The State of AI Bots report, a survey of 300 enterprise security and engineering leaders, found that 79% are confident they can detect bot activity, but only 23% have a proactive strategy for managing it. Being proactive requires understanding how and why automated traffic is interacting with your infrastructure, but most bot management tools aren't built for that. Instead, they're built to block traffic.
Enforcement and analysis are different capabilities. Bot managers are built to act on traffic in real time (enforcement). Meanwhile, bot intelligence is the capability to analyze and understand automated traffic over time, not just act on it (analysis). These two capabilities answer different questions, require different data, and have different retention needs. Many organizations have bot management tools, but these tools don’t answer critical questions like:
- Why are agents and bots interacting with our content?
- How is this behavior impacting the business and the bottom line?
As automated traffic continues to grow, and agents act on behalf of your customers, competitors, and other businesses, the answers to these questions are more important than ever. Bot management alone won’t answer these questions, but with bot intelligence, you get a complementary approach that supports your bot management policies and helps you make data-driven decisions that maximize the value of bot traffic while minimizing risks.
Bot Managers Are Designed to Act on Traffic, Not Analyze It
A bot manager operates at the edge of your infrastructure and makes binary decisions to either allow or block (or challenge) requests. It's optimized for speed and enforcement. When a request hits your WAF or CDN with a known bad signature, or triggers a rate limit, your bot manager blocks the traffic.
This is exactly what bot managers are designed to do, but bot traffic is often complex and can’t be reduced to a binary decision. Consider the example of an ecommerce site that gets sustained bot traffic from an online marketplace aggregator. The bots are poorly configured, leading to excessive infrastructure costs for the business, and it’s not clear whether the aggregator is improving sales, boosting competitors, or hurting the brand. If traffic from the aggregator is blocked, will it help or hurt the bottom line?
Variations on this scenario impact every vertical. You might want to protect original content, have tighter control over your brand, or open your products to new markets, and bot traffic can support or harm these goals. What’s more, bots that are harmful to your business often aren’t intentionally malicious, making it harder for bot managers to make clear, binary decisions about what to block and what not to.
Part of the problem is that bot managers have short retention windows that rarely extend beyond 30 days, making longer lookbacks impossible. For example, if your team wants to know how a policy change you made three months ago is impacting scraping activity, you’ll have an incomplete picture.
30-day retention windows are reasonable for a tool built to enforce policy in real time. The problem is that 30 days is rarely enough to answer the questions that matter most. If a bot campaign started 45 days ago, your enforcement layer has no record of how it began, how it has evolved, or whether it’s increased or decreased since your last rule update.
Is the traffic pattern new, or has it been running for months at a lower volume? Did the policy change you made last quarter actually reduce credential stuffing attempts, or did the traffic just shift to a different entry point? Which cohorts of automated traffic are growing, and which ones have you effectively neutralized? Are decisions you’ve made impacting beneficial bot traffic, leading to lost revenue? Or are rules allowing bots with benign intent but negative consequences to pass through, leading to higher infrastructure costs?
Without full context, you can’t answer these questions. Policy decisions are made on incomplete evidence, and the only way to find out whether a change worked is to wait for something to go wrong. You may be quietly losing revenue opportunities, blocking beneficial crawlers that boost brand recognition, or paying too much for cache misses when poorly-configured bots crawl your content. Bot management tools are crucial, but on their own, they are no longer enough.
Blocking Traffic and Understanding Traffic Are Different Questions
Your bot manager answers: what decision did we make at the edge? Bot intelligence answers: what kind of actor is this over time, and how is it impacting the business? Those questions require different data, different retention windows, and different analysis.
Bot intelligence operates on behavioral patterns over time, not point-in-time decisions. It can be used to determine whether a traffic cohort navigates in repetitive loops, maintains machine-like timing regularity, or burns server resources without ever completing a transaction. None of these signals are visible in a single blocked request. They only emerge when you look across weeks of data from the same actor or the same class of actors.
This distinction is important because modern bots are increasingly designed to blend in. They mimic browsing behavior, distribute requests across IP ranges, and operate within the thresholds that trigger your existing rules. According to the Imperva 2026 Bad Bot Report, AI agents now interact with websites, retrieve data, and execute workflows through the same interfaces as humans, blurring the line between legitimate and malicious traffic in ways that make traditional detection insufficient. A bot that never trips a rate limit won't appear in your block logs. But it will appear in requests logs such as CDN telemetry if you're retaining that data and analyzing it at the right level of detail.
At the same time, the scale of what's moving through delivery systems has shifted considerably. Automated traffic now accounts for more than 53% of all web traffic, up from 51% the year before. And according to Akamai's Fraud and Abuse Report 2025, AI bot traffic specifically grew 300% in the past year, with the commerce industry alone seeing more than 25 billion AI bot requests over a two-month observation window. When most of that traffic is designed to look like normal browsing, enforcement-layer visibility doesn’t tell you enough about what’s actually happening.
Bot Management and Intelligence Are Complementary Tools
Forrester VP and Principal Analyst Sandy Carielli recently renamed the entire bot management market category to "bot and agent trust management," on the basis that the category is now much broader than blocking alone. According to Carielli, “The decision isn’t ‘bot or not,’ nor is it ‘good bot or bad bot’ or ‘block or allow.’ The decision is ‘How much do I trust this bot, AI agent, or human?’ and then choosing actions based on the degree of trust.”
If the question has shifted from “block or allow” to “how much do I trust this,” then the tools you use to answer it need to shift, too. Bot management handles the action. Bot intelligence handles the judgment behind it. Most teams have the first but are missing the second, which means they're enforcing policy without the full context to know whether that policy is working.
If your block count has risen over the past three quarters, how do you know whether your policy is working or if the problem is getting worse? And how can you be sure that you’re blocking the right traffic?
The State of AI Bots in 2026 report surveyed 300 enterprise security and engineering leaders on exactly that gap. See how your organization compares.
