Automated systems now dominate online interactions, generating 57.4% of all web requests globally, according to recent data from Cloudflare. This trend is particularly evident in North America, where bots account for 68.6% of web traffic. As a result, existing cybersecurity measures, originally designed for a time when human users were predominant, are undergoing a necessary reevaluation.
The implications of this shift are significant. Traditional bot detection methods, which focused on identifying and blocking machine-generated requests, are struggling to keep up as these machines increasingly act as legitimate customers. A report from Human Security reveals a staggering 7,851% year-over-year growth in agentic AI traffic, with retail and eCommerce now making up 46.6% of this activity. Automated agents are now engaging with online platforms to perform tasks such as browsing, managing accounts, and completing purchases—activities that were once solely the responsibility of human users.
The rise of agentic AI poses considerable challenges for security frameworks. With only a half percentage point separating legitimate automation from malicious activity, identifying threats has become more complicated. Rapid browsing patterns and automated form submissions, once viewed as indicators of fraud, are now standard behavior for legitimate agents. This blurring of lines has resulted in a dramatic increase in carding volumes, which surged by 250% since 2022, alongside a quadrupling of post-login account takeover attempts, as noted by Human Security. Additionally, CrowdStrike’s 2026 Global Threat Report found that 82% of intrusions were carried out without malware, using legitimate credentials to bypass traditional security measures.
The challenges extend beyond detection. Current identity systems struggle to verify the authorization of non-human actors. Unlike human users, who leave behind behavioral trails that can be analyzed for signs of fraudulent activity, agents operate continuously and can spawn additional agents, all while carrying permissions that may proliferate unpredictably. This creates a significant oversight challenge for organizations, as traditional security models do not account for the complexity and dynamism of agentic interactions.
In an October analysis, PYMNTS Intelligence reported that 59% of firms consider bot-driven fraud a pressing threat, with companies losing an estimated 3.1% of annual revenue due to identity gaps. The Financial Stability Board has issued strong recommendations urging financial institutions to implement more comprehensive safeguards against the risks posed by agentic AI, highlighting the urgent need for mechanisms that can keep pace with the rapid evolution of these technologies.
As organizations confront these challenges, existing payment infrastructures are also proving inadequate. Current payment systems lack native support for transactions initiated by machines, complicating matters in a landscape where automated agents are becoming important players in the economy.
The need for a structural shift in cybersecurity strategies is evident. Companies must adapt to the reality that the web is increasingly populated by automated agents, whose behaviors and interactions were not anticipated by earlier security frameworks. As the lines between human and machine continue to blur, developing more sophisticated and adaptable security solutions will be essential to protect against fraudulent activities while allowing legitimate automated interactions to flourish. The coming years will likely see an innovation race in this space, as businesses work to safeguard their revenue streams while navigating the complexities introduced by agentic AI.
The stories that move AI & crypto markets — before the market reacts.
Free. 7am ET. Five stories. 62,400 readers.
