AI has led to a remarkable shift in internet traffic. Automated traffic (51 percent) is greater than human traffic for the first time in ten years.
This is evident from the 2025 Imperva Bad Bot Report by Thales. The emergence of accessible AI tools has drastically lowered the threshold for cybercriminals. As a result, malicious bots now make up 37 percent of all internet traffic, a significant increase from 32 percent in 2023. The increased availability of AI tools means that less advanced actors can launch more and more bot attacks. Attackers also use AI to analyze failed attempts and refine their techniques.
Travel sector most affected target
The travel sector will be the most affected by bot attacks in 2024, accounting for 27 percent of all attacks, compared to 21 percent in 2023. A notable shift is towards simple bot attacks (52 percent) instead of advanced attacks (41 percent). This confirms that AI-driven automation tools lower the threshold for attackers, making it easier for less advanced actors to carry out attacks.
The retail sector is also struggling with a serious bot problem. 59 percent of traffic to this sector consists of malicious bots. This shows that cyber criminals increasingly opt for large numbers of simple bots to flood websites, leading to more frequent and widespread attacks.
API-focused attacks on the rise
Another worrying trend is the increase in API-focused attacks. The report shows that 44% of advanced bot traffic is now focused on APIs. Attackers use bots designed to exploit vulnerabilities in API processes, leading to automated payment fraud, account takeovers and data theft.
“The increase in AI-driven bot creation has major consequences for companies worldwide,” says Tim Chang, General Manager of Application Security at Thales Cybersecurity Products. “With automated traffic now accounting for more than half of all web activity, organizations are increasingly at risk from malicious bots, which are growing in number by the day.”