The web just crossed a symbolic threshold. According to data published by an internet infrastructure provider, the share of global web traffic generated by bots has surpassed humans for the first time, reaching 57.5%, with human traffic falling to 42.5%. More notably, this crossover arrived a full year earlier than the industry had predicted.
"Welp, that happened faster than I predicted." That remark from an executive captures the real driver — not the simple data-scraping crawlers of the past, but the fast-rising tide of "agentic" AI traffic.
1. The "purpose" of bots is changing
In the past, bot traffic mostly evoked search-engine indexing or malicious scanning. But the protagonist of this wave is different: AI agents acting on a user's behalf. They proactively read product pages, check live prices, compare flights, fetch content for large language models, and even order food, compare deals, and handle customer service.
In other words, more and more of what visits your site is no longer a person, but a software agent making decisions on a person's behalf. For enterprises, this is both an opportunity and a challenge.
2. Why this is a security issue, not just a traffic number
One point needs clarifying: the 57.5% measures HTTP request volume, not dwell time or engagement depth. Humans still dominate "sticky time" in video streaming, social scrolling, and app usage, because humans come to consume content while bots come to fetch data.
But precisely for that reason, enterprises can no longer design defenses on the assumption of "human visitors." When nearly 60% of requests come from automated agents, new risks emerge
- It is hard to tell well-meaning agents from malicious crawlers; the traditional "block all bots" approach may harm legitimate AI services
- Content and pricing data get scraped at scale, affecting competition and data sovereignty
- Surging automated requests raise bandwidth costs and can become a vector for denial of service
- The abuse of VPNs combined with automation makes malicious traffic harder to identify by source
It is worth noting that bot-traffic shares vary enormously by region — some areas exceed 70% — and often correlate strongly with data-center distribution and the local habit of pairing VPNs with automated scraping tools. This means an enterprise's defense strategy must judge dynamically by source and behavior, rather than applying a blanket rule.
3. Concrete actions enterprises can take
With bot traffic becoming the norm, enterprises need not panic but should formally fold "traffic governance" into their security architecture. We suggest starting from several directions
- Deploy traffic-identification mechanisms that distinguish friendly agents, search engines, and malicious crawlers, rather than blocking everything
- Apply rate limiting and anti-scraping protection to sensitive content and pricing data
- Strengthen behavioral analysis at the WAF and CDN layers to spot abnormal automation patterns early
- Define clear policy and technical boundaries between "welcome AI agents" and "unwanted scraping"
4. Conclusion: identification is the starting point of security in the new era
Bots surpassing humans is not a sensational headline but a structural shift in the operating environment. As the web's primary users gradually shift from "people" to "agents," the ability to precisely identify "who is knocking and why" will directly determine an enterprise's security resilience and commercial safety.
For enterprises, now is the time to re-examine traffic protection, access control, and anti-scraping strategy. Building identification capability is what allows you to block threats without missing opportunities in an age flooded with AI agents.