How do you stop a bot that acts like a real user?
Ask a network security engineer what’s changed in the past three years and the answer is always the same. The bots got smarter, and there are a lot more of them.
Automated abuse used to be easy to sort into buckets. Scripted crawlers cycling through datacenter IP ranges. Botnets are assembled from consumer devices that have been taken over. Stolen logins are repeatedly used against login pages by credential stuffing software. Blocklists, rate limiters, and detection rules could prevent the majority of it from inflicting significant harm because it is ugly but predictable enough.
Generative AI broke that predictability. Volume went up, sure. The bigger problem is that bots became hard to tell apart from real users, and people who could never have built that themselves can now get it off the shelf.
The scale shift
Imperva’s 2025 Bad Bot Report put a number on what practitioners had already been sensing: in 2024, automated bot traffic crossed 51% of all global web traffic, the first time bots outnumbered humans on the internet in a decade. Bad bots specifically landed at 37%, up from 32% the year before, the sixth consecutive annual climb.
LLMs and AI-powered automation tools are behind a lot of that growth. The technical floor dropped so far that someone with minimal skills and an off-the-shelf platform can now run attacks requiring real expertise that a few years ago.
What AI-driven abuse looks like
Scraping is probably the most visible change. AI training pipelines need enormous amounts of web data, and a significant portion of that gets harvested through scraping campaigns, often aggressive ones. HUMAN Security’s benchmarks show scraping attacks in the technology and SaaS sector rising from 30% to 36% of traffic in a single year.
For IP holders, that means traffic that looks normal but is really there to copy content at scale, usually from behind residential proxies so blocklists never see it. Businesses that use restaurant management software, along with other industries that live on proprietary digital assets, are more exposed. Attackers want menus and pricing, plus whatever operational data they can get, either to compete or to sell.
Account takeover is the second major pressure point. Incidents hit roughly 330,000 in December 2024. A year earlier it was about 190,000.
The skills behind the tooling
Better tooling only helps if your team understands how AI systems behave and where they fail. That’s the gap ISACA’s Advanced in AI Security Management (AAISM) certification is meant to fill. It launched in 2025 as the first AI-focused security management credential, aimed at experienced practitioners who already hold an active CISSP or CISM and now have to manage AI-specific risk across the full lifecycle.
If you want to build these skills and earn the credential, AAISM training through Destination Certification covers every exam domain and prepares you for the exam directly. You pick the format. The MasterClass is self-paced with structured lessons, and the Bootcamp is live and instructor-led if you’d rather go at it intensively.
Why reputation-based defenses are struggling
IP reputation systems were built around a simple idea: watch for abusive behavior, flag the source, cut it off.
Two things have gone wrong with that model.
Routing is the first. Traffic now moves through residential proxies and ordinary cloud services, so the source IP looks fine. A blocklist built around datacenter ranges won’t do much when the request comes from a home address in Ohio, or from a mid-tier cloud provider nobody has flagged.
The second problem is behavioral. AI-generated bots now move through sites closely enough to human patterns that standard anomaly detection doesn’t catch them. Human typing cadence, plausible session navigation, session rotation across different residential IPs, none of that trips the thresholds built for simpler tools. The only way to catch it is to model what normal traffic looks like for your environment and flag what doesn’t fit. That’s a completely different technical problem than maintaining a blocklist, and most legacy systems weren’t built to solve it.
Defenders are fighting back with AI, too
ML-based detection has been gaining ground. Rather than checking traffic against lists of known-bad IPs, it learns what normal traffic looks like and flags small irregularities that point to automation, even when the surface signals look clean.
The governance gap
The tooling is improving. The harder problem is that organizations’ ability to run it well is lagging considerably behind. Adapting cybersecurity training to AI threats has become urgent, and not only for security operations teams. It matters for anyone responsible for risk governance across AI systems.
Controls fail without governance behind them. You can spend a fortune on tooling and still not be secure if nobody on the team can audit an ML model for drift or explain an AI-based detection strategy, and nobody knows what to do when a campaign moves outside the ruleset. Structured AI security management training exists to close that gap, and it’s now an operational need, not a theoretical one.
What this means for IP holders
If you hold, lease, or manage IP address space, your obligations have changed. Three shifts are now non-negotiable:
Behavioral monitoring over blocklists: Watching for known abuse observability isn’t sufficient anymore. If your addresses are being funneled through residential proxy networks for scraping or credential stuffing, your reputation takes the hit whether or not you were involved. By the time a standard blocklist check catches it, the damage is usually done.
Faster anomaly response: Network teams and abuse handling now have to work together as a matter of course, not as a nice extra.
Abuse desk automation: Campaigns now outrun the teams meant to handle them. Without automation and clear escalation paths, response times slip, and the reputational damage keeps piling up while everyone scrambles.
Looking ahead
Generative AI has changed what abuse looks like online. Judging behavior and intent matters more than ever, because even something as ordinary as a QR code generator can end up in a phishing campaign.
No single control gets you there. The organizations doing this well build behavioral detection and governance together. They spend on people as seriously as they spend on tools, and they run abuse management all the time, not just when something breaks. The threat surface shifted, and everything built on top of it has to shift too.
Ready to take back control of your IP infrastructure? Start by auditing your abuse detection stack and finding the places where behavioral monitoring should replace your blocklists. 
John Berti
Tags: Bot Traffic, Cybersecurity, Generative AI
