DataDome Report: Malicious Automated Traffic Is Growing 9x Faster Than Human Traffic — and Targeting Deeper Into the Customer Journey

DataDome's 2026 bot and agent security report found malicious automated traffic grew more than nine times faster than human traffic from July 2025 to June 2026. Bad-bot traffic increased 124%, while scraping—the leading threat—rose 185% year over year, highlighting escalating cybersecurity risks for websites and digital businesses.

Analysis

The investable read-through is concentrated in edge-security platforms with bot-management products already embedded in large web traffic flows: Cloudflare (NET) and Akamai (AKAM) should see the cleanest opportunity for attach-rate and net-retention upside, while Fastly (FSLY) is a smaller, higher-beta beneficiary if security bookings accelerate. The revenue effect is unlikely to be material in the next quarter absent disclosed enterprise wins, but persistent automated abuse raises the cost of operating public APIs and consumer platforms, increasing willingness to buy managed mitigation rather than build internally over the next 6-18 months.

The less obvious pressure point is on digital businesses whose content, inventory, and APIs can be extracted cheaply. Marketplace, travel, ticketing, publishing, and e-commerce platforms may face higher infrastructure spend and conversion leakage; the first-order beneficiary is the security vendor, but the second-order winner may be companies with proprietary logged-in datasets and strong authentication layers. Conversely, widespread deployment of restrictive bot controls could constrain AI-data collection and elevate licensing value for content owners, although that effect depends on enforceability rather than announced threat statistics.

This is vendor-produced research, so it does not independently establish incremental spending or pricing power. Consensus may overreact to cyber-threat headlines; the actionable confirmation is a sequential acceleration in security RPO, large-enterprise deal count, or management commentary around bot/API protection at NET and AKAM. A weak macro environment could also cause customers to treat bot mitigation as a feature consolidation exercise, favoring hyperscalers and bundled edge platforms over standalone vendors.

Key Decisions for Investors

• Maintain a 3-6 month watch-list long bias in NET versus FSLY: NET has the broader network distribution and greater ability to convert rising abuse into paid security attach. Initiate only after evidence of security revenue/RPO acceleration or a post-earnings pullback; invalidate on decelerating large-customer growth or security gross-margin compression.
• Consider a 6-12 month long AKAM / short FSLY pair if bot and API-security demand becomes a disclosed theme: AKAM offers lower valuation and enterprise installed-base leverage, while FSLY carries greater execution and customer-concentration risk. Target a 10-15% relative return; exit if FSLY demonstrates sustained security ARR growth materially above AKAM.
• Do not underwrite a standalone cyber trade from this release. Set alerts for disclosed bot-management bookings, API-security pricing changes, and enterprise web-security budget commentary in NET, AKAM, ZS, and PANW earnings calls over the next two reporting cycles.
• Monitor content and marketplace names with meaningful public-web exposure for rising CDN/security expense or restrictions on automated access; absent company-specific cost disclosures, treat this as a margin-risk screen rather than a short recommendation.