Fastly
Reports
All Statistics
99% of bot traffic is unwanted or unverifiable.
47% of requests to cached content come from bots.
40% of organizations have faced operational disruption as a result of AI activity.
The financial cost of a cybersecurity incident for AI-first businesses exceeds the cost for non-AI-first businesses by more than 135%.
44% of AI-first organizations report that AI was directly exploited in their most recent security incident, compared to 6% of non-AI-first organizations.
Organizations classified as 'Exceptional' in AppSec maturity are 3.7 times more likely than 'Emerging' programs to reduce negative user experiences by more than 20%.
The High Technology industry has 35.5% and the Travel and Hospitality industry has 18.3% of organizations classified as 'Exceptional' in AppSec maturity.
In December 2025, Japan had 18%, the UK had 16%, and the US had 12% of organizations classified as 'Exceptional' in AppSec maturity.
Fetcher bots, including those from ChatGPT and Perplexity, are driving massive real-time request volumes, with some cases exceeding 39,000 requests per minute.
ChatGPT generates the most real-time traffic to websites, with 98% of fetcher bot requests attributable to OpenAI’s bots
North America accounts for nearly 90% of observed AI crawler traffic, receiving a heavy skew compared to other regions like Europe, Asia, and Latin America.
High technology organizations were the most targeted industry by bots overall, representing 35% of observed attacks.
Search engine crawlers accounted for 66% of wanted bot traffic.
Commerce websites attracted the largest proportion of unwanted bot traffic at 39%.
Nearly half (46%) of organisations are unclear about who holds ultimate responsibility for cybersecurity incidents.
38% of IT decision makers have promised “increased scrutiny of security disclosure documentation from supervisory agencies”.
38% of IT decision makers say they improved legal support for cybersecurity staff, including liability insurance, and corporations have allocated more resources to security in the past year.
Experts project a 39% increase in the number of web applications and websites within the next two years, rising from an average of 145 to 201 per organisation.
92% of organisations implement at least one web application firewall (WAF), while 67% rely on multiple WAFs from different vendors.
59% of IT professionals believe that cyber adversaries have the upper hand in leveraging AI for attacks.
Currently, 32% of applications use APIs, but this is expected to rise to 80% in the next 24 months.
32% of urveyed professionals noted that agile development processes make it difficult to maintain security.
59% of IT professionals and 55% of cybersecurity professionals believe that AI-powered automation gives adversaries an advantage.
60% of all origin traffic is from bots.
In January 2026, bots accounted for 49% of all requests, nearly matching human traffic at 51%.
57% of AI fetcher requests target non-cached content.
64% of organizations report that AI scraping has become a material cost center, with average annual infrastructure impacts exceeding $348,000.
43% of organizations have seen infrastructure expenses increase as a direct result of AI activity.
53% of organizations acknowledge they have an increased need for AI-specific security expertise to effectively defend their systems.
75% of organizations are concerned about Distributed Denial-of-Service (DDoS) attacks targeting AI agents.
AI-first businesses take nearly seven months on average to fully recover from cybersecurity incidents, which is 80 days longer than non-AI-first businesses.
34% of AI-first organizations say AI use led to a security oversight or blind spot that contributed to their last security incident, compared to 20% for non-AI-first organizations.
56% of organizations invest in agentic discoverability, 55% invest in API security, and 54% invest in web application firewalls.
Organizations classified as 'Exceptional' in AppSec maturity are 3.6 times more likely to report a 20% or greater improvement in application availability compared to the average.
Organizations classified as 'Exceptional' in AppSec maturity are 1.9 times less likely to experience a data breach than Emerging programs.
Organizations classified as 'Exceptional' in AppSec maturity are 3.6 times more likely to achieve a 20% or greater improvement in developer productivity compared to those in the 'Evolving' category.
Bot requests increased by 2% in Q3 2025 compared to the prior quarter, representing billions of requests.
Bots account for 29% of all web traffic, with approximately 25% of this traffic classified as unwanted.
4% of wanted bot requests were blocked, reflecting concerns about data usage and revenue impact.
Only 1% of users click through to source websites that have an AI summary, indicating diminished referral traffic for Media and Entertainment publishers.
Meta’s AI crawler and OpenAI’s ChatGPT fetcher accounted for 60% and 68% of their respective traffic categories in Q3 2025.
In Q3 2025, commerce received 88% of crawler traffic, while the Public Sector received 96%, and Education had the highest fetcher volume at 77%
89% of headless bot traffic (which mimic human behavior at machine speed) in Q3 targeted transaction-heavy industries like Financial Services and Commerce.
Analysis of traffic from mid-April to mid-July 2025 revealed that AI crawlers made up almost 80% of all AI bot traffic observed.
Meta’s AI bots generated 52% of AI crawler traffic, which is more than double that of Google (23%) or OpenAI (20%).
37% of all observed internet traffic originated from bots.
Attacks on the commerce industry doubled, rising from 15% of all observed attacks in Q1 2024 to 31% of all observed attacks in Q1 2025.
Of the observed bot traffic, 89% was classified as unwanted.
Attacks on the commerce industry doubled, rising from 15% of all observed attacks in Q1 2024 to 31% of all observed attacks in Q1 2025.