Bot and agent trust management: what changes for security teams?

TL;DR: Forrester’s evaluation, published by Kasada, says enterprises are moving beyond human-versus-bot checks toward deciding whether interactions are legitimate, abusive, or acting on someone else’s behalf, while also reporting 200% ROI for customers switching from legacy bot protection. That shift makes trust decisions, explainability, and downstream fraud signals the real control problem.

Editorial analysis by NHI Mgmt Group, based on content published by Kasada: “Access the Report A c c e s s t h e R e p o r t”.

By the numbers:

• Kasada says customers can see 40% security team productivity improvement from its approach.
• Kasada says its approach can reduce vendor management effort by 50%.
• Kasada says customers can see $15-$30 in prevented loss for every dollar spent.

Key questions

Q: How should security teams govern bot and agent activity without creating user friction?

A: Start by separating low-risk interactions from high-impact account actions, then apply stronger trust checks only where the business consequence justifies them.

Q: Why do bot and agent controls matter for identity programmes?

A: Because they now influence whether an interaction is trusted to act on behalf of a user or account.

Q: What signals show that bot protection is too blunt for current traffic patterns?

A: Look for high false-positive rates, unexplained blocks, repeated customer friction, and analysts who cannot tell why a request was treated as abusive or legitimate.

Practitioner guidance

• Define trust thresholds by action sensitivity Classify account actions by business risk, then require stronger assurance before high-impact changes such as payment, profile, or recovery events.
• Separate classification from enforcement Use bot and agent signals as inputs to policy, but keep a reviewable decision trail that explains why a request was challenged, blocked, or allowed.
• Connect abuse controls to identity assurance Feed session, account, device, and behavioural evidence into the same trust model so automation decisions reflect identity risk, not traffic volume alone.

Bottom line: The central shift is from identifying bots to governing whether an interaction is legitimate and authorised to act on behalf of someone else.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →