Nine in Ten Firms Face a Bot Traffic Crisis as AI Agents Blur the Line

PYMNTS reported that 89.5% of surveyed firms find bot traffic challenging, despite growing confidence in their ability to separate helpful agents from threats. The google news headline captures the scale, but the deeper problem is not simply the number of bots. Businesses must now distinguish malicious automation from software acting for legitimate customers.

That distinction is becoming harder as AI agents start searching products, managing accounts, and initiating purchases. A shopping agent and a fraud bot can perform similar actions at similar speeds. Blocking every automated visitor would reduce risk, but it would also reject emerging forms of legitimate commerce.

The conflict is shifting from humans versus bots to authorized agents versus untrusted automation. Existing controls were designed to recognize people, devices, and accounts. They were not designed to determine whether software has permission to act for a specific person.

The Survey Finds a Broad Bot Traffic Problem

Bot management has become a mainstream operational challenge, not a narrow concern for cybersecurity teams.

The finding comes from a PYMNTS Intelligence study produced with identity verification company Trulioo. The full survey report examined responses from 350 business leaders.

Those respondents worked in compliance, fraud, risk management, underwriting, supplier acquisition, and merchant monitoring. Their companies operated across several geographic markets and revenue categories.

PYMNTS fielded the survey between August 1 and September 10, 2025. It found that 89.5% of organizations considered managing bot traffic at least slightly challenging.

Most firms placed the problem in the slight or moderate categories. Still, only about one in ten said bot traffic created no challenge.

The survey also found that 52.3% of organizations experienced increased bot traffic during the preceding year. Fewer than 10% said volumes remained stable.

That result matters because it shows movement in both directions. Some businesses experienced lower traffic, while a majority faced growth. Very few saw an unchanged environment.

The survey does not establish that every increase involved malicious activity. Bot traffic includes search crawlers, monitoring services, commercial scrapers, customer-facing assistants, and hostile automation.

That mixed population is exactly what makes the result significant. More automation does not automatically mean more fraud, but it increases the number of interactions requiring a trust decision.

A security system can challenge unfamiliar software or block it outright. However, those responses become costly when an authorized agent is trying to complete a customer’s request.

The survey measured this cost through false positives, meaning legitimate digital transactions incorrectly identified as suspicious. Large enterprises reported a 3.3% false-positive rate.

Firms with annual revenue between $50 million and $250 million reported a lower rate of 2.7%. The difference appears small until it is applied across millions of transactions.

At that scale, a fraction of a percentage point can affect many customers. It can also create support costs, abandoned purchases, and repeated identity checks.

The original google news listing framed the finding as a struggle to manage traffic. The underlying data shows a broader problem involving identity, authorization, fraud, and customer experience.

Companies are not merely deciding whether a request came from software. They are deciding whether that software represents a trusted user and has permission to perform the requested action.

Why Legitimate AI Agents Raise the Stakes

The rise of useful AI agents makes a block-first security policy commercially risky.

Traditional bot defenses often begin with a binary classification. A request is treated as human or automated, then allowed, challenged, restricted, or blocked.

That approach works when automation falls into familiar categories. A declared search crawler might be allowed, while a credential-stuffing bot receives an immediate block.

Agentic AI weakens that simple division. An AI agent is software that can take a sequence of actions toward a user-defined goal.

Those actions can include comparing products, checking availability, completing forms, or managing a subscription. An agent might also enter an authenticated account or initiate a payment.

The behavior can resemble abuse. Both helpful and malicious software can browse rapidly, follow predictable paths, submit forms, and make repeated requests.

HUMAN Security found that traffic from AI agents and agentic browsers grew 7,851% year over year. Its traffic benchmark analyzed more than one quadrillion interactions observed during 2025.

Monthly AI-driven traffic grew 187% between January and December, according to that dataset. Training crawlers still represented 67.5% of observed AI bot volume.

However, agentic systems had begun moving beyond reading pages. HUMAN reported that 77% of agentic activity occurred on product and search pages.

Another 8.8% appeared on account pages, while 5% reached authentication flows. Checkout pages accounted for 2.3% of observed agentic activity.

These percentages show why commerce companies face immediate pressure. Agents are reaching the same sensitive surfaces targeted by account-takeover and payment-fraud operations.

The security question therefore changes at each stage. Reading a public product page carries different risk from changing an address inside an authenticated account.

A retailer might welcome an agent comparing available products. The same retailer needs stronger evidence before letting that agent redeem stored value or change payment information.

Large enterprises appear especially exposed. The PYMNTS study found that 57% of companies with at least $1 billion in revenue experienced bot-related or agent-related incidents or losses.

The comparable figure was 32% among smaller companies. The survey does not prove that company size caused those incidents.

Larger organizations usually operate more sites, accounts, markets, and payment flows. They also present more valuable targets and process more interactions where a classification mistake can occur.

This creates pressure across multiple departments. Security teams want fewer successful attacks, while revenue teams want fewer rejected customers.

Compliance leaders need defensible identity controls. Product teams want agents to access useful features without gaining excessive authority.

Readers following the story through google news should not interpret it as evidence that all AI agents are unsafe. The conflict is about missing trust signals, not automation alone.

The Real Contest Is Authorization Versus Behavioral Guesswork

Businesses need to verify an agent’s authority, rather than infer its intent from speed and browsing behavior alone.

Behavioral detection looks for signals associated with automation or abuse. These can include unusual request rates, scripted navigation, device inconsistencies, and repeated authentication failures.

Such signals remain valuable. They can expose broad attacks, identify suspicious sessions, and trigger stronger verification.

However, behavior cannot always explain who authorized an agent. A legitimate assistant and a hostile bot can produce similar technical patterns.

This is the article’s central conflict. Companies can keep guessing from behavior, or they can build systems that verify delegated authority.

PYMNTS and Trulioo describe this second approach as “Know Your Agent,” or KYA. The term refers to controls that identify an automated actor and connect it with verified authority.

KYA extends familiar identity frameworks. Know Your Customer checks the individual, while Know Your Business verifies a commercial organization.

Agent verification adds another layer. It asks which software is acting, whose interests it represents, and what actions that party approved.

The chain matters because a trusted agent can still operate for a compromised account. A verified user can also grant an agent more access than intended.

Useful controls therefore need more than a recognizable bot name. They need a connection among the user, agent, requested action, and applicable limits.

Those limits might cover transaction value, merchant category, time, location, or data access. A user could authorize product research without authorizing a purchase.

Another user might permit a recurring household order but prohibit account changes. The correct decision depends on context, not simply an agent’s identity.

This model resembles delegated access already used in software systems. Applications commonly receive scoped permissions instead of a user’s complete credentials.

Agentic commerce extends that principle into browsing and transactions. The difficult part is preserving authorization across several companies and technical systems.

The user’s assistant, identity provider, merchant, fraud platform, and payment network might all see different portions of the interaction. No single participant automatically has the complete trust record.

That fragmentation leaves businesses relying on indirect clues. A known user agent, stable network address, or signed request can help, but each signal has limits.

Attackers can imitate browser characteristics and rotate through residential networks. They can also compromise legitimate accounts or abuse authorized integrations.

The solution is not a single universal bot score. It is a layered decision that combines identity, declared purpose, authorization, behavior, and transaction risk.

This change also affects analytics. A product page viewed by an agent represents neither a conventional human visit nor necessarily worthless traffic.

The agent may be comparing options for a customer who never visits the site directly. Analytics systems need to connect automated research with later purchases without assuming every request is fraudulent.

That challenge reaches publishing and search as well. Google News, conventional search crawlers, training bots, and answer engines serve different purposes, even when they collect similar pages.

Businesses need policies reflecting those differences. A company might welcome indexing, restrict model training, and permit transactional agents only after authentication.

Confidence Is High, but the Evidence Shows Gaps

Enterprise confidence in bot detection sits uneasily beside reported losses and false-positive rates.

More than nine in ten large enterprises told PYMNTS that they felt confident distinguishing harmful bots from helpful ones. Confidence alone does not establish that their controls work reliably.

The same group reported higher incident rates than smaller companies. Large businesses also recorded the survey’s highest false-positive rate.

Those results are not necessarily contradictory. A company can perform better than its peers while still losing money at a larger absolute scale.

It can also possess strong detection tools but operate across more complex systems. Each additional login, API, subsidiary, and payment route creates another possible control gap.

Still, the contrast deserves scrutiny. Survey participants were leaders responsible for fraud, compliance, risk, and related functions.

Their answers reflect professional assessments, not an independent test of detection accuracy. Companies might also define incidents, bot traffic, and helpful agents differently.

The report was produced with a digital identity vendor, which gives it relevant expertise and a commercial perspective. Readers should treat its recommendations as an informed framework rather than a neutral technical standard.

Independent traffic data supports the larger trend. Imperva reported that automated traffic exceeded human activity during 2024.

Its bad bot research classified 37% of global internet traffic as malicious bots. Another 14% came from good bots, leaving humans at 49%.

Imperva also found that moderate and advanced bots represented 55% of bot attacks. These programs attempt to imitate real browsers and user behavior.

Simple high-volume attacks still increased from 40% to 45% of bot attacks. Easier access to automation allows less experienced operators to generate harmful traffic at scale.

The report found that 44% of advanced bot traffic targeted application programming interfaces. APIs are structured connections that let software exchange data or trigger functions.

That focus matters for agentic systems. An agent can use a website, but efficient commercial agents will often seek direct API access.

APIs can support stronger authentication and defined permissions. They can also expose high-value business functions when authorization is incomplete.

Industry conditions vary sharply. Imperva found that bad bots represented 59% of retail traffic and 41% of travel traffic during 2024.

Retail and travel also offer valuable targets. Automated attackers can scalp inventory, test stolen cards, scrape prices, or take over loyalty accounts.

At the same time, those sectors are well suited to legitimate agents. Customers benefit when software can compare fares, monitor prices, or assemble a purchase.

This overlap means companies cannot optimize solely for the highest block rate. A system that rejects every uncertain interaction might reduce measurable attacks while hiding lost demand.

The inverse is also dangerous. A business that permits agents without clear permissions can expose accounts, payments, and customer information.

The survey’s nearly $100 billion estimate combines losses from fraud and the accidental rejection of legitimate transactions. That figure should be read carefully.

It is an industry estimate, not an audited total for the surveyed companies. The categories also measure different forms of harm.

Fraud represents a successful hostile action. A false positive represents a defensive action that harmed a legitimate interaction.

Putting them together highlights the central tradeoff. Tight controls can create commercial losses, while loose controls can create security losses.

The goal is not maximum friction or minimum friction. It is a more accurate decision about authority at each sensitive step.

Google News Highlights a Wider Shift in Bot Economics

The bot problem is expanding because automated traffic now carries both hostile risk and potential commercial value.

For years, many organizations treated bots as a website security issue. Security teams managed scraping, credential attacks, inventory abuse, and denial-of-service activity.

AI agents expand the conversation to distribution and revenue. An automated visitor might bring a customer’s buying intent without delivering a conventional page view.

Akamai reported that AI bots generated 47.9% of commerce traffic across its network by December 2025. Its commerce security findings placed the industry at the center of agentic fraud pressure.

Akamai also said commerce organizations categorized more than 90% of AI bot activity for monitoring. They allowed about three-quarters of the remaining activity to pass without restrictions.

Monitoring can be a sensible first response when classifications remain uncertain. It lets businesses observe behavior before enforcing rules that might block useful agents.

However, passive observation leaves exposure when suspicious automation reaches account or payment functions. Companies need policies that change as an interaction becomes more sensitive.

Public pages can tolerate broader access. Authentication, stored payment methods, loyalty balances, and account recovery require more confidence.

This risk-based progression offers a practical middle course. It avoids treating every automated request as equally dangerous.

It also avoids granting broad trust to an agent simply because a known company operates it. A legitimate service can be misconfigured, compromised, or used beyond a customer’s authorization.

Operator concentration creates another complication. HUMAN attributed about 69% of observed AI-driven traffic in 2025 to OpenAI user agents.

Meta accounted for roughly 16%, while Anthropic represented about 11%. The remaining identified operators collectively generated less than 5%.

These measurements come from HUMAN’s customer base, so they do not represent the entire internet. Still, they illustrate how decisions about several operators can shape total AI exposure.

A merchant could create rules for recognized agents from major providers. Yet provider identity does not answer whether a specific transaction carries user approval.

Smaller or self-hosted agents create an additional challenge. Blocking every unfamiliar agent would favor large platforms and limit competition.

Allowing them without strong verification would increase fraud risk. Open standards for identity and delegated permissions could reduce that conflict.

Google News offers a useful analogy, although it is not a transactional agent. Publishers can identify familiar search crawlers and decide how their content appears in discovery systems.

Commerce needs a richer version of that relationship. A store must understand not only who is requesting information, but also what the agent can do next.

The change affects business strategy. Companies that reject legitimate agents might disappear from AI-mediated product discovery or purchasing.

Companies that accept agents too freely might absorb fraud, scraping costs, and polluted analytics. Neither extreme provides a durable operating model.

What Businesses Should Watch Next

The next phase depends on verifiable agent credentials, narrower permissions, and evidence that these controls reduce both fraud and false positives.

The first signal is adoption of portable agent identity and authorization methods. Merchants need credentials they can verify without building custom connections for every AI provider.

Those credentials should identify the operator and connect the agent to a user. They should also express a limited scope for the requested action.

Adoption would strengthen the case for KYA-based controls. Fragmented or proprietary approaches would leave companies dependent on behavioral inference.

The second signal is a measurable change in false-positive rates. The PYMNTS survey established a 3.3% rate among large enterprises and 2.7% among smaller firms.

Future studies should show whether continuous verification lowers those figures. They should also separate human transactions from authorized agent transactions.

A lower rejection rate without higher fraud would support the identity-centered approach. Falling friction paired with rising losses would weaken it.

The third signal is how major merchants handle agents at login and checkout. Public product discovery is already a common agent activity, but sensitive actions remain limited.

Watch for merchants that publish clear agent-access rules and permission requirements. Also watch for disclosures about account takeover, card testing, and agent-related disputes.

These developments will reveal whether agentic commerce becomes a trusted channel or another layer of unmanaged automation.

Companies do not need to wait for a universal standard before improving controls. They can inventory automated traffic and separate public browsing from sensitive account actions.

They can define which agents are permitted, what evidence those agents must present, and which actions require user confirmation.

Businesses should also avoid using a single bot score across every digital surface. A public catalog request and a payment-method change do not carry comparable risk.

Continuous verification can reassess trust during a session. It can consider identity, device, behavior, transaction context, and the requested permission.

That approach still requires restraint. More data collection can create privacy and compliance concerns, especially when companies cannot explain their decisions.

Automated fraud controls should support review and appeal paths. Customers need a way to recover when a legitimate transaction is challenged.

Security leaders should also test whether controls produce unequal outcomes across locations, devices, or accessibility tools. A lower global false-positive rate can hide concentrated harm.

For knowledge workers tracking this shift, source quality matters as much as headline visibility. A google news result can surface an important claim, but the underlying methodology determines its value.

The PYMNTS finding is meaningful because it includes a defined sample, fielding period, and detailed measures. It still represents survey responses rather than direct observation of network traffic.

Imperva, HUMAN, and Akamai provide observational data, but each sees traffic through its own customer network. Their percentages should not be combined into one universal bot count.

Taken together, the sources support a narrower conclusion. Automated traffic is growing, malicious bots remain substantial, and legitimate agents are entering sensitive workflows.

The remaining uncertainty concerns control quality. Companies need to prove they can welcome authorized software without creating a new route for fraud.

That proof will come from outcomes, not confidence surveys. Lower incident rates, fewer rejected customers, and traceable agent permissions will matter most.

Readers who encounter another dramatic google news headline about bots should ask three questions. What traffic was measured, how was it classified, and which business action did it reach?

Those questions separate general internet noise from a genuine operational risk. They also reveal whether an organization can recognize authority instead of merely detecting automation.

The next several months will show whether businesses move beyond the old “bot or not” model. If they do, agent verification can become part of digital identity infrastructure.

If they do not, firms will continue choosing between two costly errors. They will either admit hostile automation or block software carrying legitimate customer intent.