Half Your Web Traffic Is Now Bots, and Your Dashboards Cannot Tell

Every operating dashboard rests on an assumption so basic that few teams ever write it down: the activity being counted comes from people. Page views, sign-ups, demo requests, cart starts and login attempts all feed forecasts, staffing plans and budget decisions on the understanding that a visit is a person. That assumption broke this year, and most measurement systems have not been told. The share of the web that is human is shrinking quickly, and the automated share is getting much harder to spot.

The Crossover Came Early

Cloudflare, which carries a large slice of global internet traffic, expected machines to outnumber people sometime in the second half of 2027. On its second-quarter earnings call, CEO Matthew Prince said that threshold had already been crossed this year, according to BankInfoSecurity. He went further: if current trends continue, non-human traffic could reach 1,000 times human traffic within five years, which he said would make humans "a rounding error on the internet."

The pattern is now visible in places no one would call a bot target. Speaking at FRED Con 2026 on October 1, Federal Reserve Governor Christopher Waller said about half of visits to FRED, the St. Louis Fed's economic data platform, now come from AI agents retrieving data. FRED's traffic is growing 150 percent a year, with most of that growth coming from AI and bots. Waller also flagged a measurement problem any operations leader will recognize: FRED's managers cannot always tell whether those agents attribute the data correctly, because the visitor reading the page is no longer the person who will use the answer.

If the Fed's own data service now splits roughly evenly between humans and agents, assume your website, customer portal and lead forms are seeing something similar.

More Bots, Fewer of Them Caught

Volume is only part of the story. DataDome's State of Bot and Agent Security Report 2026, covered by Help Net Security, analyzed trillions of requests across more than 75,000 customer sites. Malicious bot activity rose 124 percent between July 2025 and June 2026, while human traffic grew 13.2 percent. Traffic from AI agents and large language model crawlers rose 82.3 percent, and bots and AI agents together produced about 26.5 percent of all traffic in the dataset. Scraping made up 70.9 percent of bad bot traffic.

Detection is not keeping up. DataDome tested the homepages of more than 21,000 popular websites against 10 simulated bots. About 65.3 percent failed to detect any of them, and only 2.4 percent stopped or challenged every type. SecurityInfoWatch reports that just 5.5 percent of sites stopped every basic bot evaluated, and that even the top 1,000 sites had an unprotected rate of 64.4 percent. Size and budget, in other words, are not buying much protection. "Attacker tooling has improved faster than defenses have," said Jérôme Segura, DataDome's VP of threat research.

The traffic is also moving toward the parts of a business where money and accounts live. AI agents generated 605.6 million requests to higher-risk areas, and login pages accounted for 51.7 percent of them. AI-agent requests to login pages rose more than eightfold in six months, AI-agent spoofing climbed 45 percent between February and July, and 80 percent of AI agents do not properly identify themselves. More than seven in 10 tested websites let a spoofed AI agent or crawler through without a challenge.

Why This Is an Operations Problem, Not Just a Security One

It is tempting to file all of this under the security team. The operational cost runs wider. Invalid traffic distorts the numbers that marketing, sales and service teams plan around. Lunio's Global Invalid Traffic Report 2026, summarized by the ANA, put the average invalid traffic rate across all media channels at 8.5 percent, an estimated $63 billion in lost ad spend, and expected that figure to grow as AI agents spread. Every bot that clicks an ad, fills a form or opens an account inflates a funnel that someone then staffs, budgets and forecasts against.

The answer is not to block everything automated. Some AI agents are customers' assistants doing legitimate research or purchasing, and shutting them out costs visibility and revenue. Segura frames the choice directly: "Blanket blocking of AI traffic costs businesses visibility and revenue, and allowing everything through invites fraud." The task for operations leaders is to know which is which, and to make sure the metrics they manage by reflect the difference.

A practical playbook for the months ahead:

• Audit the metrics that drive spending: Identify the five or six traffic and conversion figures that feed budgets, headcount or forecasts, and confirm whether bot and agent activity is filtered out before anyone reports them.
• Separate human, agent and unknown traffic: Report the three streams individually rather than as one total, so a jump in "visits" can be traced to its real source.
• Protect login, account and payment flows first: With login pages taking more than half of high-risk agent requests, these are where credential testing and account fraud begin, and where losses land on the operating budget.
• Tie security spend to business outcomes: Frame bot defense in terms finance understands, such as wasted ad spend, fraudulent refunds and polluted pipeline data, rather than as a purely technical control.
• Write a policy for good bots: Decide which AI agents you want to serve, how they must identify themselves, and what data they may retrieve, instead of letting defaults decide for you.
• Revisit benchmarks set before 2026: Conversion rates, cost per lead and traffic targets set on older data may describe a mix of visitors that no longer exists. Rebaseline them on cleaned data.

The web did not become less busy this year. It became less human, faster than even the companies running its infrastructure predicted. The organizations that adjust their measurement now will keep making decisions on real demand. The rest will keep optimizing for an audience that is increasingly made of software.