Automated bot traffic has surpassed human online activity for the first time in a decade, according to research from Imperva, accounting for 51% of all web traffic.
The 2025 Bad Bot Report found that automated threats continue to rise, with malicious bots now making up 37% of all internet traffic.
Attackers are able to create more advanced and evasive bots with AI. But more concerning is the way it lowers the barrier for newer or less skilled hackers to create low-quality bots, resulting in an increase in simple attacks, according to the report.
This is the 12th annual Bad Bot Report from Imperva. It’s based on insights from its Threat Research and Security Analyst Services teams with data collected from across the firm’s global network. That includes the blocking of 13 trillion bad bot requests across thousands of domains and industries, according to Imperva.
“The surge in AI-driven bot creation has serious implications for businesses worldwide,” said Tim Chang, general manager of Application Security at Imperva’s parent company, Thales. “As automated traffic accounts for more than half of all web activity, organizations face heightened risks from bad bots, which are becoming more prolific every day.”
Chang added that the 2025 report sheds light on the evolving tactics and techniques being used by threat actors. The advanced evasion methods that can be created with AI are now widely available, resulting in a rapidly changing threat environment for business. As a result, Chang urged them to evolve their own strategies.
“It’s crucial to adopt an adaptive and proactive approach, leveraging sophisticated bot detection tools and comprehensive cybersecurity management solutions to build a resilient defense against the ever-shifting landscape of bot-related threats,” Chang said.
Advanced AI tools, such as ChatGPT, ByteSpider Bot, ClaudeBot, Google Gemini, Perplexity AI, and Cohere AI, are transforming user interactions. What’s more, they’re providing new methods of attack for would-be and professional hackers.
The ByteSpider Bot alone is responsible for 54% of all AI-enabled attacks, according to Impervia. AppleBot was attributed to 26%, ClaudeBot 13%, and the ChatGPT User Bot accounted for 6%, according to the Imperva Threat Research team.
