MEUDON, France--(BUSINESS WIRE)--Apr 29, 2026--
Thalestoday released the2026 Bad Bot Report: Bad Bots in the Agentic Age, revealing a fundamental shift in how the internet operates, as AI-accelerated automation becomes a defining feature of modern digital infrastructure.
This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260428783532/en/
The findings highlight three major structural changes: the emergence of AI agents as a new category of internet traffic, the dominance of automated activity over human interaction, and the rapid expansion of attacks targeting APIs and identity systems that serve as the backbone of digital business.
AI Is Redefining Internet Traffic and Security
The report shows that AI is not just increasing the volume of bot activity, but fundamentally changing its nature. In 2025, AI-driven bot attacks surged 12.5x compared to the previous year.
More significantly, AI agents are now emerging as a third category of traffic, alongside traditional “good” and “bad” bots, interacting directly with applications and APIs to retrieve data and perform tasks. This shift is blurring the line between legitimate and malicious automation, making it increasingly difficult for organizations to determine intent.
“AI is transforming automation from something organizations try to block into something they must also manage,” Tim Chang, Global Vice President and General Manager, Application Security at Thales, said.“The challenge is no longer identifying bots. It’s understanding what the bot, agent, or automation is doing, whether it aligns with business intent, and how it interacts with critical systems.”
This evolution is creating a growing visibility gap. Much of today’s AI-driven activity remains unverified or indistinguishable from legitimate traffic, meaning organizations are operating with an incomplete view of the risks they face.
Bots Increasingly Outnumber Humans Online
The report shows automation tightening its grip on the internet, with bots continuing to outpace human activity. In 2025, bots made up more than 53% of all web traffic, up from 51% the previous year, while human activity fell to 47%. This reflects a structural shift rather than a temporary trend, with bots no longer tied to specific events like scraping or credential stuffing campaigns, but instead operating as a persistent and expected presence across digital environments.
APIs and Identity Systems Become the Primary Attack Surface
As digital services increasingly rely on APIs to power core functionality, attackers are following suit. The report finds that 27% of bot attacks now target APIs, where bots can bypass user interfaces and interact directly with backend systems at machine speed.
These attacks often appear legitimate, using valid authentication and well-formed requests, but exploit business logic, extract sensitive data, or manipulate workflows at scale. The impact is especially pronounced in high-value sectors. Financial services accounted for 24% of all bot attacks and 46% of account takeover incidents, underscoring how automation is being used to directly monetize cyberattacks.
A New Era of Machine-Driven Interaction
As AI adoption accelerates, the report reveals that the internet is now fundamentally machine driven. Bots are no longer simply tools used by attackers; they are active participants in digital systems, shaping traffic patterns, influencing business metrics, and interacting with systems in real time. In this environment, the ability to manage automation at scale with precision is critical to maintaining security, performance, and trust.
Confronting the Rise of Uncontrolled Automation
The report concludes that traditional security approaches focused on identifying and blocking bots are not sufficient in an environment where automation is both pervasive and often legitimate. Organizations must move toward a governance-based model, combining visibility, policy enforcement, and behavioral analysis to distinguish between acceptable and harmful automation. This includes defining which AI agents are allowed to interact with systems, implementing controls at the API and identity layer, and designing defenses that can adapt as bots evolve.
For more information and recommendations, please download the full report and join our webinar to learn more about technologies that can be deployed against malicious bots .
Methodology
The 2026 Thales Bad Bot Report analyzes full-year 2025 bot activity using data from Thales Threat Research and Security Analyst Services teams. The report examines how automation, powered by AI, is reshaping application security, API exposure, and digital infrastructure globally.
PLEASE VISIT
Thales Group
Cybersecurity Products | Thales Group
Cybersecurity Solutions | Thales Group
©Thales
The SEC's reign as the king of the first round of the NFL draft was toppled by the Big Ten.
But the conference that coined the mantra “It Just Means More” for its dominance of college football in the 2010s remained in the top spot for the entire draft after the SEC set a record for the number of players picked over the three days.
Thanks to recent national champions Indiana and Ohio State, the Big Ten led the way with 10 first-round picks, marking the first time the SEC didn't have the most players taken in round one since 2015. The SEC had only seven — down from a record 15 last year — and the lowest total for the conference since that 2015 season when the ACC and Pac-12 led the way with nine first-rounders each and the SEC had seven.
The first player drafted from an SEC school came when LSU cornerback Mansoor Delane went sixth overall to Kansas City, marking the first draft without a top five SEC player since 2018 when Roquan Smith was the first taken at No. 8 overall by the Bears.
But the depth of the SEC shined on the final two days with the conference leading the way with 29 day two picks in rounds two and three and 51 more over the last four rounds on the final day of the draft. The 87 players in total were the most ever and easily beat the total of 67 from the Big Ten.
This SEC has had the most players picked for 20 straight drafts since the ACC took top honors in 2006. Florida won the national title the following season, starting a stretch where the conference won 13 of 17 national championships.
That run of dominance ended when Michigan won it all in 2023 with fellow Big Ten members Ohio State and Indiana following that up with titles of their own.
The other two power conferences were far behind with the Big 12 and ACC each having six first-rounders and 38 players picked in all.
The recent realignment that added more schools to all four power conferences, along with reduced restrictions on transfers and the advent of NIL payments all have combined to consolidate the talent at the biggest schools.
San Diego State cornerback Chris Johnson was the only player who didn't finish his college career in the SEC, Big Ten, Big 12, ACC or Notre Dame who was taken in the first round after going 27th to Miami.
The next Group of Six player off the board was Toledo safety Emmanuel McNeil-Warren at No. 58 to Cleveland and only one other was picked on the first two days with Georgia State receiver Ted Hurst going 84th to Tampa Bay.
In all, just 14 players from the Group of Six were drafted with the American and MAC leading the way with four each. There were 39 others who transferred from a Group of Six school to a Power Four conference, according to ESPN.
Seven players came from FBS independents with Notre Dame having six and UConn one.
There were four players who came from FCS-level schools and one who didn't play college at all with Philadelphia taking Nigerian native Uar Bernard in the seventh round as part of the NFL’s International Pathway Program.
The first round of the draft provided some memorable milestones for running backs with Jeremiyah Love becoming the first top five back in eight years when Arizona took him third overall. His Notre Dame teammate Jadarian Price went with the final pick of the round to Seattle.
That marked the sixth time in the common draft era starting in 1967 when two running backs from the same college were taken in the first round of the same draft with it last happening in 2008 with Arkansas' Darren McFadden and Felix Jones.
Running backs were mostly an afterthought after that.
The next back off the board came near the end of the third round when San Francisco took Indiana's Kaelon Black 90th overall, marking the fewest running backs taken in the first three rounds of the common draft.
Only 10 more running backs went on the final day with the 13 total the fewest taken in any draft.
Tight ends had a banner weekend with 22 picked, the most since 2015, according to Sportradar, when there were also 22 selected as the league's trend of more multi-tight end formations put a premium at the position.
The trenches as usual were dominant with teams drafting 51 defensive linemen and 50 offensive linemen. There were also 46 defensive backs, 36 wide receivers, 26 linebackers, 10 quarterbacks and three specialists.
Ohio State was the third fastest school ever to have four players picked in a draft with Carnell Tate, Arvell Reece, Sonny Styles and Caleb Downs all going in the top 11 of the draft.
The only schools ever to have four players picked that quickly were Michigan State with four of the top eight in 1967 and Notre Dame with four of the top 10 in 1946.
The Buckeyes didn't slow down from there with seven more players drafted, giving them the most of any school this year with 11. Alabama and Texas A&M each had 10, followed by Clemson, Miami and Texas Tech with nine apiece.
This also marked the 88th straight draft that both Michigan and USC had a player picked for the longest streaks of any school. Notre Dame has missed only one year (1977) of having a player picked in the regular draft since 1938 but did have running back Al Hunter taken in the supplemental draft that year.
Wisconsin had its streak of at least one player picked each year since 1979 snapped.
The NFL shortened the time between picks in the first round from 10 minutes to eight minutes, cutting the total duration of the round to under three hours.
The league said the first round took 2 hours, 53 minutes on Thursday night, down 36 minutes from last year and 40 minutes less than the average of the previous five drafts.
The duration of the first round has been cut in half since commissioner Roger Goodell's first draft in 2007. Teams that year had 15 minutes to make their picks in the opening round, leading to a 6 hour, 8 minute round in 2007.
Inside the Numbers dives into NFL statistics, streaks and trends each week. For more Inside the Numbers, head here.
AP NFL: https://apnews.com/hub/NFL
Ohio State defensive back Caleb Downs poses with NFL Commissioner Roger Goodell after being chosen by the Dallas Cowboys with the 11th overall pick during the first round of the NFL football draft, Thursday, April 23, 2026, in Pittsburgh. (AP Photo/Gene J. Puskar)
Arizona Cardinals NFL football first round draft choice Jeremiyah Love speaks during a news conference, Friday, April 24, 2026, in Tempe, Ariz. (AP Photo/Ross D. Franklin)
LSU defensive back Mansoor Delane puts on a hat after being chosen by the Kansas City Chiefs with the sixth overall pick during the first round of the NFL football draft, Thursday, April 23, 2026, in Pittsburgh. (AP Photo/Jeff Roberson)
Ohio State linebacker Arvell Reese puts on a hat after being chosen by the New York Giants with the fifth overall pick during the first round of the NFL football draft, Thursday, April 23, 2026, in Pittsburgh. (AP Photo/Jeff Roberson)
Las Vegas Raiders first-round draft pick Fernando Mendoza speaks during an NFL football news conference Friday, April 24, 2026, in Henderson, Nev. (AP Photo/Candice Ward)
