Imperva: Nearly Half of Internet Traffic is Bots

Nearly half of all internet traffic came from bots during 2023. That’s the findings from MSSP Imperva, a Thales company, in its 2024 Bad Bot Report.

Imperva found that 49.6% of all internet traffic originated from bots in 2023, marking a 2% increase over the previous year. This was highest level of bot traffic Imperva reported since it began monitoring automated traffic in 2013.

Imperva noted that web traffic associated with “bad bots” grew to 32% in 2023, up from 30.2% in 2022. Meanwhile, traffic from human users decreased to 50.4%.

Automated traffic is costing organizations billions of dollars annually due to attacks on websites, APIs, and applications.

“Bots are one of the most pervasive and growing threats facing every industry,” said Nanhi Singh, Imperva’s general manager of application security. “From simple web scraping to malicious account takeover, spam and denial of service, bots negatively impact an organization’s bottom line by degrading online services and requiring more investment in infrastructure and customer support. Organizations must proactively address the threat of bad bots as attackers sharpen their focus on API-related abuses that can lead to account compromise or data exfiltration.”

Why MSSPs and MSPs Are Concerned About Botnets

Because botnets can lurk undetected in an organization’s computer network for years, they can eventually exploit a vulnerability to potentially launch a full-scale cyberattack and infect an entire IT network.

There are two classes of botnets, according to Jim Broome, president and chief technology officer at MSSP DirectDefense. He explained them to MSSP Alert in an article earlier this year. Those bots are those that attack apps and those that attack humans through personal computers and tablets. When an MSSP walks into a new engagement, they likely have no idea of what might be lurking in that organization’s IT estate.

“The problem is, you may inherit a legacy technology that is currently not adequate enough to protect against either current generation or last generation’s antivirus or botnet persistence,” Broome said. “You are constantly coaching the customer that they need to install the new stuff (i.e. cybersecurity…