Bots are increasingly teaching themselves to hunt

Every attack costs energy, resources—both human and technological—and time. The same is true on the defensive side: Every countermeasure requires the same three elements. This economic logic reflects how a good application security team combats malicious bots. Instead of relying solely on blocking, an effective team increases the cost, effort, and complexity of an attack—until automation becomes a poor investment for the operator. Blocking alone is not a success. If attackers keep coming back, the model isn’t working.

The Internet Is Being Distorted

AI-powered bots behave just as human users would. For years, they have been mimicking humans—typing, browsing, taking breaks, and clicking—to blend in with legitimate traffic. But AI has accelerated these mimicry capabilities, which means application security must evolve. Teams can no longer ask, «Is this traffic malicious?» They must ask, «Who or what is accessing this application, under what conditions, and with what intent?»

Bots now generate more internet traffic than humans, and according to threat intelligence data from Thales, more than a third of this activity is malicious. AI-powered «predator bots» are part of the fundamental threat landscape. They complement well-known techniques such as SQL injection, cross-site scripting, behavioral exploitation, and volumetric attacks, which aim to overload infrastructure or conceal intent.

The economic impact is significant. Insecure APIs and bot attacks cause massive losses worldwide every year—not only through outages or security breaches, but also through less obvious damage: Bots collect pricing data, hoard inventory, manipulate workflows, spread misinformation, and undermine trust in digital experiences. As long as attacks cost less than defense, attackers will maintain the upper hand.

Make attacks more costly, not just block them

Traditional defense measures were developed for a different era. Static controls assumed that automation would be primitive and easy to detect. Rate limits assumed that attackers would behave predictably. Even behavior-based defenses face challenges, as bots are getting better and better at mimicking human nuances. In some cases, defensive measures inadvertently train attackers by revealing thresholds and signals that make future attacks faster and more cost-effective.

However, the problem should be viewed differently: Attackers are successful when the value they gain exceeds the cost of the attack. This equation holds true regardless of whether the techniques used are technical, behavioral, or volumetric. If defensive measures merely slow down attacks without altering the balance of power, a persistent threat is almost guaranteed.

Using Economic Efficiency Against the Attacker

Modern bot defense isn't just about blocking traffic. It's about making attacks so costly that they can no longer be sustained. The goal of modern application security shouldn't stop at detection and response—it should be to destroy the attacker's business model.

In corporate finance, a «poison pill» makes hostile takeovers prohibitively expensive. In application security, the concept is similar: Instead of bearing all the costs of defense internally, companies can shift them back onto the attacker. Techniques such as proof-of-work, advanced fingerprinting, and identity-aware behavioral enforcement gradually make every interaction more expensive for bots, scripts, and automated tools. Attackers don’t stop when they’re blocked. They stop when continuing no longer makes economic sense.

Why This Is Important Right Now

APIs have become the primary point of interaction for people, machines, and autonomous agents. Agent-based systems introduce new risks: automated actions without a clear identity, the abuse of APIs at machine speed, and limited accountability for decisions made without human intervention. In this environment, static credentials fall short. Security must treat identity as a dynamic signal shaped by context and behavior.

Passive detection is not enough. Application security must be actively enforced, identity-based, and continuous. Predator bots will increasingly teach themselves how to hunt using AI feedback loops. Companies that implement identity-based controls not only protect their systems—they also safeguard their revenue, their customers’ trust, and their long-term growth, transforming bot attacks from persistent threats into unprofitable investments.

www.thalesgroup.com