Bots Now Outnumber Humans Online. This Startup Just Raised $200 Million to Fight Back.
Spur Intelligence, which helps companies tell real users from fake ones, closed a $200 million funding round as new data shows bot traffic has, for the first time, surpassed human traffic on the internet.
Key points
- Spur Intelligence raised $200 million in a funding round led by investment firm Insight Partners, announced in July 2026.
- Bots, automated software programs that browse and interact with websites without a real person behind them, now generate more internet traffic than humans do, according to a Cloudflare report from June 2026.
- Cloudflare's CEO said bot traffic crossed that threshold earlier than he expected, citing the rapid rise of AI agents, software that carries out multi-step tasks automatically on behalf of users or companies.
- Spur was founded in 2017, nine years before this funding round, and focuses on helping businesses spot hidden or disguised bot activity.
Something crossed a line on the internet last month. For the first time in the web's history, automated programs outnumber the humans using it.
That finding came from Cloudflare, one of the companies that routes and monitors a large share of the world's web traffic. Its founder and CEO, Matthew Prince, said he expected bots to hit this milestone at the end of 2027, then revised that to early 2027. It happened mid-2026. AI-driven automation is moving faster than even the people building it predicted.
Why does it matter if bots outnumber humans?
Most bots are harmless: search engines, price checkers, accessibility tools. But a growing share are not. Criminal networks run bots to commit fraud, test stolen passwords, scrape private data, and fake user accounts at scale. When a company cannot tell a bot from a real customer, it cannot trust what it sees.
Investment firm Insight Partners is betting on that problem. It led a $200 million funding round into Spur Intelligence, a Lake Mary, Florida cybersecurity startup that helps companies see past disguised bot traffic. First reported by TechCrunch AI, the deal closed in July 2026.
Spur was founded in 2017, five years before most people had heard of ChatGPT. Its technology looks beyond the activity itself to the infrastructure behind it: the criminal VPNs (private networks used to hide a user's real location), residential proxy networks (services that route fake traffic through real home internet connections to look legitimate), and other tools criminals use to appear human. Insight partner Thomas Krane described the problem bluntly: organisations can see the suspicious activity but cannot see the machinery driving it.
What is pushing bot numbers so high so fast?
AI agents are a big part of the answer. An AI agent is software that can carry out multi-step tasks on its own, browsing websites, filling forms, or making purchases without a person clicking anything. Legitimate companies are deploying them in large numbers. So are criminals.
The result is that distinguishing a genuine customer from an automated threat has become genuinely hard. Bots now mimic human browsing patterns, rotate through real home IP addresses, and pass basic security checks that would have stopped them two years ago.
What should ordinary people watch for?
If you run a business with any kind of online presence, unusual spikes in account sign-ups, login attempts, or checkout activity deserve a second look. Bot farms inflate these numbers to probe for weak points.
For individuals, the threat is mostly indirect: your stolen credentials may be the raw material a bot tests automatically across dozens of sites. Using a unique password for every account removes that risk almost entirely. A password manager makes that practical.
Researchers at Cloudflare deserve credit for tracking the human-to-bot ratio over time. That long-term measurement is what made this crossing visible.
Common questions
Are all bots dangerous?
No. Many bots do useful work, such as indexing pages for search engines or checking whether websites are running. The concern is the rising share that are built to deceive, defraud, or disrupt.
Does this affect me if I'm just a normal internet user?
Mostly in the background. Bots drive up fraud rates that businesses pass on through tighter security checks, and they feed off leaked passwords. Keeping your own credentials unique limits how useful your data is to them.
