New 2026 E-Commerce Bot Threat Report details the rise of bad bots, AI-driven attacks, and emerging challenges for online retailers
Radware (NASDAQ: RDWR), a global leader in application security and delivery solutions for multi-cloud environments, today released its 2026 E-Commerce Bot Threat Report. The report found that malicious bots accounted for 43% of e-commerce website traffic during the 2025 holiday shopping season, compared with 46% generated by human shoppers.
For years, the defining story of holiday web traffic has been the steady rise of bots. Last year, overall bot traffic exceeded human traffic for the first time. This year, the story has sharpened further. It is no longer about the overall share of bots, but about the share of malicious bots specifically and how close it is to matching human traffic. During the 2025 holiday shopping season, according to Radware’s 2026 E-Commerce Bot Threat Report, bad bots accounted for 43% of traffic, up from 31% a year earlier, placing malicious automation within three percentage points of the entire human shopping audience.
“For years, the story was that web traffic was becoming more automated,” said Connie Stack, chief growth officer, Radware. “Today, the story is that malicious bots alone are approaching the size of the entire human shopping audience during peak shopping periods. Generative AI is lowering the barrier to entry for attackers and accelerating the growth of automated threats, making it increasingly important for organizations to distinguish legitimate automation from malicious activity.”
The report highlights a significant shift in the bot threat landscape. While sophisticated attackers continue to evolve their tactics, generative AI is lowering the barrier to entry for malicious actors. According to the report, nearly 70% of bad bot traffic observed during the holiday shopping season was classified as low sophistication, which Radware believes reflects how AI is enabling a broader population of attackers to build and launch automated attacks with minimal technical expertise.
The report’s key findings include:
- Malicious bots nearly matched human shoppers. Bad bots accounted for 43% of e-commerce traffic during the holiday shopping season compared with 46% generated by human shoppers. A year earlier, bad bots represented 31% of traffic.
- AI expanded the attacker population. Nearly 70% of bad bot traffic was classified as low sophistication, indicating that attackers increasingly leverage AI-powered tools to create and deploy automated attacks.
- Attack volumes increased across major attack categories. At one large multinational retailer, account takeover attacks more than quintupled year over year, carding attacks increased approximately 15 times, and fake account registrations grew sixfold.
- Attacks struck before the sale, not just during it. Many attacks peaked in the days leading up to major shopping events as dormant accounts were reactivated and stored payment information refreshed.
- AI crawlers emerged as a growing source of automated traffic. Across the holiday shopping season, AI training crawlers accounted for more than half of observed AI crawler activity, highlighting a new category of automation that organizations should evaluate and manage.
The report also found that traditional attack techniques such as price scraping, account takeovers, carding, content scraping, fake registrations, and inventory hoarding intensified during the holiday shopping season, several by orders of magnitude.
Radware researchers identified AI crawlers and AI agents as emerging challenges for online businesses. As agentic commerce takes hold, with AI-powered systems increasingly browsing, comparing, retrieving information, and transacting on behalf of users, organizations may need to consider new approaches to distinguish trusted automation from malicious activity and manage both at scale.
Explore AITechPark for the latest advancements in AI, IOT, Cybersecurity, AITech News, and insightful updates from industry experts!