Fingerprint's Keshia Rose: sites now want some bots, so 'is this a bot?' fails

For years, websites asked one question of automated visitors: is this a bot? Keshia Rose, who works in developer relations at the security company Fingerprint, argued on Software Engineering Daily that the question no longer works. Sites now want some bots, such as AI assistants acting for a customer. They must tell those apart from hostile ones, and not every agent says who it is.

What was said

Rose spoke with host Gregor Vand. She described the old rule of thumb: a bot was probably bad, unless it was a well-known search crawler. Now a site may want agents to make a purchase or a booking. "now it's like, well, hold on, we want the bots."

Her company's answer is to layer checks. It looks at how the visitor behaves, such as how often and how fast it works. It also uses Web Bot Auth, a draft standard in which an agent signs its request headers with cryptography. Fingerprint compares the signature with a registry and confirms the named company really owns the agent.

But signing is voluntary. Rose said not all agents announce themselves. She named Meta's Muse as one that, as far as she knew, did not. Blocking such an agent is risky, she said, because it is probably someone using the site legitimately. Some agents also send plain requests without loading a page at all, so Fingerprint is preparing a separate tool for them. Rose summed up the moment this way: "now it is like the wild wild west".

Why it matters

Our reading: the block-or-allow switch has become a policy decision. A shop or booking site must now choose which agents may transact, and how it will know they are who they claim. Vand said his own company is being approached by frontier AI labs that want to buy on its platform. His question was how his side could be sure the request really came from them.

Rose said Fingerprint plans an assessment for site owners. It asks whether you can see agents on your site, tell what kinds they are, and give them a clear path to buy or book while still stopping fraud. For managers, the first step is simply to check whether your logs can separate a person, a named agent and an unknown one.

The other side

Rose works for a vendor that sells this kind of detection, so her framing deserves that caution. She also conceded that Web Bot Auth is still an emerging standard. She said many players, including Google and Visa, are building their own approaches to agent shopping. A signing scheme only helps agents that choose to sign.

She also noted that by "bad bot" her team mostly means one that did not announce itself. That is not the same as a malicious one. Sites that block every unnamed agent may turn away real customers. Sites that let them in may let fraud through. The episode did not offer a clean answer to that trade-off, and Rose said people are still scrambling to work it out.