Bots surpass human traffic in SG at 58% amidst AI-driven surge

Human traffic only stood at 42%.

Bots accounted for 58% of internet traffic in Singapore in 2025, with 52% classified as malicious, according to Thales’ 2026 Bad Bot Report.

The report shows automated systems now outpace human activity online, with human traffic at 42%, attributing the shift to rising artificial intelligence (AI)-driven automation and the emergence of AI agents operating across digital systems.

Thales said AI-driven bot attacks increased 12.5 times year on year in 2025.

It also identified AI agents as a new category of internet traffic, alongside traditional good and bad bots, where these agents interact directly with applications and application programming interfaces (APIs) to retrieve data and perform tasks.

The report said this development has blurred the distinction between legitimate and malicious automation, whilst adding that intent, rather than identity, has become the main security challenge for organisations.

APIs and identity systems have become the main targets for attackers. Thales said 27% of bot attacks now target APIs, where bots bypass user interfaces and interact directly with backend systems.

In Singapore, financial services accounted for 80% of bot attacks, whilst the computing and IT sector recorded 45% of account takeover incidents. The gambling sector recorded the highest proportion of bad bot traffic at 100%.

The report also found bots increasingly operate across multiple sectors, including sports, travel, and healthcare, where advanced bot activity measured 55%, 40%, and 29% respectively.

Thales said organisations face a visibility gap as AI-driven activity becomes harder to distinguish from legitimate traffic. It said much of this activity remains unverified within existing systems.

The company said organisations must shift from bot detection to governance of automation, calling for controls at the API and identity layer, and the use of behavioural analysis to assess automated activity.

Thales said the data is based on 2025 global bot activity analysed by its Threat Research and Security Analyst Services teams.