Topic starter
18/08/2026 2:21 pm
TL;DR: AI bot visits to human visits shifted from 1:200 to 1:31 in a single year, according to Netacea research, while LLM systems, agentic browsers, and third-party agents are now acting on infrastructure that was never designed for machine-to-machine commerce. The governance problem is visibility first, then policy, because declared and undeclared traffic create different security and business risks.
Editorial analysis by NHI Mgmt Group, based on content published by Netacea: “The Rise of the Agentic Internet: What Every CISO Needs to Know About Governing Non-Human Web Traffic”.
By the numbers:
- AI bot visits to human visits shifted from 1:200 to 1:31 in a single year.
Key questions
Q: What breaks when web traffic policies were written only for humans and simple bots?
A: Policies built for a human or basic-bot model break when traffic includes LLM scrapers, agentic browsers, and partner automation that looks legitimate at first glance.
Q: Why does declared versus undeclared machine traffic matter for governance?
A: Declared traffic can be governed through identity, contract, and policy, while undeclared traffic must be treated as an uncertainty and monitored more aggressively.
Q: How should organisations measure whether agentic traffic controls are working?
A: Measure whether the platform can classify traffic accurately enough to link each actor type to a policy outcome and a business impact.
Practitioner guidance
- Define a machine-traffic classification model Separate human users, declared automation, third-party agents, and unknown scrapers into different governance classes before policy enforcement.
- Instrument visibility before blocking Build telemetry that captures actor identity, session pattern, request intent, and downstream business effect so teams can distinguish abuse from legitimate automation.
- Assign joint ownership across security and commerce Set explicit decision rights for bot policy, pricing impact, fraud response, and partner automation so no team is left governing agentic traffic alone.
Bottom line: The core problem is no longer just bot volume. It is that web platforms must distinguish human users, declared automation, and undeclared agents before policy can work.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:12 pm
Agentic web traffic is becoming an identity governance problem, not just a bot-management problem. Once machines can browse, scrape, and transact, the question shifts from whether traffic is automated to whether it is governed as a distinct class of non-human activity. That creates an identity boundary problem because policy must follow actor type, intent, and lifecycle. Practitioners need to treat machine traffic as part of the access governance model.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Who should own governance of non-human web traffic?
A: Ownership should sit across security, fraud, and digital commerce, because the risk spans access governance, abuse prevention, and revenue protection. Security can define classification and control requirements, but product and commerce teams must help set acceptable automation thresholds. If one function owns it alone, the policy will be too narrow for the real risk.
👉 Read our full editorial: The agentic internet exposes a governance gap in web traffic