Holiday Peak Security: Stop Bots, Not Buyers
How retail security teams can stop malicious traffic during holiday shopping peaks without turning away shoppers or the AI agents buying for them.
From Singles’ Day to Black Friday, Cyber Monday and the December rush, retail sites face more than a traffic spike. Shoppers, AI agents, crawlers, scrapers and fraud bots compete for the same paths, but edge controls still tend to ask one question: human or bot? The result is a costly trade-off: block legitimate buyers or let abuse through. With WAFs, CDNs, bot management and rate limits operating in silos, even a valid order can get caught in the crossfire. This post explores what recent research reveals about holiday traffic, why conventional controls fall short, and how retailers can protect revenue without blocking the customers they want.
The Old Problem
Peak-season edge security has long rested on one assumption: unusual traffic is suspicious traffic.
A typical retail edge is a stack of controls, often from different vendors and owned by different teams: WAF managed rules for known attack patterns, CDN and rate-limiting rules, bot management that scores how human a request looks, and API and fraud tools on login and payment. Each is tuned against a baseline from normal weeks.
In November, teams do what has always made sense. They freeze changes, tighten thresholds and measure success in blocked requests and uptime. The hidden assumption is that anything the edge blocks was worth blocking. Nobody sees the shopper who got a 403 at checkout. They don't open a ticket; they buy somewhere else, and the blocked request shows up on a dashboard as a win.
What Changed
Three data points capture the shift.
More revenue rides on fewer days (forecast). Adobe's 2026 holiday forecast projects $275.1 billion in US online spend this season, with $47.5 billion in Cyber Week alone. That is a projection, not a measurement, but the direction is clear: more of the year's revenue passes through the edge in a handful of days.
Commerce is where AI bots go (measured, 2025). Akamai's State of the Internet report on commerce found that commerce accounted for 47.9% of all AI bot traffic on Akamai's network from July to December 2025. Some of it is now buying: in June 2026, Visa embedded its payment network inside ChatGPT so AI agents can complete purchases for users, most of them still approved by the user at first.
Bad traffic is rising alongside it (measured, 2024 to 2026). CHEQ's Agentic Black Friday Report found invalid traffic made up about 20% of retail visits on its customer network in summer 2026, up from 7.1% during Black Friday and Cyber Monday 2024. That is one vendor's network, not the whole market, but the trend matches what other bot researchers report.
As Akamai's Patrick Sullivan put it, the "customer" is increasingly "an AI agent operating on behalf of the human user." The challenge is telling that customer apart from the bots imitating it.
Different Traffic, Different Policies
The most useful way to read this traffic is by two things at once: what kind of traffic it is, and which path it is on. The same AI agent is welcome on a product page and suspicious when it hammers login.
A verified identity is a starting point, not a verdict: a legitimate agent can still be misused. And most agent traffic browses rather than buys. HUMAN's benchmark report found 77% of agentic traffic hits product and search pages and only 2.3% reaches checkout. One site-wide "bot" policy will be wrong somewhere: too strict on browsing paths, or too loose on login and payment.
At Huskeys, we look at how edge controls actually behave on production traffic, across WAF, CDN, bot rules and rate limits together. In commerce and booking environments, peak-season false positives cluster in a few places:
- Generic managed rules misfire on real buyers. At a global entertainment brand, a SQL-injection rule tripped on third-party tracking cookies and kept campaign shoppers off the checkout. The rule did exactly what it was written to do.
- Campaign traffic looks like an attack. Holiday emails and affiliate links add new parameters, referrers and sudden spikes. To a rate limit tuned on a normal week, a successful campaign and a layer-7 flood look alike.
- Controls disagree with each other. The bot tool allows a verified agent, then a CDN rate limit or WAF rule blocks it two hops later. No single team sees the full path.
- Expensive inspection runs on everything. Scrapers and card testers ride the spike while every request gets the heaviest checks, raising costs without improving outcomes.
When controls are tuned together on real traffic, the difference can be large. In Huskeys commerce and booking deployments, customers reduced false positives (legitimate requests blocked or challenged) in booking and checkout flows by more than 80%, and blocked more than 200 million malicious requests during peak attack events.
At peak, the question isn't "human or bot?" It's "what is this traffic trying to do, on this path, and what should happen to it?"
Why It Matters
For a retail CISO, peak season has two failure modes that pull in opposite directions.
Block too much, and the cost is real but invisible. A blocked shopper doesn't complain; they leave. CHEQ warns that "blocking all automated traffic turns away real buyers and can keep your products out of AI answers."
Allow too much, and the rush becomes cover for abuse. Akamai's commerce report notes that autonomous shopping agents mimic human micro-behaviors, which also masks fraud signals, and that attackers are hijacking legitimate AI assistants to abuse stored payment credentials.
Many teams are stuck in between. In the same report, Akamai found that commerce organizations on its network placed more than 90% of their AI bot activity in the "monitor" category, which observes the traffic without acting on it, and let three-quarters of the rest pass unrestricted (July to December 2025). That figure describes how teams configured their bot policies, not how much of the traffic was good or bad. When each control is managed separately, every change feels risky.
Follow a single request to see why. A verified shopping agent adds an item to the cart and moves to checkout. The bot-management tool allows it. A CDN rate limit, tuned on a normal week, counts it alongside a campaign spike and throttles it. A WAF managed rule flags a tracking parameter on the checkout URL. Each control made a reasonable decision on its own. Together, they blocked a real order, and no single dashboard shows why.
The gap is coordination: seeing how all edge controls treat a given path and traffic type together, then changing them together with confidence. Tuning each tool in isolation can't close it.
What You Can Do Today
Before the holiday traffic surge, these steps fit before a change freeze and don't require new infrastructure.
- Map your critical paths, and how every control treats them. List the five or six paths that carry revenue: search, product pages, cart, login, checkout, payment and the APIs behind them. For each, write down which WAF rules, rate limits, bot policies and CDN rules apply. Then replay last year's peak logs, or a recent campaign day, and look for 403s, challenges and rate-limit hits on sessions that went on to look legitimate. That's your false-positive baseline.
- Set policy by traffic type and path, not "human vs. bot". Use the table above as a starting point. For shopping agents, verify signed identity where it exists, since a user-agent string is a label, not proof. Two different mechanisms are emerging: Web Bot Auth, an IETF effort for bots to cryptographically sign their requests, and Visa's Trusted Agent Protocol, developed with Cloudflare to help merchants recognize registered shopping agents. Neither is universal yet, and support depends on your vendors and the agents themselves. Then assess behavior and apply policy per path. Decide crawler access per operator and purpose, with rate and scope limits on catalog pages. Keep the strictest controls on login, gift cards and payment, where fraud bots concentrate. Remember a self-declared agent still needs to behave like one: watch for agents hitting login at scale.
- Tune before the freeze, then watch outcomes, not just blocks. Make rule changes now, test them in monitor or log-only mode against real traffic, and promote them before the freeze. During peak, track blocked checkouts, challenge rates on cart and payment, and conversion by traffic source alongside blocked attacks. Agree in advance who can approve an emergency rule change on peak days, and how fast.
The goal isn't zero bots. It's the right treatment for each kind of traffic on each path, consistently across every control at the edge.
The Bottom Line
Holiday-season security used to mean holding the line against bots. Now some of those bots carry your customers' orders.
This season, the question isn't whether to block bots. It's whether your edge can tell which ones to stop.
