Most Companies Think They Can Handle AI Bots. New Data Says Otherwise.

Most companies believe they can see AI bots moving through their networks. The harder question is whether they understand what those bots are doing once they get there. 

New research from Hydrolix suggests enterprise confidence is running well ahead of readiness. In The State of AI Bots in 2026: Risk, Readiness, and Governance, a survey of 300 enterprise leaders across IT security, engineering, infrastructure and site reliability engineering found that 79% of respondents said they can detect bot activity on their networks.

Only 23% said they have a proactive strategy in place to manage it. That 56 point gap is the report’s central warning. Companies are not necessarily blind to automation.

They are struggling to understand which automation matters, which traffic is useful, which activity is adversarial and which bots are quietly driving up infrastructure costs before anyone in security, engineering or finance connects the dots. 

The Detection Gap Is Really a Visibility Gap

Part of the challenge is that many organizations still cannot confidently separate human traffic from nonhuman traffic. Survey respondents estimated that AI bots generate roughly 17% of their traffic. That is far lower than figures found in several industry reports tracking overall automated web activity. 

According to Imperva’s 2026 Bad Bot Report, automated traffic accounted for more than 53% of all web traffic last year, with malicious bots alone making up 40%. The gap between what companies believe they are seeing and what the broader market data suggests points to a familiar problem in enterprise security: visibility is rarely as complete as teams think it is. 

“When we look at traffic logs alongside the security incident data, adversarial bots and legitimate automation are increasingly showing up as identical,” said Simon Ouderkirk, VP of Product at Hydrolix. “The old model of flagging what ‘looks wrong’ is failing because these bots are designed to blend in. They’re built to look exactly like your best customers.” 

That is what makes the current wave of AI bots harder to manage than earlier generations of automated traffic. Modern bots can rotate identities, adapt in real time and evade traditional checkpoints. Many no longer announce themselves through obvious volume spikes or crude behavioral patterns. They operate inside the noise. 

Not Every Bot Is the Enemy

The bot problem has also become more complicated because bots are no longer only bad actors. Enterprises now depend on automation for daily operations. 

More than half of the Hydrolix survey respondents said they rely on bots for uptime monitoring. Nearly as many use automated agents for SEO. Others use bots for analytics, performance testing and operational tasks that would otherwise require significant human hours. 

That changes the old “block all bots” strategy. A blunt approach no longer works when the business itself depends on automation to function. The question has shifted from whether companies can detect bots to whether they can distinguish the bots that benefit the business from the ones working against it. 

That distinction is where many companies remain exposed. 

Dr. Chase Cunningham, the cybersecurity strategist known as “Dr. Zero Trust,” said the issue should be viewed through the same trust lens applied to human users. 

“Zero trust has always been about verifying identity before granting access,” Cunningham said. “That principle doesn’t change just because the actor is a bot. AI-driven bots require the same authentication, authorization, and continuous verification you’d expect from human users because they’re faster, more persistent, and harder to distinguish from legitimate traffic.” 

AI Bots Are Becoming a Cost Problem, Too

Security teams often talk about bots in terms of fraud, credential attacks, scraping and abuse. But the financial impact is becoming harder to ignore. 

Unwanted bot traffic that bypasses perimeter controls and reaches origin infrastructure can drive up cloud, bandwidth, compute and network provider costs. Those costs may not show up as a clean security incident. They may appear months later as a finance anomaly, attached to traffic spikes no one can explain. 

“Unwanted bot traffic is no longer just a security problem,” Cunningham said. “It’s a six-figure infrastructure and revenue problem that AI is only accelerating.” 

That cost dynamic matters because many enterprises still measure bot risk through a narrow security lens. If a bot does not trigger an alert, steal credentials or take down a service, it may not be treated as a meaningful threat. But a crawler that repeatedly hammers origin infrastructure can still hurt the business, even if it never behaves maliciously in the traditional sense. 

The Real Problem Is Classification

At the root of the AI bot challenge is a classification problem. 

Most existing detection tools are built to raise flags. They are less equipped to explain intent. They can identify a spike, an anomaly or a policy violation, but they often cannot explain whether the traffic came from a search engine crawler, a partner integration, a vulnerability probe, an AI training scraper or an adversarial bot designed to mimic ordinary users. 

That distinction matters. 

A media company concerned about AI training scrapers faces a different problem than a financial services firm battling credential stuffing. An ecommerce platform trying to protect inventory has different risk calculations than an infrastructure provider watching automated traffic consume compute resources. Each scenario requires a different response. 

Only 33% of Hydrolix survey respondents said their WAF or bot detection solution blocked more than 50% of AI bot traffic in the last 12 months. Even among organizations that blocked traffic, the larger question remains: did they understand what they blocked and why? 

The report frames this as a governance issue rather than a tooling issue alone. The organizations closing the readiness gap are not simply collecting more telemetry. They are building processes to understand intent, risk, cost and operational impact. 

“You’re flying blind if you’re only looking at whether traffic is human or not,” Ouderkirk said. “You need to understand what that traffic is trying to accomplish. A legitimate crawler that’s hammering your origin server is a cost problem even if it has no malicious intent. An adversarial bot operating within normal behavioral bounds is a security problem even if it never triggers an alert.” 

More Data Will Not Fix the Problem by Itself

The Hydrolix research also shows why many enterprises are struggling to move from awareness to action. 

Forty percent of respondents cited budget constraints as a barrier. Thirty percent pointed to fragmented systems and insufficient visibility. Another 27% said they were overwhelmed by telemetry volume. 

That last point may be the most important. The answer to too much data is rarely more alerts. Security, engineering and infrastructure teams already have more signals than they can reasonably interpret. What they lack is context. 

Without that context, bot management becomes reactive. Teams block what looks suspicious, allow what seems familiar and hope that the most dangerous activity stands out. AI bots are making that model less reliable because the more sophisticated ones are designed not to stand out at all. 

The Next Bot Strategy Has to Be Governance Led

The next phase of bot management will likely depend less on whether a company can detect automation and more on whether it can govern automated activity across security, infrastructure, finance and operations. 

That means asking better questions. 

Which bots are allowed? Which ones are useful but too expensive? Which ones are unknown? Which ones are accessing sensitive systems, scraping proprietary content, inflating cloud costs or probing for weaknesses? Which teams own the response when the answer is not strictly a security issue? 

Those questions cannot be answered by traffic volume alone. 

The Hydrolix report does not claim that every organization faces the same bot risk. That is part of the point. The most urgent risk depends on industry, infrastructure, business model and what types of bots are already operating in the environment. 

For some companies, the immediate concern may be account abuse. For others, it may be AI training scrapers or a runaway infrastructure spend. But across all of those use cases, the underlying problem is the same: enterprises cannot manage what they cannot classify. 

The companies that close the AI bot readiness gap will not be the ones that simply block more traffic. They will be the ones that can explain which automated traffic belongs, which traffic does not and what each bot is costing the business.