AI Agents Read Your Site in Under 1,000 Tokens. Most of What You Built Never Gets Seen.

Your website is no longer read only by people.

Tony Lauro opens this episode with a client whose sequential order numbers let a competitor read their daily volume through a public API. No breach. No alert. Just a number counting up in plain sight.

The same blind spot shows up when a product drop gets sniped by bots in seconds, or when the large language models you’re exposing to customers and employees get probed before anyone notices.

Tony has spent 13 years inside Akamai’s bot management and API security practice, watching exactly this shift happen. He walks through what replaced the old human-or-machine test, and it comes down to one thing: who decided your defaults, and whether anyone at your company ever checked.

Find the Risk You’re Already Dealing With

• Our security team still argues about whether traffic is a real person or a bot. Is that even the right question to be asking anymore? → Jump to [1:00]
• Some of our “customers” completing checkouts or filling out forms might actually be AI agents acting on a real person’s behalf. Can our bot rules even tell the difference? → Jump to [3:54]
• We know some of the activity on our platform isn’t clean, but cracking down on it would hurt our numbers. How do we actually think through that tradeoff? → Jump to [26:38]
• Our security team and our marketing team have never once talked about brand risk together. Should they be in the same room? → Jump to [29:03]
• Our provider pushes our blocking rules out to the edge before traffic even reaches us. What judgment calls are they making on our behalf without us knowing? → Jump to [36:57]
• We know AI is a risk somehow, but nobody’s mapped out where it’s actually hitting us. Where would we even start? → Jump to [45:01]
• We just turned on an internal AI tool or chatbot, and I don’t know what it’s actually watching for. What should it be catching? → Jump to [50:57]
• A security vendor ran a proof of value on us and found something scary in our environment. Is that actually proof their tool works? → Jump to [1:28:57]
• We just signed with a new security vendor and I have no idea what its default settings actually are. Should I be worried? → Jump to [2:04:38]

Chapters

• 1:00 Why “human or bot” is the wrong security question now
• 3:54 AI agents that act like your customers, and why bot management needs a third tier
• 26:38 Brand safety versus listing volume: a marketplace’s real tradeoff
• 29:03 Cyber fusion: why security and marketing finally have to talk
• 36:57 Pushing your security policy to the edge means trusting your provider’s judgment call
• 45:01 The three places AI is actually hitting your business at once
• 50:57 Prompt injection and what a firewall built for AI actually watches for
• 1:28:57 Every proof of value finds something. That’s not proof it works.
• 2:04:38 The default is the most important thing you never reviewed

What We Mentioned

• Akamai, bot management and API security
• Akamai’s “Firewall for AI,” announced at RSA Conference
• Akamai’s recent acquisition moving the company into the browser
• robots.txt and llm.txt, the standards good bots and crawlers are supposed to honor
• AEO and GEO (answer engine optimization and generative engine optimization)

About the Guest

Tony Lauro, Senior Director, Security Technology and Strategy at Akamai. Thirteen years inside Akamai’s bot management and API security practice, working the exact problem this episode covers: telling good traffic from bad without losing customers in the process.

Connect with Tony: LinkedIn | Akamai

About Signed

Signed is the podcast for buyers in a market built for sellers. Host Max Clark, CEO of ITBroker.com, sits down with CIOs, CFOs, operators, and founders who’ve lived inside real enterprise tech deals. New episodes weekly at itbroker.com/podcast. If you’re in the middle of a real tech decision and want someone in your corner, book an intro call at itbroker.com. Buy tech without regret. Follow: @itbrokerdotcom