Which Industries Are Least Protected From Bots & Spoofed AI Agents in 2026?

Bad bot traffic grew 124% between July 2025 and June 2026, more than 9x faster than human traffic. But most websites’ defenses haven’t kept pace.

For The State of Bot & Agent Security Report 2026, we tested 21,491 popular websites across 15 industries. Here’s how they performed.

Nearly two in three websites are unprotected, and full protection keeps shrinking

We sent 10 bot types at each site tested, including basic bots, spoofed AI agents, disguised bots, and real-browser bots. Requests came from three proxy locations (the US, France, and Canada), so results wouldn’t be skewed by IP-based geofiltering.

The results: 65.3% of sites stopped none of the bot types, and only 2.4% stopped all of them. 

Full protection has now fallen two years running, from 8.4% in 2024 to 2.8% in 2025 and 2.4% in 2026, though the 2026 test added spoofed AI agents and more advanced bot types. As low-cost, low-code bot-as-a-service platforms become increasingly accessible, bot tooling appears to be outpacing defenses.

The least protected industries: Telecoms, tech, & financial services

Protection gaps aren’t limited to one type of business. Below are the highest unprotected rates (the percentage of sites that stopped none of our test bots) by industry:

• Telecommunications: 82.9%, up from 73% in our 2025 test. This was the weakest of all 15 industries. Telecoms run critical infrastructure and hold large customer bases, yet fewer than one in five sites stopped even one test bot.
• Tech platforms: 77%. Broad digital reach doesn’t automatically translate into strong bot protection. 
• Financial services: 73.8%. Nearly three in four sites let every test bot through, despite the value of the data and accounts they protect.
• Property, infrastructure & public sector: 71.9%. Public-facing services and listings are exposed to scraping and automated abuse.
• Education: 69.7%. Portals, applications, and student accounts are attractive and often lightly defended targets for attacks.

The most protected industries: Marketplaces, retail, & travel

Here are the most protected industries, ranked by the combined share of fully and partially protected sites:

• Marketplaces & classifieds: 47.7%. The leader, with the highest fully protected rate at 3.9% as well. Scraping, fake listings, and account abuse are common risks here, which may explain the stronger showing.
• Retail & e-commerce: 40.4%. Scalping, carding, and credential stuffing may have pushed retailers to act.
• Travel & hospitality: 38.5%. Fare and inventory scraping may make bot defense a priority among travel and hospitality sites.
• Automotive & mobility: 37.9%
• Food & beverage: 36.8%

Even so, no industry has reached a strong baseline. 52.3% of marketplaces and classifieds sites remain completely unprotected, despite having the highest share of fully and partially protected sites. 

Size and traffic don’t predict protection

You might expect big companies and high-traffic sites to be better defended. This year’s report shows they aren’t.

• Companies with 10,000+ employees: 64.6% unprotected, worse than companies with 1-10 employees at 62.7%
• Top 1,000 sites by traffic: 64.4% unprotected, virtually the same as the lowest-traffic tier

High-traffic sites host more users, data, and monetizable assets, yet they fail the same tests as everyone else.

Where defenses break down

The results suggest standard defenses, like IP reputation, user-agent filtering, and simple behavioral rules, aren’t keeping up. Here’s where they break down:

• Basic bots get through. Only 5.5% of tested sites stopped every basic bot.
• Disguised bots are rarely stopped. Only 5.5% of sites stopped the test bot with forged browser fingerprints at the network level.
• Real-browser bots are hardest for sites to detect entirely. Just 3.1% of sites stopped every one. Sites stopped cloaked and uncloaked versions at nearly identical rates, which suggests most challenge any browser-like request rather than reading the automation signal.
• Spoofed AI agents pass on identity alone. More than 7 in 10 sites let one through simply because it claimed to be GPTBot or ClaudeBot.

Spoofed AI agents were stopped more often than any other bot type (29.3% of sites stopped at least one), but that’s likely name matching. Many publishers and content platforms have added rules for known agents like GPTBot and ClaudeBot, and the forged versions trip the same rules. Blocklists catch bots that announce themselves honestly and miss anyone using unknown or custom agent strings.

What to do: Detect intent, not just identity

The pattern holds across every industry. Standard defenses can’t keep up with automation that looks human or borrows a trusted name.

The question that matters is: “What is this visitor trying to do, and does it benefit the business?”

DataDome’s intent-based detection answers it in real time by evaluating behavior, endpoint sensitivity, session context, and device and network signals across web, mobile apps, APIs, and MCP servers.

Test your site to see how you stack up against bots and spoofed AI agents, or book a demo to see DataDome in action.

Read the full report

The full report includes complete protection benchmarks across all industries, a deep dive into bot traffic and threat trends in 2026, and a breakdown of AI traffic across DataDome’s network. Get your free copy.