Fastly has released a Threat Insights Report arguing that automated traffic is approaching parity with human activity across the web, with bots accounting for 49% of requests in January 2026 compared with 51% attributed to humans.
The report, titled “AI, Bots, and the Agentic Future of The Web”, says most bot traffic observed across Fastly’s network was unwanted or unverifiable. According to the company, 99% of bot traffic fell into that category, including scrapers, impersonators and automated attackers, while 1% was considered verified or “wanted”.
Fastly said bot patterns varied by region and industry, with JAPAC recording the lowest proportion of human traffic and the highest share of unwanted bots, while LATAM showed the opposite trend.
The findings point to a growing operational challenge for organisations that rely on web applications and APIs: separating legitimate automated access from activity that increases risk or cost. The report argues that simple allow-or-block approaches based on identifiers such as declared user agents can be unreliable, claiming some bots attempt to masquerade as verified services.
Fastly also highlighted bot activity against cached content, which is often treated as lower risk from a security perspective. It said 47% of requests to cached content came from bots, raising questions about who is accessing publicly available content and for what purpose.
Beyond visibility, the report linked bots to infrastructure cost pressures when traffic reaches origin systems rather than being served from cache. Fastly reported that 60% of origin traffic was generated by bots, which it said can increase egress charges and backend load.
On AI-specific automation, Fastly said AI bots represented only a subset of verified bot traffic but could have disproportionate impact on how content is surfaced and consumed. The company reported that 57% of AI “fetcher” requests targeted non-cached content, often associated with real-time or highly specific queries.
The report frames bot management as a broader business issue as automated traffic grows, particularly where it influences how content is accessed and reused by AI systems, and where it drives demand on infrastructure. It suggests organisations need more granular decisions based on bot intent and the business impact of allowing access.
You can read the full report here.
