AI agent traffic is reshaping how users interact with digital experiences. In The Forrester Wave™: Bot And Agent Trust Management Software, Q2 2026, we explore how this shift is transforming a market that has historically focused on detecting and mitigating bot attacks into one that must also enable trusted automated traffic at scale.

Here are three key takeaways that highlight what’s changing and what prospective buyers must consider.

1. The Market Has Shifted From “Block Bots” To “Enable Trusted Automated Traffic”

The rise of AI agents blurs the line between human and automated traffic. Agents can represent legitimate customers, business partners, or malicious actors. Formerly trusted agents can be hijacked into performing malicious activities.

This creates a fundamental tension: Blocking too aggressively risks disrupting real customer experiences, but allowing the wrong automated traffic opens the door to fraud and abuse. As a result, the market is evolving from a security-first mindset to a trust-first model that emphasizes understanding intent, distinguishing between good and bad automated traffic, and enabling beneficial agent activity while stopping harmful traffic.

What this means for buyers: Solutions must go beyond detection and response. They must identify who or what is interacting with your applications, why, and how that aligns with business value.

2. Bot And Agent Trust Management Really Is A Cross-Functional Business Problem

We’ve noted for years that security, fraud, eCommerce, marketing, and business leaders all have a stake in bot management. With the evolution into bot and agent trust management, cross-functional participation becomes critical. Bot and agent traffic impacts far more than security teams. Organizations must now coordinate across the full set of stakeholders to define policies that balance:

• • • Security and fraud mitigation
    • Customer experience
    • Revenue generation and marketing performance

For example, different stakeholders may have different attitudes about LLM scraping – while some on the team will be concerned about the potential loss of IP and the infrastructure costs from heavy scraping, others will prefer to allow certain LLMs to scrape so that their brand and site shows up more in AI responses and drives more human customers to the site. This also means that bot and agent trust management software must integrate across the ecosystem (including identity providers, eCommerce platforms, and marketing tools) and support use-case-specific workflows and dashboards.

What this means for buyers: Treat bot and agent trust management as a shared discipline, not a point solution. Success depends on governance, cross-team alignment, and the ability to operationalize policies across multiple business functions.

3. Analytics And Vendor Partnership Are Core Differentiators

Bot detection is no longer sufficient. Organizations increasingly require deeper analytics to understand:

• • • Intent and behavior of bots and agents, including how agents tie back to specific human consumers
    • Relationships between agents and customers and how that impacts what agents should be allowed to do on behalf of a customer
    • Attack patterns and targets (including when an identifiable and approved agent starts to behave maliciously)
    • Measurable business impact and ROI

At the same time, buyers are relying more heavily on vendors as strategic partners, not just technology providers. Ongoing threat research, proactive support, and collaboration on tuning models and preparing for major events are critical to maintaining effective defenses, especially as bot operators continue to evolve their attacks. For example, a few vendors offer features that allow customers to proactively notify them of upcoming hype sales.

What this means for buyers: Evaluate solutions not just on detection, but on visibility, explainability, and partnership.

The Forrester Wave™: Bot And Agent Trust Management Software, Q2 2026 describes these and other trends and dives into the capabilities of the top providers. Check out the report and schedule an inquiry or guidance session to learn more.

Categories

Blog

Move Over, WAF: The Web Application Protection Platform Takes Over

For years, the web application firewall (WAF) has been a foundational control for protecting customer‑facing digital experiences. It started as a compliance-driven application security tool that filtered malicious traffic, blocked common exploits, and provided a last line of defense in front of web applications. But the way applications are built, deployed, and attacked has fundamentally […]

Blog

OpenAI’s Daybreak Promises To Improve AppSec But Introduces A New Pricing Model: Five Buyer-Side Implications For CISOs

OpenAI recently announced Daybreak, its vision for making agentic application security faster and more capable. While promising, Daybreak will also make security more expensive per unit of work. In this model, customers will pay for tokens and multiagent workflows burn tokens. CISOs and CIOs should budget for application security (AppSec) line-item inflation, not deflation, with […]