Topic starter
22/06/2026 10:22 am
TL;DR: Most teams still cannot quantify how much agentic AI traffic hits consumer identity flows, even though 85% of organisations in Arkose Labs' view already had bot detection deployed, and Forrester has now recognised bot and agent trust management as a distinct category. The real issue is that legacy bot controls were built to answer whether traffic is human, not what it is trying to do, so visibility and intent classification now matter more than simple automation detection, according to Arkose Labs research.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “The Forrester Wave Just Confirmed What We Have Been Building Toward”.
Key questions
Q: What breaks when bot detection only looks for human versus automated traffic?
A: Bot detection breaks when legitimate AI agents and malicious automation share similar traffic patterns.
Q: Why do agentic AI sessions create risk for login and checkout flows?
A: Because they can look like ordinary user activity while operating at machine speed and scale.
Q: How should security teams tell benign agent traffic from malicious automation?
A: Use a combination of provenance, behavioural patterns, and enforcement context.
Practitioner guidance
- Instrument consumer identity flows for traffic class visibility Measure login, signup, and checkout traffic separately for human users, disclosed agents, non-disclosing agents, and suspicious automation so your baseline reflects actual traffic composition.
- Build trust classes into enforcement policy Define allow, challenge, step-up, and block decisions by trust class and declared intent instead of applying one bot rule across every automated session.
- Correlate device, behaviour, and challenge signals Combine device intelligence, behavioural biometrics, and adaptive challenge telemetry so one weak signal does not decide enforcement on its own.
Bottom line: Legacy bot controls are increasingly misaligned with AI traffic because they were built to identify automation, not to interpret intent.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 11:14 am
Bot management has become an intent problem, not an automation problem. The category was built around identifying scripted traffic, but AI agents and agentic browsers now blur the line between legitimate automation and hostile activity. That means the governance question has changed from "is this a bot?" to "what is this actor trying to do?" Practitioners should treat intent classification as a core identity control for consumer-facing flows.
A few things that frame the scale:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: What should identity and fraud teams do when agent traffic is rising?
A: They should separate traffic visibility from fraud outcomes and map both to the account journey. That means classifying sessions, correlating signals across the stack, and adjusting enforcement so challenge and step-up responses are tied to suspicious behaviour. It also means treating agent activity as a standing input to identity governance, not an edge case.
👉 Read our full editorial: Bot and agent trust management exposes the AI traffic blind spot