Netacea, the bot detection and mitigation specialist, today announced results from a new report that reveals the high price that businesses pay because of bot traffic. For e-Commerce companies, automated bots cost them 3.35% of their annual revenue.
According to survey respondents, automated bots operated by malicious actors cost businesses an average of 3.6% of their annual revenue. For the 25% worst affected businesses, this equates to at least a quarter of a billion dollars ($250 million) every year.
The report, The Bot Management Review: What are bots costing your business?, surveyed 440 businesses across the travel, entertainment, eCommerce, financial services and telecoms sectors in the United States and the UK. It found that every sector had a substantial bot problem, with two-thirds of businesses detecting website attacks. 46% of respondents reported mobile apps had been attacked, and 23%—mostly in the financial services—said bots had attacked their APIs.
“Last year, a particularly tough one for legitimate businesses already operating with razor-thin margins thanks to an economic slump, was a bumper year for those who use bots to leech off of those businesses—especially from bad actors who looked to take advantage of a significant shift to online working and retail,” said Andy Still, CTO, Netacea.
While scalper bots—which automate the purchase of inventory such as game consoles and other limited availability goods faster than is possible for any legitimate user—continue to dominate headlines in 2021, businesses have been affected by all types of bots. These include account checker bots which use stolen usernames and passwords to take over accounts, sniper bots that monitor activity and swoop in at the last moment, and scraper bots that extract content and data from websites.
The Netacea research also uncovered: 78% of eCommerce businesses stated that scalper bots had a known financial impact in 2020, costing 2-10% of their online revenue.
Automated bots cost e-Commerce companies 3.35% of their annual revenue which for 35% of respondents in this sector equates to $235 million a year.
Over 80% of businesses reported that customer satisfaction had been negatively affected by bot activity, in particular scalper and sniper bots.
Only around 5% of security budgets are dedicated to bot mitigation, though for larger firms it’s a little higher, at up to 20%.
Account checker bots are the most popular form of bot attacks, taking advantage of data breaches and leaked passwords to compromise customer accounts.
Most worrying is the time it takes to discover attacks. On average, more than 14 weeks pass between a successful attack and its detection, making it difficult to limit the damage done to a business’s customer satisfaction, reputation, and bottom line.
Still said: “While there is a greater awareness of the threat than in previous years, only 5% of security budgets are being used to target the problem. Businesses need to realise that bots are not a mere nuisance, but a genuine security threat—especially when a business is already struggling because of other factors.”
Netacea’s previous research around the Genesis Market, an underground marketplace for stolen credentials, shows how sophisticated the industry is becoming. Those operating bots do so at a professional level, with consultants, help desks and highly specialised infrastructure providers accessible through covert forums, making bots widely available.