Defenses struggle to keep pace

As automated activity expands, DataDome’s research also points to a substantial gap between evolving bot capabilities and the defenses deployed against them.

The company tested more than 21,000 popular websites against 10 types of bot and AI traffic and found 65.3% failed to block or challenge any of them. Only 2.4% blocked or challenged all 10. DataDome’s 2026 test was expanded to include spoofed AI agents and more advanced bot types, a methodological change that provides context for comparisons with previous years.

Segura attributes part of the protection gap to the speed at which attackers’ capabilities are developing.

“Attacker tooling has improved faster than defenses have,” he said.

Segura said AI is also accelerating the attacker side of that equation. Automated challenge solvers and AI-assisted development are helping make more sophisticated evasion techniques faster and cheaper to build, he said, while many organizations continue to depend on controls developed for an earlier generation of automated threats.

Those defenses can include IP reputation, user-agent filtering, robots.txt and static allowlists and blocklists. The limitations aren’t confined to sophisticated bots, either. According to DataDome, only 5.5% of the websites tested stopped every basic bot evaluated, while just 3.1% stopped every real-browser bot.

Organization size also provided little insulation. Segura said sites ranked among the top 1,000 by traffic had an unprotected rate of 64.4%, roughly comparable with smaller sites.

“Budget and scale are not helping,” he said. “Unprotected rates were essentially flat across company sizes.”

The findings suggest the challenge isn’t limited to organizations without substantial security resources. Instead, DataDome argues that widely deployed defenses are struggling to keep pace with changes in automated attack techniques.

AI complicates the question of identity

The rise of AI agents adds another dimension to the problem because automated traffic itself cannot simply be treated as malicious.

Some AI agents legitimately access websites on behalf of users, potentially retrieving information, navigating services or interacting with accounts. Malicious automation can target the same environments for credential testing, account takeover attempts and other forms of abuse.

At the same time, an AI agent isn’t necessarily what it claims to be.

DataDome found AI-agent spoofing increased 45% between February and July 2026. Segura also cited separate DataDome research finding that 80% of AI agents do not properly identify themselves.

That creates a problem for security systems that make decisions largely according to a visitor’s claimed identity.

More than seven in 10 websites in DataDome’s testing allowed a spoofed AI agent or crawler through without a challenge. Segura said DataDome believes sites that did stop such traffic frequently did so because a static rule recognized a known agent name, rather than because the system determined whether the visitor was actually the agent it claimed to be.

For security teams, the implication is that identifying traffic as human or automated is becoming less useful on its own.

“They need to stop asking ‘is this a bot or a human?’ and start asking ‘what is this visitor trying to do, and does it serve the business?’” Segura said.

Determining that intent requires more context than an identity label. Segura said organizations can combine verified agent identity with behavioral signals including the sequence of actions, sensitivity of the endpoint, request rate and volume and session context.

Organizations can also establish AI-agent access policies defining which agents are permitted, what they are allowed to reach and under what conditions. Those decisions will vary by organization because legitimate uses of AI agents will differ according to the business and the services it provides.

Managing automation rather than simply blocking it

That distinction becomes increasingly important as legitimate AI agents and malicious bots operate within many of the same online environments.

Segura noted that an AI agent accessing a login page could be acting on behalf of an authorized user, such as retrieving order information or other account data. Similar activity, however, could also be associated with credential testing or account takeover reconnaissance.

For security teams, Segura said, the challenge is therefore less about eliminating automated traffic and more about understanding its intent and determining which automation should be permitted.

“The goal is not to block automation,” he said. “Blanket blocking of AI traffic costs businesses visibility and revenue, and allowing everything through invites fraud. The task is identifying the wrong automation in real time while the right automation operates freely.”