In an era of heightened cyber threats, researchers at cybersecurity firm Imperva have shed new light on the ever-evolving landscape of cyberattacks. Drawing from their recent 10th annual Bad Bot Report, the team offers a comprehensive examination of the escalating threats posed by bad bots, providing invaluable insights for industries across the board.
The Imperva report’s findings are informed by an exhaustive analysis of six trillion blocked bad bot requests made across thousands of domains throughout 2022. The scale of the data examined underscores the increasingly pervasive nature of the bad bot problem and illustrates the need for evolving detection and mitigation strategies.
In previous years, bots were known to exploit technical vulnerabilities. However, Imperva’s research reveals a new frontier of sophistication: the rise of bots employing business logic. By mimicking human interactions with web applications, they have become more difficult to detect and block, presenting an elevated challenge for cybersecurity professionals. Approximately 75% of all bot traffic can now be attributed to these advanced and moderate bots, highlighting a substantial evolution in cyber threats.
Alongside the general increase in sophistication, the researchers also found a particular area of vulnerability. Application Programming Interfaces (APIs), which are integral to the digital operations of most organizations, have become an attractive target for bad bots. By manipulating APIs, these malicious applications can extract sensitive data and disrupt services, posing a significant threat to organizations’ overall operations. With APIs constituting 36% of all bad bot traffic, according to the report, this vulnerability cannot be overlooked.
No industry is immune to these threats, and the healthcare sector, in particular, is facing unique challenges. The rise of digitalization in healthcare has brought along the inevitable necessity of data protection. Bad bots, however, pose significant risks, with about 26% of all website traffic in 2022 being attributable to them. They have the potential to facilitate data breaches, compromise patient confidentiality, and disrupt crucial healthcare systems. Such disruptions can lead to significant financial losses and reputational damage, but more alarmingly, they can potentially result in life-threatening delays in patient care.
In addition to general data protection concerns, the report also sheds light on the shifting landscape of bot attack platforms. Mirroring the global trend of increased mobile device usage, mobile platforms have emerged as a preferred choice for bad bot operators. The shift presents a new challenge for the healthcare sector, which is increasingly reliant on mobile apps for managing patient care and information sharing.
Imperva’s report also maps out a strategic path for organizations to combat the evolving threat of bad bots. Beginning with the identification of potential risks—like high-demand product launches or vulnerabilities in website functionalities—it underscores the need for securing all digital access points, including APIs and mobile apps, not just the website itself. Coupled with the necessity of consistent threat monitoring, blocking outdated browsers, and restricting access from bulk IP data centers, organizations can build comprehensive defense mechanisms. Furthermore, the report emphasizes the importance of traffic evaluation and staying alert to global data breaches, ensuring a well-rounded cybersecurity strategy that distinguishes between good and malicious bots.
In its 10th edition, Imperva’s Bad Bot Report presents a stark reality of today’s cyber threat landscape, with a particular focus on the healthcare industry—an industry evermore reliant on digital infrastructure. By highlighting these insights, Imperva extends a call-to-action to the cybersecurity community and healthcare sector. They emphasize the continuous need for vigilance, adaptation, and learning in this unending battle against cyber threats, with the understanding that no industry, sector, or organization can afford complacency. As we lean further into a digitized future, the commitment to robust cybersecurity measures is not only advisable—it’s an absolute necessity.