Notifications
Clear all
Topic starter
02/09/2026 3:58 pm
TL;DR: Traditional WAFs miss modern bot traffic that uses residential proxies, headless browsers, and distributed request patterns to look legitimate, according to SecureAuth. Behavioral analysis, device intelligence, and continuous risk scoring change bot defence from a static filter into an adaptive control layer that reduces false positives while catching credential stuffing and scraping.
NHIMG editorial — based on content published by SecureAuth: WAFs alone miss modern bot attacks and require behavioral risk analysis
By the numbers:
- 72% of attacks use residential IPs, which makes them look legitimate at the network layer.
- 85% of bots mimic real browsers, weakening signature-based detection.
- $6 million annually, attacks cost enterprises an average of $6 million annually, and 80% originate from IPs that would pass traditional WAF rules.
Questions worth separating out
Q: What breaks when WAFs are used alone against scalping bots?
A: WAF-only controls usually fail because scalping traffic is valid at the request level.
Q: Why do residential proxies and headless browsers increase account takeover risk?
A: They make malicious sessions look like ordinary customer sessions at the point where many controls still rely on IP reputation and signature matching.
Q: How do security teams know whether QBot detections are actually working?
A: Look for multi-signal coverage rather than raw alert volume.
Practitioner guidance
- Add behavioral risk scoring to high-value login and transaction journeys Instrument mouse movement, keystroke timing, navigation flow, and device consistency for sessions that matter most, then route risky sessions to challenge or step-up controls before sensitive actions complete.
- Tune controls for residential proxy and headless browser abuse Review whether IP reputation, browser fingerprinting, and rate limits are working together or being bypassed by distributed automation that appears legitimate at the network layer.
- Separate bot management from static WAF rule tuning Use the WAF for request filtering, but move account takeover, enumeration, and scraping decisions into a risk engine that can evaluate behaviour continuously during the session.
What's in the full article
SecureAuth's full blog post covers the implementation detail this analysis intentionally leaves at the strategy layer:
- Behavioral signal categories used to score mouse, keyboard, touch, and navigation patterns in real time
- Deployment guidance for adding JavaScript-based telemetry without re-routing traffic
- Policy examples for allowing, challenging, or blocking sessions based on risk score
- Customer outcome metrics showing how bot traffic, false positives, and manual review time changed after deployment
👉 Read SecureAuth's analysis of why WAFs alone miss modern bot attacks →
WAFs and modern bots: what IAM teams need to know now?
Explore further
02/09/2026 3:58 pm
Behavioral context is now a core identity control, not an optional add-on. The article shows that WAF rules alone cannot reliably separate human sessions from automated abuse once attackers use residential proxies and headless browsers. That makes behavioural analysis part of the identity control plane, especially where customer-facing login and transaction flows are exposed. The practitioner conclusion is simple: if session behaviour is not measured, the control is guessing.
A few things that frame the scale:
- 85% of bots mimic real browsers, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared with nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Should IAM and fraud teams use the same signals for bot defence?
A: Yes, where customer sessions can be abused for account takeover, enumeration, or fake account creation. Shared behavioural and device signals reduce duplication and make it easier to spot abuse patterns that sit across authentication, identity assurance, and fraud operations.
👉 Read our full editorial: WAFs alone miss modern bot attacks: what behavioral risk adds
