Most SaaS founders don't know how much of their traffic is automated. They know their cloud bill to the cent, their CDN spend, their database CPU — but not how much of that load is bots.
That's expensive, and it's usually more expensive than any single line item suggests. Imperva's Bad Bot Report has put automated traffic near half of all web requests in recent years, and even if your product sits well below that figure, the costs spread across your business in ways a single invoice never shows.
The hidden line items
Bot traffic shows up in places you might not expect.
1. Infrastructure
Scrapers, scanners, and fake signups consume the same compute, bandwidth, and storage as real users. A sustained scraping campaign can inflate your CDN bill or force you to scale your API tier earlier than actual customer growth justifies. Because the traffic blends into normal usage graphs, the cost hides inside "growth."
2. Fraud and abuse
Fake accounts dilute your metrics, burn through free trials, and generate support noise. Credential-stuffing runs trigger account lockouts and password-reset emails — and every reset email costs real money to send and real support time to unwind. If you offer a free tier, automated signups convert directly into consumed resources: storage, compute, and onboarding emails for accounts that will never become customers.
3. Conversion
CAPTCHAs and aggressive rate limits reduce signups. Every legitimate user who abandons a flow because of friction is a customer you paid to acquire but didn't get. This cost never appears on an invoice, which is exactly why it gets ignored.
4. Data quality
If a meaningful share of your product usage data is synthetic, your analytics, A/B tests, and retention metrics are wrong. Bad data doesn't just cost money — it quietly steers the roadmap in the wrong direction.
A simple cost framework
Here's a back-of-the-envelope way to estimate what bots cost you each month:
monthly_bot_cost =
(bot_requests / total_requests) * monthly_infra_bill
+ fake_accounts * cost_per_signup
+ fraudulent_charges * chargeback_rate
+ lost_conversions * cac
+ support_hours * hourly_support_cost
Most teams only measure the first term. The others are usually bigger — and they compound. Fake signups this month become churned "users" in next month's cohort analysis.
Why this is getting worse
Two trends make bot traffic harder to ignore than it was even two years ago:
- LLM crawlers and AI agents now browse at scale. Some are benign — search indexing, or answer-engine retrieval you may actually want. Others are not: content harvesting, price scraping, automated signup attempts driven by agent frameworks.
- CAPTCHA is less effective. Modern automation solves challenges cheaply, and legitimate users dislike puzzles enough that conversion measurably drops. You pay on both sides of the interaction.
The old playbook — IP blocks, rate limits, puzzles — is no longer enough on its own.
A worked example
To make the framework concrete, consider a hypothetical mid-sized SaaS handling 50 million requests a month with a $40,000 monthly infrastructure bill:
- Log analysis suggests 30% of requests are automated — that's $12,000 of infrastructure serving bots.
- 4,000 signups a month turn out to be fake; at a conservative $2 handling cost each, that's $8,000.
- Aggressive rate limiting and CAPTCHAs deter an estimated 200 would-be customers a month; at a $300 acquisition cost each, that's $60,000 of marketing spend producing nothing.
Even with rough numbers, the total dwarfs the infrastructure term alone. Your figures will differ — the point is to run your own numbers through the same shape of calculation.
What to do instead
Teams that handle this well share a few habits:
- They measure first: what percentage of traffic is automated, and where does it concentrate?
- They score behavior rather than blocking by static rules, so detection adapts as attackers do.
- They run detection at the edge, so the check adds no visible latency to the user experience.
- They tune for false positives aggressively — a blocked good user is worse than a missed bot.
None of this requires a six-month project. Behavioral scoring runs alongside your existing stack: you start in monitor mode, see what share of your traffic is actually automated, and only then decide where to throttle or block. The first win is usually just knowing the number.
Try this
This week, pull your logs and answer two questions:
- What percentage of your requests come from sessions with non-human behavioral patterns?
- What is your cost per thousand automated requests?
If you can't answer either, start there. The number is usually higher than expected.
If you want a shortcut, Phylaxa flags automated traffic across your web, mobile, and API endpoints using LLM behavioral analysis — and for a limited time it's free for teams under 100,000 monthly users. Apply for the free plan: every application is reviewed by an engineer, and most teams are live within one to two business days. Details are on the pricing page.