Cloudflare has announced the general availability of Precursor, a behavioural detection and verification system designed to identify and block automated bot traffic by analysing user interactions across an entire web session.
The company said automated bots now generate roughly 57% of all web requests, overtaking human activity. Cloudflare argues that as AI-powered agents become more capable of mimicking legitimate users, traditional approaches such as one-time checks and CAPTCHAs are increasingly being bypassed.
According to Cloudflare, Precursor runs inside web browsers and continuously collects signals during a visitor’s session, rather than relying on single, point-in-time challenges. The goal is to make it harder for automated systems to imitate the full sequence of interactions a human would typically generate while browsing or completing actions such as logins and checkouts.
The company said the tool records aggregated behavioural patterns instead of capturing content. It said keyboard activity, for example, is tracked as timing and cadence rather than actual keystrokes, and that the system is intended to protect user confidentiality.
Cloudflare also said Precursor can be enabled without modifying underlying site code, using a script delivered through its network. The script is described as collecting interaction metrics including mouse movement, scrolling rhythm, typing cadence, clipboard activity, and how long a page remains visible.
In a statement, Dane Knecht, CTO of Cloudflare, said the product is intended to address what he described as a blind spot between traditional security checkpoints. “Traditional security checks look at a single moment in time, but modern bots have gotten smart enough to fake their way through the front door,” Knecht said. “Instead of just checking an ID at the gate, we are looking at behavior over the entire visit.”
Cloudflare positioned Precursor as part of a broader shift toward continuous behavioural validation as bot-driven traffic grows and becomes more difficult to distinguish from legitimate users. The company said bot activity can drive up infrastructure costs, manipulate inventory, and compromise data.
