Topic starter
24/10/2026 8:49 pm
TL;DR: Bot operators are scaling through rented capability, cheap proxies, and purchased accounts rather than deep technical innovation, according to Kasada's Q2 2026 Threat Report. Identity checks and abuse controls now matter more than IP-only blocking when reuse and resale make attacks easy to repeat.
Editorial analysis by NHI Mgmt Group, based on content published by Kasada: “Q2 2026 Threat Report: Same Adversaries, Faster Tooling”.
By the numbers:
- A newcomer can become fully operational in the bot ecosystem for $400 to $500, according to Kasada.
- Roughly 94% of the operators KasadaIQ can classify rent their capability rather than build it, according to Kasada.
- Clean residential proxies now sell from $0.30 per gigabyte, according to Kasada.
Key questions
Q: Why do residential proxies make fraud detection harder?
A: Residential proxies make fraud detection harder because they borrow the appearance of real customer connections.
Q: How should security teams govern AI accounts that have resale value?
A: Treat AI accounts as governed identities with lifecycle controls, usage analytics, and abuse monitoring.
Q: What breaks when bot operators can rent capability instead of building it?
A: When capability is rented, the defender loses the advantage of attacking technical skill gaps.
Practitioner guidance
- Harden account economics against resale value Flag accounts with unusually rich profile data, broad feature access, or long-lived session tokens because those traits increase criminal resale value.
- Reduce trust in network origin Lower the weight of IP reputation in fraud decisions and combine it with device history, session behaviour, and identity confidence.
- Instrument AI account usage like privileged access Track issuance, duration, feature use, and anomaly patterns for AI accounts so resale or sharing behaviour becomes visible.
Bottom line: Bot operators are scaling through rented capability, cheap proxies, and purchased accounts rather than through deep technical innovation.
Glossary terms: Bot Operation Economy, Identity Resale Value, Residential Proxy, Valid Account Abuse
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Bot operations now behave like a supply chain, not a single threat. The quarter's strongest signal is that adversaries are buying capability as a service, which reduces the importance of individual technical skill and increases the importance of access to infrastructure, accounts, and automation. That means the governance problem is no longer only detection at the edge but disruption of the commercial model that supports abuse. Practitioners should treat criminal capability marketplaces as part of the threat surface.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should organisations prioritise identity-linked signals over IP reputation?
A: Organisations should prioritise identity-linked signals whenever attackers can cheaply rotate network origin, proxies, or automation infrastructure. In those conditions, IP reputation becomes a supplementary indicator, not a primary decision point. Behaviour, session integrity, and identity confidence give defenders a harder signal to fake and a better basis for response.
👉 Read our full editorial: AI and cheaper tooling are lowering bot operation barriers in Q2 2026
This post was modified 7 days ago by NHI Mgmt Group