Imperva, a Thales company, (@Imperva) the cybersecurity leader that protects critical applications, APIs, and data, anywhere at scale, releases the 2024 Imperva Bad Bot Report, a global analysis of automated bot traffic across the internet. Nearly half (49.6%) of the global internet traffic came from bots in 2023—a 2% increase over the previous year and the highest level Imperva has reported since it began monitoring automated traffic in 2013. Similarly, the proportion of web traffic associated with bad bots grew to 32% in 2023, up from 30.2% in 2022.

However, APAC bucked the trend, dropping to under 27% (26.6%) in 2023, from 27.9% in 2022 and 34.8% in 2021 - marking a 23.5% decrease over a three-year period. While this gradual decline indicates potential progress in bot detection and mitigation strategies in the region, it's noteworthy that bots (good and bad) now comprise over 40% of APAC's internet traffic, an increase of 15.6% YoY, underscoring the ongoing challenge of managing bot activity.

Reinhart Hansen, Director of Technology at Imperva's Office of the CTO, stressed the critical importance of taking proactive steps against bad bots as they grow in sophistication. “With attackers increasingly exploiting API vulnerabilities and lapses in business logic guardrails, this proactive stance is essential to prevent data breaches, account takeovers, and large-scale data theft. From simple web scraping to malicious account takeover, spam, and denial of service, bots negatively impact an organisation’s bottom line by degrading online services and requiring more investment in infrastructure and customer support. Organisations must proactively confront the menace of bad bots as attackers sharpen their focus on API-related abuses that can lead to compromised accounts and data exfiltration,” he added.

Key trends identified in the 2024 Imperva Bad Bot Report include:

• Global average of bad bot traffic reached 32%: Ireland (71%), Germany (67.5%), and Mexico (42.8%), saw the highest levels of bad bot traffic in 2023. In APAC, Singapore notably experienced a high level of bad bot traffic, accounting for 35.2%, surpassing the global average. In contrast, Japan recorded the lowest level of bad bot traffic at 17.7%.

• Growing use of generative AI connected to the rise in simple bots: Rapid adoption of generative AI and large language models (LLMs) resulted in the volume of simple bots increasing globally to 39.6% in 2023, up from 33.4% in 2022. Australia, in particular, has a high volume of simple bots (70.6%) – 31% higher than the global average. Singapore, in contrast, is comparatively lower, with 13.1% of simple bot volume. The industries in APAC with the highest proportion of simple bot traffic are Automotive (100%), Telecom and ISPs (77.53%), and Healthcare (68.21%). The technology uses web scraping bots and automated crawlers to feed training models while enabling nontechnical users to write automated scripts for their own use.

• Every industry has a bot problem: For a second consecutive year globally, Gaming (57.2%) saw the largest proportion of bad bot traffic. Meanwhile, Retail (24.4%), Travel (20.7%), and Financial Services (15.7%) experienced the highest volume of bot attacks. The proportion of advanced bad bots, those that closely mimic human behaviour and evade defences, was highest in Law & Government (75.8%), Entertainment (70.8%), and Financial Services (67.1%) websites.