The further, the more: bots generated half of all internet traffic in 2023

Almost half of all global internet traffic in 2023 was generated by bots.

This is the highest level of bot activity since monitoring automated traffic began in 2013.

Some bots serve useful functions, such as indexing web pages, but most are created for malicious purposes.

The percentage of web traffic associated with malicious bots continues to rise gradually. In 2022, it was 30.2%, and in 2023, it's already 32%.

The report also shows that real user traffic decreased to 50.4% in 2023, with automated traffic costing companies billions of dollars annually due to attacks on websites, APIs, and applications.

Nanhi Singh, General Manager of Application Security at Imperva, a Thales company, discussed the growing threat, stating:

"Bots are one of the most common and growing threats faced by every industry. They have a negative impact on organizational profits," noted the Thales General Manager for Security.

The report identified several key trends. On average, global malicious bot traffic reached 32%, with the highest percentages in:

• Ireland (71%);
• Germany (67.5%);
• Mexico (42.8%).

Attacks related to account takeover have also become more frequent.

Invasion of AI Bots

The report also warns of the increase in activity of bots related to artificial intelligence. It was found that the rapid deployment of generative artificial intelligence and large language models led to an increase in the number of simple bots to 39.6% in 2023 from 33.4% in 2022.

Additionally, 17% of them were malicious bots seeking system vulnerabilities to gain access to confidential data or user accounts.

The largest share of malicious bots is present in such areas as:

• gaming (57.2%);
• retail trade (24.4%);
• travel (20.7%);
• financial services (15.7%).

The data and trends presented indicate one thing: an even greater increase in bot-generated traffic can be expected in the future. Bots lead to an increase in the number of attacks on accounts, including attacks on application programming interfaces.