For years, we have been designing websites, campaigns and sales funnels based on an idea that seemed obvious: there is a person on the other side of the screen. That assumption has now become outdated. In 2025, the bot traffic has overtaken human traffic for the first time and now accounts for more than 53% of all internet activity, according to the Imperva (Thales) 2026 Bad Bot Report. To put it another way: when you publish something online today, more than half of those who go online to view it aren’t breathing.
This isn’t just a sensationalist headline, but a fundamental shift in how the internet works, and it has very specific consequences for anyone investing in digital marketing. At Vandelay, we’ve been seeing this for months in the accounts we manage, so it’s worth taking a moment to understand what’s happening, what constitutes a threat and what is simply the new normal we have to work with.
The figure worth taking a second look at
The key figure speaks for itself. The Imperva report, which analyses web traffic on a global scale, puts automated activity at 53.3% of the total for 2025, compared with 51% the previous year. Human activity, consequently, has fallen to 47% and continues to decline. This is the first time, since the internet as we know it came into existence, that machines have become the majority.
There are important nuances within that 53% figure. Part of it corresponds to “good bots” —search engine trackers, monitoring tools, crawlers that check whether a page is available—. But most are not: according to the report, malicious bots account for around 40% of total traffic—programmes designed to scrape data, steal credentials, commit fraud or overload servers. Imperva adds two figures that help illustrate the pace of change: 27% of bot attacks now target APIs directly, and AI-powered automated attacks have increased 12.5-fold in a year, rising from an average of around 2 to 25 million blocks per day.
Why bot traffic has skyrocketed
Automation is nothing new on the internet: Google’s web crawlers have been scanning web pages for decades. What has changed is the scale and, above all, the purpose. The main driving force behind this leap forward is language models and, more recently, the AI agents. ChatGPT, Claude, Gemini and Perplexity need to crawl the web on a massive scale in order to train themselves and provide up-to-date information, and this generates a volume of web crawling that would have been unthinkable a few years ago.
But it is no longer just about reading. The Imperva report emphasises one idea: AI agents are a new category as a visitor. They do not simply scan a page; rather, they interact with it, retrieve data, complete workflows and act on behalf of a user. In practice, what looks like a customer visit may actually be a system checking prices, comparing availability or making a purchase. The line between an “interested person” and a “working machine” becomes blurred, and that is where the problem begins for marketing.
How bot traffic affects your analytics
If a growing proportion of your traffic is not from human visitors, your metrics no longer mean what you thought they did. A spike in traffic may not reflect genuine interest, but rather a surge in web crawlers. A drop in the conversion rate may be because the denominator — the number of sessions — is inflated by automated bots that were never going to buy anything. And the demand signals on which you base your budget decisions may be skewed.
This ties in with something we’ve already discussed on the blog: the AI-powered marketing measurement and the end of last-click attribution. In an environment where more than half of the traffic is automated, relying on a single metric — sessions, clicks, users — is riskier than ever. The good news is that tools such as GA4 filter out known bot traffic by default, but filtering is never perfect and fails to catch the most sophisticated bots, which behave almost identically to humans. That’s why it’s worth cross-referencing sources, keeping an eye out for unusual patterns (zero-second sessions, impossible geographical locations, spikes at four in the morning) and being wary of metrics that rise without any apparent reason.
Bots and advertising budgets: the problem of invalid traffic
Where the bot traffic What really hurts is the impact on the advertising bottom line. The industry calls it invalid traffic (IVT): impressions and clicks generated by machines that eat into the budget without any chance of converting into customers. Every fake click is money coming out of your pocket and going towards a metric that looks good but doesn’t drive sales.
The major platforms — Google Ads, Meta Ads — invest heavily in detecting and filtering out this traffic, and they do so reasonably well within their own ecosystems. The risk increases when you step outside that walled garden: display campaigns on third-party networks, sites of dubious quality or opaque placements are fertile ground for fraud. The practical advice remains the same regardless of AI, but it becomes even more urgent: check where your adverts are being served, use exclusion lists, prioritise verified inventory and measure actual conversions rather than vanity metrics. A sky-high CTR with zero sales is not good news; it’s a warning sign.
SEO and GEO: not all bots are the enemy
This is where things take a significant turn, because treating all bots as a threat would be a marketing mistake. There are automated systems you want to welcome with open arms. Google’s crawler needs to access your website to index it; and, increasingly, AI-powered crawlers determine whether your brand appears — or not — when someone asks ChatGPT or Perplexity for a supplier like yours.
This is what lies behind the rise of GEO (generative engine optimisation) and the loss of SEO visibility caused by generative AI which many companies are noticing. If you indiscriminately block bots to protect yourself from fraud, you may end up making your brand invisible on the very channel that is growing the fastest. The solution isn’t to shut the door, but to decide who gets in: allow legitimate crawlers, monitor abusive ones, and make it clear to AI models what they can learn about you. A simple way to start is to publish a llms.txt file to guide ChatGPT, Claude and Perplexity towards the information that truly represents your business.
What your business can do without succumbing to paranoia
As Imperva puts it, the challenge is no longer simply to detect bots, but to manage automation according to its intended purpose. For an SME or a brand that does not have a dedicated security team, this translates into a few very practical decisions:
- Monitor your actual traffic. Where possible, distinguish between human and automated visits before drawing conclusions from your reports.
- Protect the forms and the login. They are a favourite target for malicious bots; a good anti-spam system and verification process reduce noise and fraud.
- Keep an eye on the advertising inventory. Exclude low-quality placements and always measure performance against actual conversions, not clicks.
- Open the door to the right bots. Make sure that Google and AI crawlers can crawl your key content; SEO and GEO depend on it.
- Check your KPIs. A metric that rises for no apparent reason warrants more suspicion than celebration.
Marketing on the internet, where machines are in the majority
It’s hard to come to terms with the fact that the web, where we compete for people’s attention, is now populated, above all, by machines. But denying it doesn’t change the fact that the bot traffic It’s already the majority, and the trend points to more, not less. Brands that continue to interpret their analytics as if every visit were a potential customer will make poor decisions based on data that appears to be sound.
The silver lining is that this also presents an opportunity. Whoever is the first to understand this new mix of humans and bots — who gets the metrics right, who protects their investment and who makes themselves visible to AI models without neglecting people — will compete with a real advantage. That is, ultimately, the conversation we have every week with our clients at Vandelay: how to continue speaking to people on the internet where, figures in hand, they are no longer in the majority. If you’re wondering what proportion of your traffic and budget is being spent on machines, that’s exactly the sort of review it’s worth starting with.
English (UK) 
Español