From Human or Bot to Trustworthy or Not
The old mental model of web security—humans are good, bots are bad—no longer holds. Humans can commit fraud, and many bots are helpful. Site owners want some automated traffic. More importantly, the line is blurring: sessions now frequently shift from human to agentic and back again, such as when a user browses a store and then hands the checkout process to an automated shopping assistant.
That complexity forces a shift in how we evaluate traffic. Instead of asking “is this a human or a bot?”, the question becomes one about behavior. Is a specific action abusive, malicious, or otherwise risky? Making that call requires looking beyond single point-in-time checks and instead analyzing continuous behavior to build a picture of Trust.
The Web Integrity & Trust team at Cloudflare has been working on exactly that problem. Their approach hinges on two distinct, reciprocal concepts: Risk and Trust. Risk is ephemeral—the likelihood that a single request or action is harmful. Trust is built over time through reputation and consistent behavior. Consider a frantic late-night doorbell ringing as a risk signal; you assess it immediately as alarming. But if the person on the camera is your trusted next-door neighbor, that context overrides the risk. On the web, blocking all frantic behavior is impractical; the same logic applies. A request that looks odd at one moment is fine if the source has earned trust.
Defining Good: Declared and Non-Abusive
On the positive side of the ledger, the standard for "good" automated traffic is rooted in transparency. The updated taxonomy for verified bots in BotBase boils the definition of “Verified” down to two key requirements: declare yourself honestly, and don’t abuse the trust you’ve earned.
This transparency is the foundation for a symbiotic relationship between site owners and bot operators. Site owners can specify what behaviors and data usage they allow, while operators who declare themselves clearly reduce friction when accessing those sites. BotBase is designed as a complete directory of known bots and agents—good and bad. Unlike the prior directory that only tracked good actors, BotBase can also track less-than-good actors, because the same systems used to validate a bot’s good behavior also flag when those expectations aren’t met. Abusing trust on the network leads to unverification.
Defining Bad: Behavioral Shifts and Persistent Threats
Bad behavior isn’t always loud. Precursor is a continuous client-side system designed to catch subtly inhuman traffic that passes network-level checks. When enabled, its JavaScript detection is injected over the CDN, so there’s nothing for a site owner to install or configure locally. Crucially, it evaluates user behavior throughout the entire session, rather than issuing a one-time pass.
In the Risk and Trust framework, a CAPTCHA is a risk-based, context-free hurdle. Behavioral verification is trust-based because it captures context from the full user journey. Precursor’s power lies in two attributes:
- It provides trust-based detection over the whole session.
- It drives up the cost for bot developers to simulate human behavior over a multipage timeline.
Making it expensive to evade the detection wins the economic game against bots. Since launch, the data validates the approach. In a single 24-hour period, the system saw 206 million evaluation events across 73,438 zones.
The data reveals patterns that point-in-time detection would have missed:
- Suspicious behavior often happens mid-session.
- Behavior frequently shifts from human to agentic and back within a single session. This makes it important to understand intent so site owners don’t block flows they actually want—a key reason the BotBase taxonomy was updated for classifying by use case, purpose, and data use.
To let anyone see this analysis in action, the team has released Precursor Trace, an interactive demo that shows how the system evaluates your own cursor movements, including rhythm, acceleration, and corrections. It’s available to try now.
Adaptive Intelligence: A Self-Updating Engine
Previously, Bots ML updates were tied to formal model versions announced as product launches. That pacing is too slow. Bots adapt in hours or minutes, not months.
Adaptive Intelligence is a new detection engine that differs from anything built before in the Bots ML space. The model is itself adaptive: it learned from historical patterns, but more critically, it continues to learn and self-adjust based on observed traffic. Customers won’t need to upgrade to a new version to get the latest predictive detections. The system upgrades itself based on patterns ranging from good to bad, and this will be available to all Bot Management customers soon.
Beyond Blocking: Mitigations Designed to Throttle
Static defensive rules are easy to probe and reverse-engineer—an issue that Cloudflare nicknames the “Bot Antibiotic Problem.” Sending a deterministic 403 block every time teaches a malicious developer exactly how to adapt. The answer being built is a suite of mitigations explicitly made to throttle bots, with different approaches for malicious vs. benign automated traffic.
Three approaches are in development:
Approach 1: Unpredictability. Randomly applying block, challenge, or allow responses to suspected automated traffic breaks a bot's retry logic and fingerprinting.
Approach 2: AI Labyrinth. A defensive response that traps unauthorized bots in an endless maze of AI-generated pages. It has three tiers, depending on the site’s preference:
- Maze: Generates an endless web of linked pages for bots to follow.
- Summary: Feeds crawlers an LLM-generated summary of a page that looks real but is useless as AI training data.
- Poison: Serves deliberately fake content (like prices or inventory) to pollute the data a bot collects for AI training.
Approach 3: Queuing for good bots. Not all agentic traffic is bad. Queuing manages throughput for legitimate automated traffic, like user-directed shopping agents, without denying service entirely.
These advanced mitigations roll out toward the end of the year, and site owners will have control over how strict they want them to be. Since attacks evolve, designed defenses should too: a dynamic ruleset that self-corrects is a better long-term bet than static rules requiring constant manual updates.
Any site owner can start shaping how agents interact with their infrastructure today by turning on Precursor, using Precursor Trace, and exploring BotBase. Moving away from static checks toward continuous trust evaluation turns the game with bot operators into a more manageable, strategic one rather than a game of whack-a-mole.
