Bot operations in Q2 2026: what changed for defenders?

TL;DR: The same criminal ecosystem became cheaper and faster to enter in Q2 2026, with AI lowering tooling barriers, rental capability dominating the bot market, and residential proxies plus AI account sales sustaining fraud operations, according to Kasada's Threat Report. The quarter's signal is that defenders must focus on economics, identity abuse, and operational friction rather than assuming AI changes adversary intent.

Editorial analysis by NHI Mgmt Group, based on content published by Kasada: “Q2 2026 Threat Report: Same Adversaries, Faster Tooling”.

By the numbers:

• A newcomer can become fully operational in the bot ecosystem for $400 to $500, according to Kasada.
• Roughly 94% of the operators KasadaIQ can classify rent their capability rather than build it, according to Kasada.
• Clean residential proxies now sell from $0.30 per gigabyte, according to Kasada.

Key questions

Q: What breaks when bot operators can rent capability instead of building it?

A: When capability is rented, the defender loses the advantage of attacking technical skill gaps.

Q: Why do residential proxies make fraud detection harder?

A: Residential proxies make fraud detection harder because they borrow the appearance of real customer connections.

Q: How should security teams govern AI accounts that have resale value?

A: Treat AI accounts as governed identities with lifecycle controls, usage analytics, and abuse monitoring.

Practitioner guidance

• Harden account economics against resale value Flag accounts with unusually rich profile data, broad feature access, or long-lived session tokens because those traits increase criminal resale value.
• Reduce trust in network origin Lower the weight of IP reputation in fraud decisions and combine it with device history, session behaviour, and identity confidence.
• Instrument AI account usage like privileged access Track issuance, duration, feature use, and anomaly patterns for AI accounts so resale or sharing behaviour becomes visible.

Bottom line: Bot operators are scaling through rented capability, cheap proxies, and purchased accounts rather than through deep technical innovation.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →