By E-commerce platforms absorb automated bot traffic at volumes three times greater than any other industry. The volume alone is not the full story. Attackers deliberately time their campaigns to coincide with peak revenue events, when operational pressure to keep checkout flows frictionless is at its highest and the cost of disruption is most severe.
In this interview on TFiR, Steve Winterfeld, Advisory CISO at Akamai, breaks down why commerce is the primary target for AI-driven bot traffic, how peak events concentrate both revenue and attack surface, and what the timing of these campaigns reveals about adversary strategy.
Guest: Steve Winterfeld, Advisory CISO at Akamai
Show: TFiR
Here is what every security practitioner and CISO in retail and e-commerce needs to know.
Technical Deep Dive
Q: Why does e-commerce attract three times more AI bot traffic than any other industry?
Steve Winterfeld, Advisory CISO at Akamai, explains that commerce leads all industries in online customer interaction, making it simultaneously the largest target and the most revenue-interactive surface for automated attacks. Because financial return is directly tied to transaction volume and customer-facing endpoints, it is the sector where automated bot operators can extract the most value with the least effort. Akamai’s research quantifies this as three times the AI bot traffic volume compared to the next most targeted industry.
“Commerce is one of the leading industries in interacting with customers online. They’re targeted because they’re the largest target and they’re highly revenue interactive. It’s where I can simply make the most money.” — Steve Winterfeld, Advisory CISO, Akamai
Q: How do peak retail events like Black Friday and Prime Day increase bot attack risk?
Winterfeld draws directly on his experience as former CISO for Nordstrom Bank to illustrate how peak events such as the anniversary sale, Amazon Prime Days, and the full Thanksgiving-through-Cyber Monday stretch represent a disproportionate share of annual revenue for many commerce organizations. The operational imperative during these windows is to minimize friction and keep conversion rates high, which creates a window of maximum vulnerability. Adversaries understand this dynamic and time their campaigns accordingly, targeting organizations precisely when disruption carries the greatest financial consequence.
“When I hear minimize friction as a cyber criminal, that’s when I want to attack.” — Steve Winterfeld, Advisory CISO, Akamai
Q: What does the Akamai report on AI bot traffic reveal about commerce targeting?
According to Winterfeld, the Akamai report includes detailed graphics illustrating that commerce receives three times the volume of AI bot traffic compared to the next most targeted sector. The report frames this not only as a volume problem but as a strategic targeting pattern tied to where automated attacks generate the highest financial return. Winterfeld recommends the report directly for practitioners who need data to support internal risk prioritization and executive briefings.
“The report is worth reading because there’s a lot of great graphics in there. Three times the volume of what Akamai characterizes as AI bot traffic over the next most targeted industry.” — Steve Winterfeld, Advisory CISO, Akamai
Q: Why does the pressure to minimize friction during sales events make commerce organizations more vulnerable to bot attacks?
Winterfeld identifies a direct conflict between the business goal of frictionless customer experience and the security controls needed to detect and block automated traffic. During peak revenue events, organizations are under pressure not to introduce any latency, CAPTCHAs, or step-up authentication that could reduce conversion rates. This operational constraint is well understood by adversaries, who exploit the window when defenders are least likely to aggressively throttle suspicious traffic patterns for fear of impacting legitimate customers.
“Not only is it the most attacked, but they’re the most heavily attacked during their most vulnerable time for impacts to revenue.” — Steve Winterfeld, Advisory CISO, Akamai
Resources & Documentation
- Akamai, leading provider of cloud security, CDN, and bot management solutions for e-commerce and enterprise platforms
- Akamai State of the Internet / Security Report, referenced by Winterfeld for AI bot traffic volume data and commerce targeting graphics
***
👇 Click to Read Full Raw Transcript
Swapnil Bhartiya: Of course, E commerce or commerce is, you know, low hanging fruit. But why is commerce specifically drawing the highest volume of automated bot traffic compared to other industries? What is the reason behind it?
Steve Winterfeld: Yeah, and you know, the report is worth reading because there’s a lot of great graphics in there. One of the graphics is to what you just said. Three times the volume of what Akamai characterizes AI bot traffics over the next most targeted industry. And so commerce is one of the leading industries in interacting with customers online. So, you know, they’re, they’re targeted because they’re the largest target and they’re highly revenue interactive. And so, you know, it’s where I can simply make the most money. So, you know, we talk about this, we also talk about peak events. So again, when I was CISO for Nordstrom bank, we have the anniversary sale, a peak event if you, we all probably bought something on Amazon, you know, Amazon prime days. Um, we have, you know, it used to be Black Friday and then Cyber Monday. Now it’s that whole five day stretch is just one long endurance for, for people in sales, one long endurance sprint from, you know, Thanksgiving through that, that following Monday. These peak events for some commerce organizations are, you know, a significant part of their annual revenue. And so they need to minimize friction during these sales. Well, when I hear minimize friction as a cyber criminal, that’s when I want to attack. And so this is another aspect of it. Not only is it the most attacked, but they’re the most heavily attacked during their most vulnerable time for impacts to revenue.
