Telecommunications companies handle enormous amounts of digital traffic, yet their websites performed worse than any other industry in a new bot protection test. Technology platforms and financial services weren’t far behind. For anyone managing hosted applications, the findings call for a closer look at what existing defenses actually recognize.
The findings come from a 2026 benchmark by Datadome, a bot-protection provider that tested 21,491 websites across 15 industries using ten bot types. Nearly two-thirds, or 65.3%, didn’t challenge or block any of them. Just 2.4% stopped all ten. The results reflect how websites responded to these automated requests, rather than a full audit of their security controls or evidence of actual breaches.
Telecommunications Leads the Weakest Industries
Telecommunications had the highest share of unprotected websites at 82.9%. Only 15.9% showed partial protection, and 1.2% stopped every bot type. That placed the sector well behind the overall sample, where 32.3% of websites managed at least some protection and 2.4% achieved full protection.
Technology platforms followed at 77% unprotected and financial services at 73.8%. Property, infrastructure and public sector sites came next at 71.9%, with education at 69.7%.
The Bot protection benchmarks rank sectors by the share of websites that failed to challenge any of the test bots. That doesn’t tell an individual business how its own defenses perform. It does give operators in those industries a reason to run their own checks.
Technology Platforms Deserve Particular Attention
For people managing hosting infrastructure, the technology-platform figure deserves a closer look. The category includes public-facing technology services, making its performance particularly relevant to teams overseeing web infrastructure.
Among the technology platforms tested, 21.5% showed partial protection and only 1.5% achieved full protection. The report doesn’t identify individual hosts or tie those scores to specific hosting architectures.
Even the Better-Performing Industries Struggled
Marketplaces and classifieds came out on top, though their results would hardly reassure a site owner. In that category, 52.3% of websites failed to challenge any test bot. The remaining 47.7% provided at least partial protection, including 3.9% that stopped all ten types.
Retail and e-commerce ranked second, with 59.7% unprotected. Travel and hospitality followed at 61.5%. Every industry tested had a majority of sites classified as unprotected.
First place in this ranking means better performance against these ten tests, not protection against every kind of automated misuse.
Company Size Offered Little Advantage
An enterprise-scale security budget might be expected to deliver stronger defenses. The company-size figures didn’t support that assumption. Websites belonging to organizations with more than 10,000 employees had a 64.6% unprotected rate, compared with 62.7% among businesses with one to ten employees.
Traffic made little difference, either. Sites in the top 1,000 by traffic had an unprotected rate of 64.4%, matching the figure shown for the lowest-traffic tier in the report. Traffic and company size, on their own, provided little indication of stronger bot detection.
The same concern appears when examining infrastructure security risks: technical teams need visibility into the systems and connections they rely on. For bot traffic specifically, a review should include what happens when automated requests arrive, not simply whether a firewall or filtering service is switched on.
What the Testing Can Actually Tell You
The benchmark used several levels of automation. Basic bots sent straightforward requests. More advanced tests included bots impersonating AI crawlers, traffic with disguised browser fingerprints and automation running inside real browsers. Blocking a familiar crawler name is easier than identifying an impersonator.
For instance, 29.3% of sites stopped at least one spoofed AI bot. The report cautions that some of those defenses may simply block familiar crawler names rather than detect impersonation. It also found that only 3.1% of sites stopped every real-browser bot tested, where ordinary browser activity and automation can be difficult to separate.
There are limits to these findings. A site counted as partially protected might have stopped only one test type, while another might have stopped nearly all of them. An unprotected score records no challenge during this particular exercise; it isn’t proof that the website has no other safeguards or has suffered an incident.
For website operators, that suggests a practical exercise: run authorized tests against the traffic patterns their applications actually receive, note which requests trigger a response and review the gaps. Tests should also cover automation that looks like a real visitor.
Protection Needs to Be Demonstrated
The least-protected category in DataDome’s study was telecommunications, followed by technology platforms and financial services. More surprising is how little advantage large organizations and high-traffic websites showed over smaller ones.
A hosting plan, security tool or familiar brand name can’t answer whether a particular website will detect unwanted bots. Teams need evidence from their own environments, including what their controls block, what they challenge and what passes through. The benchmark gives them a reason to ask for that evidence, and a reminder to read any protection score in the context of the tests behind it.
