Suspicious Activity signals are now generally available for Business and Enterprise plans. Tell agents, bots, and humans apart, and find the ones with ill intent.
Not long ago, you could look at the traffic on your site and assume a person was behind almost all of it. That's no longer true. In fact, earlier this year, Cloudflare announced that 57% of web traffic is now non-human. Guess what? We’re now outnumbered.
Some of this non-human traffic is AI agents acting for people: booking, shopping, and filling out forms on their behalf. And some are neither, just scripts running stolen credentials, bots probing your forms, automation built to take something that isn't theirs.
Telling these apart has become one of the more important questions companies need to answer. It’s the ability to see what's a human, what's an agent, and what's hostile, and to sort your traffic accordingly. We've been building toward that, and the first place it shows up in the product is the highest-stakes version of the question: which activity on your site is suspicious?
Move from blocking bots to understanding their intent
The old way of dealing with non-human traffic was blunt: separate bots from humans so you could block the bots. That's still useful, but a wall only tells you what to keep out. It doesn't tell you what's happening inside.
As AI agents and automated traffic become more sophisticated, the mandate for risk, digital, and analytics teams has evolved. Teams didn't just want to block traffic. They wanted fraud indicators: signals that something looks wrong, early enough to investigate before it turns into a loss. The old approach waited for problems to surface. This gives you an earlier read, so you can look closer and stop problems before they escalate.
What it actually catches
Suspicious Activity works because sophisticated fraud and automation rarely announce themselves in a single moment. They show up as patterns: the same credential pair tried across dozens of accounts, form fields filled faster than any human could type, a session with no cursor movement at all. Clues that only make sense when you see them together, across events, pages, and sometimes an entire session.
Instead of leaving those clues scattered, Fullstory surfaces them as one signal you can find and search, organized so it's useful at a glance:
By type: is this fraud, or is it automation?
By category: credential stuffing, autofill abuse, bot activity, and more
And it surfaces in real time, in the order things happened, because with fraud the sequence is the story. The tenth login attempt means something the first one didn't.
If you own fraud, risk, or forensics, this is aimed squarely at you. The earliest interest has come from the places with the most to lose: financial services, gaming and gambling, and retail, where gift-card abuse is a perennial headache. Anywhere the stakes are high and someone has a motive to game the system, an early and searchable suspicious signal changes what your team can catch, and when.
One thing to be clear about: this is not a full forensic investigation suite, and it isn't trying to be. Suspicious Activity alerts you to the signal. It's the early-warning layer that tells you where to point to a deeper investigation, whether that's a dedicated fraud tool or a hands-on forensic review by your team. Knowing where to look, and knowing it early, is most of the battle.
Get started with Suspicious Activity in Fullstory
In the Segments menu and Engagement sub-menu, you will find Suspicious Activity. Or you can just type in the global search bar "Suspicious Activity”. From there, select your event filter as AI Agent, Credential Pair, or the signal(s) that matter most to your team. After applying the search, you will be able to view the relevant sessions and trends.
Your traffic is more mixed than it has ever been. Your behavioral data should be what tells you who to trust. See how behavioral data separates humans, agents, and bad actors on your site. Book a demo →
