Automated traffic consists of web requests made by software rather than directly by a person using a browser. It can come from search crawlers, monitoring tools, scripts, bots, or AI agents that read pages and interact with websites.
Automation is not inherently malicious, but it matters to security because high-volume or deceptive requests can support scraping, fraud, account abuse, or denial-of-service activity. Defenders use measures such as rate limits, behavior analysis, and access controls to distinguish permitted automation from harmful activity. AI agents may also make requests through a user’s logged-in session, so sites and users should limit their permissions and require confirmation for sensitive actions, such as purchases or account changes.