Thales has unveiled its 2026 Bad Bot Report, highlighting a significant shift in Singapore’s digital landscape, where bots now constitute 58% of all internet traffic. The report underscores the growing challenge for organisations as 52% of this bot traffic is classified as malicious, posing a threat to digital security.
The report reveals that financial services are particularly vulnerable, accounting for 80% of bot attacks in Singapore. As AI continues to blur the lines between legitimate and malicious activity, the focus is shifting from identifying bots to understanding their intent. Tim Chang, Global Vice President and General Manager of Application Security at Thales, stated, “AI is transforming automation from something organisations try to block into something they must also manage.”
The findings indicate a structural change in internet traffic, with bots increasingly outnumbering human activity. In 2025, bots made up 53% of global web traffic, a figure that rises to 58% in Singapore. This trend is not limited to specific events but represents a persistent presence across digital environments.
APIs and identity systems have become primary targets for bot attacks, with 27% of such attacks focusing on APIs. These attacks often exploit business logic and manipulate workflows, particularly affecting high-value sectors like financial services and IT.
Andy Zollo, APJ Senior Vice President at Thales, emphasised the need for a governance-based model to manage automation effectively. As AI-driven automation reshapes the digital landscape, organisations must adapt their security strategies to maintain trust and performance.
