AI Bots Now Drive Nearly Half of All Commerce Traffic: Inside Akamai’s 2026 Security Report

Attack Vectors: APIs Are the Primary Surface, Layer 7 DDoS Surges 104%

The report confirms that APIs have become the dominant attack vector. 87% of all organizations experienced an API-related security incident in 2025 . The commerce industry faced more than 200 billion application and API attacks between 2024 and 2025 . API web attacks grew 9% between Q4 2024 and Q4 2025, surpassing traditional web application attacks in volume .

Layer 7 DDoS attacks are exploding. Akamai reports these attacks surged 104% over two years (2023–2025), with a 61% year-over-year increase from 2024 to 2025 alone . Commerce faced nearly three trillion Layer 7 DDoS attacks between 2024 and 2025 . Retail was hit hardest — 84% of all Layer 7 DDoS attacks on commerce targeted the retail vertical .

Regional Surge: APAC Leads, North America and EMEA See Modest Growth

Regional trends show significant divergence :

• APAC — Explosive growth: bot counts increased 63%, more than any other region . APAC's fragmented travel market and loyalty programs made it a primary target .
• LATAM — Bot activity surged 48% .
• EMEA — Moderate increase of 16% in automated bot activity .
• North America — Modest increase of 7%, though North America led in raw AI bot activity with 33 billion counts .

Agentic Commerce: New Risks That Blur the Line Between Friend and Foe

The rise of agentic commerce — where AI agents autonomously shop, transact, and interact on behalf of users — has fundamentally reshaped the threat landscape. Attackers are actively exploiting the trust gap between human and machine-driven interactions .

Threat actors weaponize AI bots to automate advanced attacks that exploit session flows, authentication mechanisms, and API business logic, and to build and manage fake identities at scale . Malware accounted for 56.5% of endpoint threat activity from November 2025 to April 2026, indicating that agentic workflows expand the endpoint attack surface .

The report warns that benign AI shopping agents and malicious bots now look nearly identical, making traditional bot detection alone insufficient .

Akamai's Agentic Security Framework: A Unified Trust Layer with Visa and Experian

In response, Akamai announced its unified Agentic Security Framework on June 15, 2026, for its Bot & Agent Control solutions . The framework connects identity, observability, trust, and edge security into a single, real-time decisioning layer at the edge . It comprises six tightly integrated pillars :

• Verified identity and human attribution
• User-centric authentication
• Adaptive trust analysis
• Edge-based enforcement
• Content monetization and value exchange
• Operational visibility and traffic analysis

Ecosystem partners include Visa, Experian, Skyfire, Ping Identity, Auth0, and Tollbit . Notably, Visa contributes its Trusted Agent Protocol (TAP) to cryptographically verify AI shopping agents and prevent fraud across Akamai Cloud . The framework is designed to answer the core identity, intent, and trust questions raised when AI agents act on behalf of users .

What CISOs Should Do Now: Strategic Recommendations

Based on the report findings, Akamai recommends the following priorities for security leaders :

• Adopt agent-aware security frameworks — Implement real-time identity, observability, and trust decisioning rather than relying on legacy bot detection.
• Secure APIs as the primary attack surface — Treat API security as a business continuity imperative, not just a technical concern. Conduct continuous API discovery and behavioral monitoring.
• Prepare for Layer 7 DDoS at peak commerce periods — Since retail absorbs 84% of Layer 7 DDoS attacks on commerce, scale DDoS defenses ahead of high-traffic shopping dates.
• Invest in regionalized defenses — Prioritize APAC due to its 63% bot surge, but do not neglect EMEA and North America.
• Adopt emerging authentication standards — Protocols like Visa's Trusted Agent Protocol (TAP), Web Bot Authentication, and Know Your Agent (KYA) bring cryptographic verification to bot/agent interactions.
• Integrate bot and fraud controls — Because AI bots now blur the line between legitimate scraping and malicious fraud, security and fraud teams must unify their strategies.