For the first time in the history of the internet, most of it isn't human.
In 2025, automated bots generated 53% of all web traffic — up from 51% the year before — while the human share fell to just 47%. This isn't a fluke spike tied to some viral event. Analysts describe it as a structural shift: bots crossed the halfway mark in 2024 and, in 2025, settled in as the stable majority.
Not all of that automation is sinister. Around 13% is "good" bots — search-engine crawlers, monitoring tools, accessibility readers. But the larger share is hostile. Bad bots — scrapers, credential-stuffers, ad-fraud and account-takeover tools — now make up about 40% of all internet traffic, up from 37% a year earlier. Roughly one in three requests hitting a typical website is actively malicious.
What changed so fast is AI. Cheap large language models let almost anyone spin up bots that mimic human pacing, defeat rate limits, and slip past the old defences. In a single year, AI-driven bot attacks surged 12.5× — the daily volume Imperva blocked jumped from 2 million to 25 million.
For comparison, where all that traffic actually comes from:
- Bots (total): 53% — the majority
- Humans: 47% — now the minority
- Bad bots alone: ~40% of everything
- Good bots: ~13%
There's now a third category emerging that breaks the old human-or-bot binary entirely: AI agents — software acting on a real person's behalf, booking flights, filling carts, pulling data. They behave like legitimate users because, in a sense, they are. Security teams can no longer just ask "is this a bot?" — they have to ask what it's doing and whether it was sent by a human at all.
The next time someone tells you the internet connects people, remember that on today's web, the people are outnumbered.