Topic starter
12/06/2026 9:54 pm
TL;DR: Total attacks from bots and fraud farms rose 121% in Q2 versus Q1 2023, while malicious bot attacks increased 167% and intelligent bot attacks rose 291%, according to Arkose Labs. The core issue is not just volume but economics: attackers are industrialising fraud faster than many enterprise controls can adapt.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “Decrypting Cyber Threats: Insights from Breaking (Bad) Bots”.
By the numbers:
- Total attacks from bots and fraud farms rose 121% in Q2 over Q1 2023, according to Arkose Labs.
- Malicious bot attacks increased 167% in Q2 over Q1 2023, according to Arkose Labs.
- Intelligent bot attacks increased 291% in Q2 over Q1 2023, according to Arkose Labs.
Key questions
Q: What should teams do first when bot abuse starts overwhelming account flows?
A: Start with the identity journeys attackers abuse most often: signup, password reset, account recovery, and customer support.
Q: Why do bots and fraud farms create such a large fraud risk?
A: They lower the skill barrier and raise the attacker’s scale at the same time.
Q: What are the signs that bot defenses are failing?
A: A common sign is when account creation, login, or recovery traffic looks healthy in aggregate but hidden abuse keeps increasing.
Practitioner guidance
- Tighten account recovery controls Apply stronger verification and step-up checks to password resets, support-assisted recovery, and account change requests so automated abuse cannot reuse the weakest user journey as an entry point.
- Instrument behavioural risk signals Feed device intelligence, interaction patterns, and session behaviour into fraud and IAM decisions so suspicious automation can be identified before it reaches takeover or signup success.
- Segment bot traffic by abuse pattern Track fake account creation, scraping, credential stuffing, and support manipulation as separate abuse classes, because each path needs different thresholds and different response logic.
Bottom line: Bot abuse is not just traffic inflation. It is a governance problem that undermines account trust, recovery flows, and consumer-facing identity decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
13/06/2026 12:19 am
Bot abuse has become an identity governance problem, not just a fraud problem. When machine-generated traffic dominates the interaction layer, enterprises are no longer deciding only whether a user is legitimate. They are deciding whether the session itself is authentic enough to trust. That shifts the control plane from static perimeter blocking to continuous assurance across signup, login, recovery, and support.
A question worth separating out:
Q: How should security teams balance bot blocking with customer experience?
A: Use adaptive controls that add friction only when a session looks suspicious, rather than applying the same challenge everywhere. That approach preserves the consumer journey for legitimate users while making automation more expensive. The goal is not maximum blocking, but selective resistance where abuse is most profitable.
👉 Read our full editorial: Bot abuse is scaling faster than enterprise fraud controls
This post was modified 3 days ago by NHI Mgmt Group