Intelligent CISO Issue 62 | Page 21

cyber trends

“ Bots have evolved rapidly since 2013 , but with the advent of generative Artificial Intelligence , the technology will evolve at an even greater , more concerning pace over the next 10 years ,” said Karl Triebes , Senior Vice President and GM , Application Security , Imperva . “ Cybercriminals will increase their focus on attacking API endpoints and application business logic with sophisticated automation . As a result , the business disruption and financial impact associated with bad bots will become even more significant in the coming years .”

Key findings from the 2023 Imperva Bad Bot Report :

• Bad bots are increasingly sophisticated and harder to detect . In 2022 , the proportion of bad bots classified as ‘ advanced ’ accounted for more than half ( 51.2 %) of all bad bot traffic . In comparison , the level of bad bot sophistication in 2021 was 25.9 %. This is a concerning trend for businesses as advanced bad bots closely mimic human behaviour .

• Account takeover ( ATO ) attacks increased 155 % in 2022 . Further ,

15 % of all login attempts in the past 12 months , across all industries , were classified as account takeover . Cybercriminals use bad bots to facilitate credential stuffing and brute force attacks , as automation can cycle through credentials quickly until successful .

• Targeting APIs to abuse business logic and compromise accounts . In 2022 , 17 % of all attacks on APIs came from bad bots abusing business logic . A business logic attack exploits flaws in the design and implementation of an API or application for the intent of manipulating legitimate functionality to steal sensitive data or illegally gain access to accounts .

• Travel ( 24.7 %), Retail ( 21 %) and Financial Services ( 12.7 %) continue to experience highest volume of bot attacks . Meanwhile , Healthcare and Law & Government experienced a considerable jump in the volume of bad bot attacks in 2022 . Bots are a growing problem for all industries .

• Majority of countries have a bad bot problem . Of the 13 countries analysed , more than half ( 7 ) had bad bot traffic levels that exceeded the global average of 30.2 %.

• Browser settings disguise bad bot behaviour : Onein-five bad bots used Mobile Safari as their browser of choice in 2022 , up from 16.1 % in 2021 . Updated browsers offer privacy settings that obfuscate bad bot behaviour , making it harder for organisations to detect and stop automated traffic .

“ Every organisation , regardless of size or industry , should be concerned about the rising volume of bad bots across the Internet ,” continued Triebes . “ Year-over-year , the proportion of bot traffic is growing and the disruptions caused by malicious automation results in tangible business risks – from brand reputation issues to reduced online sales and security risks for web applications , mobile apps and APIs . Businesses need to act now and invest in bot management and online prevention that can identify and stop sophisticated automation that targets APIs and application business logic .” u

21