Notifications
Clear all
Topic starter
18/08/2026 2:32 pm
TL;DR: As AI-powered scrapers learn to mimic human browsing, legacy controls such as CAPTCHAs, static IP blocks, and user-agent checks lose reliability, according to Netacea. The real control problem is session intent: distinguishing legitimate users, integrations, and search engines from automated actors that harvest content, pricing, and catalogue data at scale.
NHIMG editorial — based on content published by Netacea: Talos intent-based detection and the limits of legacy anti-scraping defences
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams stop AI scrapers that mimic human behaviour?
A: They should stop relying on single-signal controls and move to behavioural classification at the session level.
Q: Why do CAPTCHAs and IP blocks fail against modern bots?
A: They fail because modern bots can solve challenges, rotate infrastructure, and imitate the delays and click paths of real users.
Q: What do teams get wrong about bot detection and scraping risk?
A: They often treat bot defence as a blocking problem rather than a governance problem.
Practitioner guidance
- Classify non-human traffic by session intent Define behavioural rules that separate search engines, accessibility tools, integrations, and scrapers based on navigation sequence, pacing, and repeat access patterns.
- Map bot policy to business-approved use cases Create explicit allowlists and policy conditions for known legitimate automation so blocking controls do not disrupt search indexing or authorised integrations.
- Centralise detection across full user journeys Inspect behaviour across websites, APIs, and mobile apps from the server side so evasion through client-side manipulation does not fragment visibility.
What's in the full article
Netacea's full blog covers the operational detail this post intentionally leaves for the source:
- Customer-specific model design for separating legitimate automation from scraper behaviour
- Server-side detection and real-time mitigation mechanics across websites, APIs, and mobile apps
- Case-study detail on the luxury shoe retailer, including request reduction and CPU impact
- How the platform turns traffic visibility into monetisation and licensing decisions
👉 Read Netacea's analysis of intent-based detection for AI scraping →
AI scrapers and bot intent: what legacy defences are missing?
Explore further
18/08/2026 3:19 pm
Intent, not appearance, is now the decisive control variable. The article’s core point is that non-human activity can no longer be governed by surface checks alone. CAPTCHAs, fingerprints, and IP blocks are increasingly bypassed by automated actors that imitate legitimate session behaviour. For IAM and NHI programmes, that means the policy question shifts from 'is this a bot?' to 'what is this session trying to do?' Practitioners should treat behavioural intent as part of access governance.
A question worth separating out:
Q: How should organisations balance bot blocking with legitimate automation?
A: They should define policy for approved non-human use cases first, then enforce different treatment based on intent and session behaviour. Search engines, accessibility tools, and partner integrations need different rules from scrapers or competitive intelligence bots, so the control model must separate business value from abuse.
👉 Read our full editorial: Intent-based bot detection is replacing legacy scraping defences
