced human oversight.
MITRE ATT&CK
T1090.002 · External ProxyBots route traffic through residential and mobile proxy networks to blend into legitimate geographic and behavioral patterns and evade IP-based detection.T1110.004 · Credential StuffingThe report identifies credential stuffing and exploitation of credential reuse as recurring methods used in automated account takeover attacks.T1550.004 · Web Session CookieAnalysts observed bots reusing cookies and session IDs from legitimate sessions to bypass controls.
Vendors
Products
Account Takeover ProtectionWorking with SAS, the organization rapidly configured Account Takeover Protection (ATO), implemented custom rules within Advanced Bot Protection (ABP), and enabled out-of-the-box mitigation capabilities. These controlsImperva Advanced Bot ProtectionAdvanced bot protection solutions, such as Imperva Advanced Bot Protection, provide persistent bot identification capabilities that enable tracking of automated activity across sessions, even as attackers rotate IPs,
Tools
Playwright- **Headless and Automation Frameworks.** Tools such as Puppeteer, Selenium and Playwright remain widely used, now enhanced with AI-generated scripting and real-time behavioral tuning. These tools enable bots to executePuppeteer- **Headless and Automation Frameworks.** Tools such as Puppeteer, Selenium and Playwright remain widely used, now enhanced with AI-generated scripting and real-time behavioral tuning. These tools enable bots to executeSelenium- **Headless and Automation Frameworks.** Tools such as Puppeteer, Selenium and Playwright remain widely used, now enhanced with AI-generated scripting and real-time behavioral tuning. These tools enable bots to execute
Countries
AustraliaThe United States was the most targeted country for bot attacks in 2025 targeted by 59 percent of all attacks, followed by Australia (12 percent), the United Kingdom (9 percent) and France (3 percent).Canada| **Canada** | 6% |Colombia| **Colombia** | 2% |FranceThe United States was the most targeted country for bot attacks in 2025 targeted by 59 percent of all attacks, followed by Australia (12 percent), the United Kingdom (9 percent) and France (3 percent).Germany| **Germany** | 2% |Mexico| **Mexico** | 2% |Singapore| **Singapore** | 2% |Spain| **Spain** | 2% |United KingdomThe United States was the most targeted country for bot attacks in 2025 targeted by 59 percent of all attacks, followed by Australia (12 percent), the United Kingdom (9 percent) and France (3 percent).United StatesThe United States was the most targeted country for bot attacks in 2025 targeted by 59 percent of all attacks, followed by Australia (12 percent), the United Kingdom (9 percent) and France (3 percent).
Industries
Computing & ITTelecoms, Society (Non-Profit), Computing & IT, Travel, and Business sectors rank among the top five industries with the highest proportion of bad bot traffic.Education- **Education:** 8%Financial Services- [A Real-Life Bot Mitigation in the Financial Services Industry](#a-real-life-bot-mitigation-in-the-financial-services-industry)Gaming| **Gaming** | 38% | 22% | 40% |Healthcare| **Healthcare** | 42% | 4% | 54% |Insurance- [A Real-Life Bot Mitigation in the Insurance Industry](#a-real-life-bot-mitigation-in-the-insurance-industry)Law & Government- **Law & Government:** 7%Retail- [Retail & Travel Lead in Targeted Business Logic Abuse](#retail--travel-lead-in-targeted-business-logic-abuse)Telecom & ISPs| **Telecom & ISPs** | 62% | 12% | 27% |Travel- [Retail & Travel Lead in Targeted Business Logic Abuse](#retail--travel-lead-in-targeted-business-logic-abuse)