HUMAN Iris Report: CISO and CMO Perspectives on Agentic Traffic Visibility
Adam Sell
Sr. Research Editor
of marketing and security leaders have directional insight at best into agentic traffic on their digital properties
of marketing and security leaders were only “somewhat confident” or worse about their current tools’ ability to see agentic traffic
of marketing and security leaders had no idea how much of the traffic to their digital properties was automated
Introduction
CISOs and CMOs are looking at the same rising tide of non-human traffic from opposite ends of the organization, yet neither can fully see it, nor are they fully prepared for the paradigm shift it represents.
Agentic AI is rapidly spreading across the enterprise web. Traffic from AI agents, browsing on behalf of a user, comparing products, or scraping content for a model to learn from, is already mixed into the traffic that marketing teams optimize for and that security teams are responsible for defending. This traffic, which is by definition automation but reflects some of the highest-intent traffic that could visit your site, needs to be identified in order to be governed properly.
The rise of this traffic demands a shift in how organizations perceive digital interactions. We have entered the Agentic Era, where interactions can’t be governed with yesterday’s bot-or-not rules. That’s the role of agentic trust – the emerging discipline for understanding, verifying, and governing how humans, bots, and AI agents operate online. Establishing this trust is essential to ensure that AI-driven growth doesn’t come at the cost of fraud, wasted spend, or distorted signals.
In July 2026, HUMAN surveyed two groups who sit on opposite sides of this phenomenon: 50 senior marketing leaders and 50 CISOs and equivalent security leaders. Both groups were asked a largely parallel set of questions about their confidence in identifying non-human traffic (including AI agents), their current tools, and how they would respond if that traffic accounted for a larger share of their numbers than they think.
The two surveys tell a connected story. This Iris Report covers how each group currently sees that traffic, from their confidence and tooling today, to how much AI agent activity they believe is already present, to the point at which each would change course, and what that visibility gap has already cost them. Marketing leaders are the ones staring at conversion and attribution data that may be quietly contaminated. Security leaders are the ones responsible for deciding whether that same traffic is a threat, a legitimate new channel, or both. Neither group reports strong confidence that they can currently tell the difference.
Survey Methodology and Demographics
The findings in this report are drawn from two parallel surveys conducted in spring of 2026: one of senior marketing leaders and one of CISOs and equivalent security leaders, each with a sample size of 50.
Marketing | CISO |
|---|---|
Sample size: 50 senior marketing leaders (100% CMO, VP Marketing, or SVP Marketing) | Sample size: 50 CISOs and equivalent security leaders (100% CISO or Leadership) |
Company size: 78% Mid-Market (200-999 employees), 22% Enterprise (1,000+ employees) | Company size: 62% Enterprise (1,000+ employees), 38% Mid-Market (200-999 employees) |
Industry mix: 58% SaaS/Software, 18% Financial Services, 14% IT Services & Consulting, with smaller representation across fintech, insurance, and other sectors | Industry mix: 36% IT Services & Consulting, 32% SaaS/Software, 24% Financial Services, with smaller representation across other sectors |
Both surveys asked a largely parallel set of ten questions, adapted for each audience’s role: marketing leaders were asked about the impact on conversions and marketing decisions, while CISOs were asked about the impact on security posture, fraud, and risk decisions. Where the two cohorts’ responses notably diverge, this report presents the data side by side.
Executive Summary
Both CISOs and CMOs suspect AI agents are already interacting with their properties, but neither group can reliably measure it, and that gap is already producing real business and security consequences.
Confidence in distinguishing human, bot, and AI agent traffic is low across both groups. 68% of marketing leaders and 80% of CISOs report low to moderate confidence in their organization’s ability to make this distinction.
Both groups largely believe AI agents are already interacting with their websites and apps, but very few can quantify it. 94% of marketing leaders and 98% of CISOs said AI agents are either possibly or definitely present, but only 16% of marketing leaders and 4% of CISOs said they can quantify that traffic.
The damage from this visibility gap is already measurable. 58% of marketing leaders report broken attribution tracking in the last 18 months, and 44% of CISOs report growth in automated scraping against their applications or APIs. Despite this, close to half of CISOs (48%) say their organization does not actively filter non-human traffic at all.
Both groups are also candid about the limits of their current visibility. 72% of marketing leaders and 44% of CISOs describe their current state as having only “directional insight,” enough to see general patterns but not enough to make confident, granular decisions.
The findings point to a shared blind spot. Without a shared, reliable way to classify human, bot, and agentic traffic, the two functions are likely to keep reaching different conclusions from the same underlying data, one optimizing for it, the other defending against it, often without realizing they are looking at the same problem.
Confidence and Coverage Today
Confidence in telling human, bot, and agent traffic apart is low for both marketing and security leaders, and the tools each group leans on to fill that gap point in different directions.
Overall, leaders are living in that murky middle, where they believe they can see humans, bots, and AI agents in their data, but they’re not completely sure. And that blind spot can be the cause of a wide variety of challenges, as we’ll explore.
Among marketing leaders, 34% describe themselves as somewhat confident and 34% as not very confident in their organization’s ability to reliably distinguish human, bot, and agentic AI traffic. Among CISOs, 42% are somewhat confident and 38% are not very confident.
The one notable gap is at the top end of the scale: 14% of marketing leaders call themselves extremely confident, compared to just 2% of CISOs. On the whole, a combined 68% of marketing leaders and 80% of CISOs report low to moderate confidence.
Estimated and How Each Group Currently Filters Non-Human Traffic
Marketing leaders and CISOs don’t even agree on the scale of the problem. As a combined group, estimates for non-human traffic to company websites or public-facing apps ran the gamut: one in ten figured the number at less than 5%, while 19% of respondents thought it was more than a quarter of visitors. And the plurality of respondents, 27%, had no idea.
The most common answer for marketing leaders specifically was 5% to 10% of traffic (26%), while the most common answer for CISOs was simply “not sure” (30%). And CISOs—who, granted, may be the more pessimistic of the groups—estimated higher automated traffic numbers on average. One in four CISO respondents pegged the automated traffic figure at more than 25%.
That uncertainty carries through to how—or if—each group actually filters it. Marketing leaders lean on tools built into their existing stack: 46% use built-in analytics tools like GA4 or Adobe, and 40% use ad platform filtering. Nearly one in three (30%) reported not actively filtering non-human traffic at all.
CISOs tell a different story. Nearly half (48%) of respondents reported that their organization does not actively filter non-human traffic. Where CISOs do filter, they lean more on third-party tools (30%) than on built-in analytics (24%) or ad platform filtering (18%).
The two functions are working from different pictures of the same traffic, and neither has settled on a shared source of truth: CISOs are the least certain of how much non-human traffic exists, and the least likely to be actively filtering it.
AI Agents: Presence, Confidence, and Willingness to Act
Both CISOs and CMOs largely believe AI agents are already active on their properties, but they set very different goals for what should prompt action.
Belief that AI agents are already interacting with the organization’s website or app is high in both groups, but it comes with almost no certainty.
Among marketing leaders, 44% say agents are possibly interacting with their site but they are unsure, and 34% say agents are interacting but they cannot quantify it. Only 16% say they can quantify that activity.
CISOs report a similar pattern but lean slightly more toward believing agents are already present: 48% say agents are interacting but they cannot quantify it, and 46% say possibly. Only 4% of CISOs say they can quantify AI agent activity, and just 2% say agents are not present at all.
“This is a timely question. We are currently evaluating this and are working to determine what additional controls, if any, we can place to defend against this type of activity. So far, we have not had a clear answer.”
CISO, Mid-Market Higher Education
Confidence and the Willingness to Act
In a reflection of the earlier question about visibility into bot, human, and AI agent traffic, leaders across the board expressed only mild confidence about whether their current toolkits were sufficient to segregate malicious bot traffic and beneficial AI agents.
Splitting the leaders into their roles, there’s a clear divergence of opinion. CISOs report meaningfully less confidence than marketing leaders when it comes to separating malicious bots from legitimate agents. 54% of CISOs say they are not very confident or not at all confident that their current tools make this distinction accurately. Among marketing leaders, that figure is 40%. And only half as many CISOs ticked one of the top two boxes for confidence level, an echo of their earlier concerns about identifying traffic.
Given a hypothetical “what would you do differently if you could reliably identify non-human or low-quality activity”, there’s a substantial shift when comparing the two cohorts:
CISOs report less confidence and are far less likely to act on it compared to CMOs. Asked how a meaningful portion of non-human or low-quality activity in their conversions or traffic would affect their decisions, 44% of marketing leaders said they would significantly reallocate spend. Only 8% of CISOs said they would respond that significantly, with the large majority clustering in “moderately, we would adjust some tactics” (46%) or “slightly, we might investigate” (46%).
Business and Security Impact
A visibility gap is appearing for both groups: marketing leaders are dealing with broken attribution and measurement, while CISOs are seeing a rise in automated threats, and both sides describe what they currently have as directional insight at best.
CMOs and CISOs describe different symptoms of the same underlying condition: traffic neither group can fully classify is already showing up as a cost, whether that cost is measured in broken attribution or in account takeover attempts.
Asked how their marketing has been negatively affected in the last 18 months, marketing leaders pointed most often to measurement problems. 58% report broken attribution tracking, 52% report distorted KPIs, and 52% report inaccurate customer acquisition cost (CAC) and lifetime value (LTV) calculations.
CISOs report a different set of impacts, centered on threat activity rather than measurement. 44% report growth in automated scraping targeting their applications or APIs, and 42% report account takeover (ATO) attacks against existing accounts. 36% report difficulty defining or operationalizing incident response triggers for fraud and abuse events.
Current Visibility, and What Clearer Visibility Would Change
One question neatly summarized the survey’s thesis:
Only 12% of survey respondents felt like they had a clear understanding of what’s driving traffic to their websites and public-facing apps today. The largest proportion of respondents by far—58%—felt their insight was only directional. And nearly one in three respondents (30%) said they were making strategic decisions with only partial visibility.
Marketing leaders converge heavily on one answer: 72% say they have directional insight into traffic and performance, but lack clarity or visibility on some key components. Only 18% say they are making decisions with only partial visibility, and 10% say they have a clear understanding of their traffic.
CISOs are more evenly split between the two more cautious statements. 44% say they have directional insight but lack clarity on some components, while a nearly equal 42% say they are currently making strategic decisions with only partial visibility into traffic or performance drivers. Just 14% say they have a clear understanding of their traffic. That even split suggests CISOs feel the visibility gap more acutely than marketing leaders do, even though both groups are working from broadly similar levels of actual measurement capability.
From Insight to Action
Asked what they would do differently with clearer visibility, marketing leaders most often described reallocating spend toward channels and segments they could trust, and rebuilding attribution and targeting models around a cleaner picture of who, or what, is actually converting. As one CMO put it: “I hadn’t even thought about marketing to bots. Now I’m targeting GEO/AEO but have not even considered real buyers using bots to gather information.” Granular governance of AI-driven traffic (i.e., making traffic available for LLM crawlers but not for AI agents) can help marketers dial in their level of engagement with AI.
CISOs most often described shifting from broad, reactive controls to more precise, risk-based ones: reducing friction for legitimate users while tightening controls only where risk is actually elevated. As one CISO explained, clearer visibility into “exactly who and what was visiting our site and app” would mean far more confidence separating genuine users from suspicious activity, and the ability to “tighten controls where risk is high while removing unnecessary friction for legitimate customers.”
“To be completely honest, this is a topic we haven’t thought of at all. Maybe we didn’t experience the impact yet, or maybe we are not aware of the impact as of this point in time. This survey does trigger me to investigate, but this will be the first time investigating it.”
CISO, Enterprise Retail/Automotive
Looking Forward
Marketing and security are each holding half the picture. Marketing feels the cost first, in broken attribution, distorted KPIs, and conversion rates that don’t hold up. Security feels the risk first, in scraping and account takeover attempts. Both sides describe what they have the same way: directional insight, not real measurement.
Closing the awareness and understanding gap starts with adopting an agentic trust framework – a shared way to tell human, bot, and agentic traffic apart. As AI agents browse, decide, and transact at scale, businesses need this new operating model to maximize opportunity without compromising performance or security. By verifying digital interactions across the entire customer journey, organizations can finally make optimization and defensive decisions from the same picture, turning agentic traffic into a trusted growth channel rather than a liability.
HUMAN’s AgenticTrust is a trust and governance layer for agentic AI. It enables organizations to detect and classify AI agents, verify trust level, and govern how agents interact with web applications. By evaluating the intent behind each agent-initiated interaction, AgenticTrust empowers businesses to enable high-value use cases, prevent abuse and fraud, and safely integrate AI agents into the customer journey.
About HUMAN
HUMAN Security is the global leader in Agentic Trust, the emerging discipline that informs and governs how humans, bots, and AI agents operate online. For more than a decade we’ve helped enterprises, platforms, and digital ecosystems verify digital interactions and establish trust across the entire customer journey – from first ad impression to final transaction. Powered by one of the world’s largest behavioral signal networks, HUMAN analyzes over a quadrillion digital interactions each year to distinguish legitimate activity from fraud, abuse, and automated manipulation. Learn more at humansecurity.com.