Over the last 18 months, securing websites against fraud, web scraping, credential stuffing, scalping, and other attacks leveraging bots has become more complex. Where we mainly had to worry about differentiating bots from a growing number of legitimate devices (desktop, laptop, smartphones, tablets, smart TVs, game consoles, and more), all using a wide variety of operating systems and applications to access the internet, a new class of clients–AI agents–emerged, adding a new variable to the complex equation of protecting websites and their users. AI agents are intelligent automated systems (bots) that perform online transactions on behalf of legitimate users.
As consumers adopt AI technology to streamline their online experience, businesses must adapt their defense strategies to account for agentic traffic. This means upgrading the web security stack to a bot management product that can distinguish agents from bots and handle transactions appropriately.
Differentiating among these three categories of traffic is half the battle: detecting the intent of the user, bot, or agent is essential for protecting websites efficiently. As shown in Figure 1, four main components are involved in building an efficient and accurate Bot and AI management product. First, a robust bot-detection layer is needed to identify agents that do not authenticate themselves using an agent identity standard.
When such agents are identified, the Bot and AI management product must enforce the usage of agent identity standards. The product must also support the new agent identity protocols, such as Know Your Agent (KYA), Web-Bot_auth (WBA), or the Trusted Agent Protocol (TAP), to authenticate agents that already adopted them. Finally, a trust layer must be able to assess the activity of the agent and the user principal it represents to prevent fraud and abuse.
Fig. 1: Components needed for effective AI agent management
In this article, we’ll describe the numerous agentic standards, with a particular focus on agent identity, and discuss the advanced detection layer, methods for enforcing agent identity standards, and how to evaluate agent activity and the user they represent to prevent fraud.
Agentic Commerce Protocol Support
The new agentic traffic disrupted many established detection paradigms for identifying the different types of clients consuming web resources. Since AI agents are intelligent bots, the risk of bot management systems unintentionally blocking legitimate agentic traffic increased. The AI agent revolution fueled the emergence of new standards and protocols to support the promises of agentic commerce. Some standards, such as Web-Bot-Auth, Know-Your-Agent, and the Trusted Agent Protocol by Visa, are designed to authenticate agents, the platform they run on, and the user principal they represent. Other standards, such as the Agent Payment Protocol (AP2) or KYAPay, track intent and payment.
Lastly, protocols such as the Model Context Protocol (MCP) help agents discover APIs and resources available to them to complete various operations, while the Agent-to-Agent (A2A) protocol handles communication between agents. Figure 2 below shows, at a high level, the most relevant protocols and standards currently at play in the Agentic world, the problems they solve, and how they interconnect.
Fig. 2: The Agentic protocols and standards
As seen in Figure 1, the various protocols and standards aim at solving various problems:
- Identity: Traditional methods of identifying and categorizing bots or agents—such as relying on HTTP header name/value pair signatures, network/IP of origin, or credential exchanges (e.g., mTLS or API keys)—lack scalability in an environment where thousands of agents are regularly launched by independent developers and require constant maintenance from the bot and agent management point of view. Protocols such as Know Your Agent (KYA), Trusted Agent Protocol (TAP), HTTP Header Signature (RFC 9421), and Web-Bot-Auth offer a more modern approach to authenticating AI agents at scale. To establish trust and transparency in agent-driven transactions, identity can be broken into three components:
- Platform Identity: Represents the entity hosting or operating the agent (e.g., OpenAI for ChatGPT).
- Agent Identity: Since agents can be temporary and serve diverse purposes, agent identity specifies the unique name and intended function of an agent.
- User Identity: The user principal the agent is representing
The various standards offer different levels of identification depth. KYA stands out by offering a flexible framework that independently identifies the platform, the agent, and the user it represents, while leveraging trusted KYB (Know Your Business) or KYC (Know Your Customer) processes. In contrast, other methods, such as Web-Bot-Auth, provide proof of token possession but lack rigor in validating an entity’s legitimacy, since anyone can technically generate an encryption key pair, sign a token, and publish the public key to a well-known location. Not all standards offer the same level of transparency regarding platform, agent, and user identities. Protocols like KYA and TAP cover all three, although some user details may remain partially obfuscated with TAP to protect privacy.
- Intent: Recording user intent—such as “purchasing a red shirt under $100”—is essential for ensuring that agents execute predefined tasks accurately. Clear intent documentation helps prevent disputes between consumers and merchants, mitigates fraud risks upon transaction completion, and enables agentic commerce. Protocols like KYAPay (an extension of KYA for payments), Mastercard agent pay, and AP2 ensure proper intent tracking as part of the transaction authentication process.
- Payment: Successful e-commerce transactions depend on robust payment mechanisms. Several protocols have been developed to offer flexibility in payment methods, supporting credit cards, bank transfers, and cryptocurrencies. These protocols ensure the secure sharing and transport of payment credentials and the seamless processing of payments across different commerce environments.
- Agent Communication and Discovery: In the future, agents will increasingly collaborate to accomplish more complex tasks. For example, a travel agent might delegate specific responsibilities—such as booking flights, hotels, or activities—to specialized agents. The Agent-to-Agent (A2A) Protocol provides a system akin to a directory or yellow pages for agents, enabling efficient discovery and communication. Once tasks are delegated, agents can use protocols like KYA and Web-Bot-Auth for authentication and seamless interaction.
- Site API Discovery: For agents to efficiently utilize website functionality, they need mechanisms to discover and understand available APIs. Instead of relying on trial and error, the Model Context Protocol (MCP) provides a standardized “dictionary” of site APIs, detailing their capabilities and intended functions. This streamlines agent interactions and ensures efficient use of web resources.
The F5 bot defense product supports most agent identity protocols (KYA, web-bot-auth, HTTP message signature) and partners with industry leaders like Skyfire and Amazon to advance agentic protocols and their adoption across the ecosystem.
Detection Strategy
General Strategy
Supporting agentic protocols and standards is, however, the easy part of detecting agents for the simple reason that the protocols cited above are relatively new and their adoption is still in progress. This means that a holistic agent detection strategy also requires a set of advanced signals and detection methods to identify and challenge automated systems (bots or agents) visiting protected web resources, where a decade of experience with the bot defense product is a strong advantage. As a foundation, F5 has followed the following guiding principles to evolve the detection engine over the years:
- Protecting the JavaScript from reverse engineering and payload tampering using advanced obfuscation and encoding algorithms and F5’s proprietary virtual machine (VM) technology.
- The detection engine must have a good understanding of the internet ecosystem, in particular, the fingerprint characteristics of legitimate devices and the internet communication protocols (TCP/IP, TLS, HTTP)
- The detection engine must also understand human behavior, in particular, the diurnal pattern, how legitimate users traverse a site, and the resources they typically visit on a site, and be able to compare and contrast with the more repetitive behavior from bots
- Developing detection methods that look at the traffic from different angles to follow the natural bot evolution from simplistic scripts to advanced headless browser botnets and agents.
Figure 3 below shows the main categories of detection included in the bot defense product:
Fig. 3: Bot and fraud detection stack
Headless browser: Frameworks like Playwright, Selenium, and Puppeteer are commonly used by AI agents and for web scraping. Headless browsers can run JavaScript natively. Our detection engine can detect “vanilla” headless implementations and stealth mode, which represent cases where the bot operator “hides” common characteristics left behind by the headless framework in the DOM, making them difficult to identify through our traditional signal collection or obfuscation.
Behavioral biometric: we collect mouse movements, keypresses, and touch events, which allow us to evaluate how users interact with their devices through their mouse, keyboard, and touchscreen when available. Key metrics and statistics are extracted from the coordinates and used to power a collection of deterministic rules and an emerging set of machine learning models that can detect complex patterns common to bots.
User behavior: these methods help evaluate how users interact with and traverse the site. While humans interacting with an e-commerce site may start their navigation from the home page, then browse multiple products before adding items to the cart, logging in to their account to finally proceed to the checkout, bots may directly go to the login endpoint and attempt to log in several times using different credentials in a credential stuffing scheme with the goal of taking over accounts. Web scrapers, on the other hand, may focus on collecting inventory, product prices, or products available for sale. Assessing client behavior through their journey on the site can help differentiate bots from humans.
IP intelligence: F5 has researched and infiltrated the mobile and residential proxy ecosystems to understand who the main actors and resellers are, how IP addresses are sourced, and the overall network architecture and load balancing strategy. This knowledge is integrated into the bot defense product, helping it make more accurate decisions.
Email intelligence: This method evaluates user input and is especially useful for addressing account-opening abuse and scalping by advanced bots or agents. The method evaluates the syntax of the email address’s local part and domain to detect disposable email addresses.
Agent trust: AI agents are disrupting the Internet ecosystem, and bot management is adapting to these new client types. Agent trust is designed to assess the risk associated with an agentic platform, individual AI agent, and the user they represent.
Agent Detection Strategy
Not all agents identify themselves through the User-Agent header or newer agent identity protocols. Therefore, a more holistic detection strategy is required to enforce the use of agent identity protocols. Agents are advanced bots capable of executing JavaScript, necessitating a focus on identifying them through innovative signals and detection methods. These approaches, centered on user behavior and behavioral biometrics, and recent advancements and ongoing research in this domain include:
Fingerprinting - Virtual Machine Detection: Bots and agents frequently execute some of the more complex operations or inferences on virtual machines hosted in data centers, even leveraging residential proxy services for load balancing traffic to match common user behaviors. To address this, advanced fingerprinting techniques probe client devices’ hardware characteristics, identifying systems with high-performance CPUs, memory, and GPUs typical of servers and virtual machines rather than consumer devices like desktops, laptops, or mobile devices. F5’s bot defense product leverages deep client signal fingerprinting as a distinguishing hallmark of its capabilities.
Fingerprinting - Mobile Spoofing and Emulator Detection: Advanced bots and agents may also spoof or emulate mobile devices. In response, F5 continues to refine methodologies for collecting hard-to-spoof client-side signals, enabling the identification of authentic mobile devices. Proprietary innovations involve querying a device’s hardware at a low level to verify its type, thereby enhancing resistance to spoofing.
User Behavior - Site Traversal: Bots and agents typically follow predetermined paths to accomplish specific tasks, resulting in behavior that is far more uniform compared to the diverse and unpredictable methods employed by human users. F5’s patented Sequence Detection method evaluates these navigational patterns to distinguish automated users from humans by how they navigate a website.
User Behavior - Form Interaction: When bots or agents interact with forms—whether for account creation, login attempts, or searches—they aim to complete tasks swiftly to maximize scalability. This often results in behavior patterns such as faster-than-human step completion and more predictable page scrolling. By monitoring form interactions and utilizing an advanced detection layer to process these signals, F5 identifies behavior patterns characteristic of bots and agents.
User Biometrics - Mouse Movements and Clicks: While bots and agents mimic mouse interactions on web pages, their behavior diverges from human tendencies. Automated interactions feature small movement distances, straight trajectories, smooth curves, and consistent clicks near button centers—all hallmarks of perfectionism that stand in contrast to erratic human behavior. Attempts to mimic human behavior often result in detectable anomalies, further highlighting the differences between bots and real users.
User Biometrics - Mobile Sensors: Native mobile applications provide unique opportunities to analyze signals from devices’ sensors—such as accelerometers, gyroscopes, altimeters, and magnetometers. These signals offer valuable insights into how a device is being handled, acting as “proof of life.” Due to the complexity and sensitivity of the data, ongoing research focuses on optimizing sampling rates and developing detection models to maximize bot-identification accuracy.
Through cutting-edge innovations in fingerprinting, user behavior, and biometrics, F5 continues to pioneer methods for advanced bot and agent detection, ensuring robust security and protection against automated threats.
Enforcing Agent Identity Standards
When advanced bots are detected, agent identity standards must be enforced to enable more advanced fraud and abuse detection through the agent trust logic. AI agents and advanced bots sometimes use the same technology stack, and there is not always a clear way to differentiate between them. But because AI agents serve legitimate purposes, there is greater incentive for their operators to comply with authentication requirements, and the adoption will ultimately become a differentiator between the two categories of traffic. F5 favors enforcing the KYA standard, as it is backed by KYB and KYC practices and offers deeper visibility into the platform that supports the agent and the user it represents. When the expected token type is missing or invalid, we’ve established a communication protocol to inform the agent operator of how to resolve the issue. The expected token type varies depending on the type of transaction the agent is attempting. This dynamic feedback will support protocol adoption and authenticated access for AI agents. As described in the KYA specifications, there are 3 token types, each with a distinct set of claims, that can be used to perform different actions.
By default, the agent and the platform running the agent should always be clearly identified under the apd.name or apd.id and aid.name claims. When the agent is not present, you cannot clearly identify it, and you should return an error to the agent indicating the problem.
The table below provides an overview of the token type required to complete various transactions and the claims expected to be present in the token to complete the transaction or to provide access to the resource.
Agent Trust
User and agent trust consists of verifying the identity of the agent and the user principal it represents, assessing their behavior, and validating their intent. One way to infer trust is to check whether the company/individual running the agent has been vetted by an entity independent of the agent, or by a trusted agent identity issuer such as Skyfire, a credit bureau, or a credit card issuer. Who vetted the agent and the user it represents, and the methodology used, also matters greatly. Credit bureaus and credit card issuers potentially offer the most context about the legitimacy of a business or the user the agent represents, adding to the sense of trust of the incoming request. The KYA protocol provides the most detailed set of claims for assessing who issued the token and how the user and the business supporting the agent were vetted. In contrast, WBA does not offer the same level of scrutiny to infer trust.
But beyond the authentication process and claim validation, it’s also important to assess the behavior of the agent and the user it represents over time and look for deviations from the norm. This assumes we can establish what normal agent behavior looks like, which, at this point, is difficult to tell because, despite the hype around agentic commerce, most internet users use agents to search for information, products, or services, while actual e-commerce transactions remain limited. F5 is exploring detection algorithms to build agent trust in the context of emerging agentic commerce traffic. While still in its early stages, here are a few examples of algorithms that are being considered:
-
Agent Request Behavior Tracking: Develop predictive models to establish expected request rates and volumes per agent interacting with specific APIs or site content (e.g., login, checkout, search). Agents with consistent behavior and minor deviations are deemed low risk, while significant deviations indicate heightened risk.
-
Negative Response Monitoring: Set performance baselines for HTTP response codes (e.g., 2xx, 3xx, and 4xx) across critical endpoints like account creation and checkout. Elevated failure rates, such as repeated 4xx errors, may indicate rogue agents or malicious activity, such as credential stuffing.
-
Token Usage Modeling: Implement analytics to monitor request volumes tied to specific authentication tokens, noting the number of interactions during a token’s valid lifetime. Statistical models determine acceptable request limits dynamically based on past behavior, service type, site popularity, and agent activity patterns.
Conclusion
Agentic traffic has disrupted how users interact with websites, and web security products must adapt, just as the industry did when smartphones emerged 20 years ago. We no longer talk about bot management but about bot and AI agent management, with added complexity in detecting agents that do not authenticate themselves through emerging standards, and in enforcing their use. Beyond that comes the challenge of agent trust, which parallels the existing challenge of user trust, to help prevent fraud and abuse. The agentic world is evolving rapidly, and the cybersecurity industry must adapt at the speed of light to continue efficiently protecting websites and other critical APIs.