Notifications
Clear all
Topic starter
18/08/2026 2:21 pm
TL;DR: AI bot visits to human visits shifted from 1:200 to 1:31 in a single year, according to Netacea research, while LLM systems, agentic browsers, and third-party agents are now acting on infrastructure that was never designed for machine-to-machine commerce. The governance problem is visibility first, then policy, because declared and undeclared traffic create different security and business risks.
NHIMG editorial — based on content published by Netacea: The Rise of the Agentic Internet: What Every CISO Needs to Know About Governing Non-Human Web Traffic
By the numbers:
- AI bot visits to human visits shifted from 1:200 to 1:31 in a single year.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, or revealing credentials.
Questions worth separating out
Q: How should security teams govern AI agents that browse and transact on behalf of users?
A: Security teams should govern AI agents as delegated actors with narrow, task-scoped permissions, not as enhanced browsers.
Q: What breaks when organisations treat all automation as the same?
A: Controls fail because useful automation, partner integrations, scrapers, and agentic browsers each create different risk and cost profiles.
Q: How do you know if machine traffic governance is actually working?
A: Look for three signals: you can classify traffic by declared purpose, you can audit the identity or session path behind non-human actions, and you can tie response thresholds to measurable business impact.
Practitioner guidance
- Define traffic classes for machine actors Create policy buckets for declared partners, internal automation, AI scrapers, and unknown agents so each class has a distinct control path and review owner.
- Bind access decisions to declared purpose Require machine sessions to present purpose, registration, or entitlement context before they can transact, scrape, or invoke costly workflows.
- Instrument business-impact thresholds Set thresholds for content harvesting, checkout abuse, and API consumption so response actions map to revenue loss, fraud risk, or service degradation.
What's in the full report
Netacea's full research covers the operational detail this post intentionally leaves for the source:
- The Agentic Traffic Composition Model and its classification categories for machine visitors
- Examples of how declared and undeclared traffic change governance decisions in practice
- Commercial impact scenarios for content scraping, agentic browsing, and platform abuse
- The article's broader market framing for CISOs, digital commerce leads, and fraud teams
👉 Read Netacea's analysis of the agentic internet and non-human web traffic →
Agentic web traffic: what CISOs need to govern now?
Explore further
18/08/2026 3:12 pm
Agentic traffic is now an identity governance problem, not just a bot problem. Once machine actors can browse, call tools, and complete workflows, the platform has to decide whether the actor is a customer, a partner, an automation script, or an AI agent. That decision affects authorisation, auditability, and fraud response. Security teams that only tune bot signatures will miss the identity layer where delegated trust is actually granted. Practitioner conclusion: govern machine actors as identities with purpose, scope, and revocation paths.
A question worth separating out:
Q: Who should be accountable for non-human traffic risk in the enterprise?
A: Accountability should sit across security, fraud, digital product, and platform operations, because machine traffic affects all four. Security owns trust and logging, product owns acceptable use, fraud owns abuse patterns, and platform teams own policy enforcement. A shared operating model is the only practical way to avoid blind spots.
👉 Read our full editorial: The agentic internet exposes a governance gap in web traffic
