Application security (AppSec) has long been a core part of what we do at Fastly, and over the past year (especially the last six months), we’ve accelerated that work. Our security research makes it clear: attackers are getting faster, more automated, and more persistent. This year at RSAC, you’ll hear more about two technology investments as a result:
Strengthening the core of modern AppSec
Leveraging purpose-built solutions for bots
What We’re Seeing in the AppSec Landscape
Our recent research, along with findings from our From Code to Production benchmarking report with IDC, highlights a few consistent patterns across organizations.
High-performing (“Exceptional”) security teams stand out in a few ways:
They connect security to business impact: 44% reported more than a 20% improvement in reducing negative user experiences over the past year
They prefer platforms over point solutions: 81% say security works better in platforms vs. silos (compared to 17% of Emerging organizations)
They share a common foundation: more than half of organizations across all maturity levels have adopted three core AppSec controls: DDoS protection, WAF, and API security
These trends reinforce something we’ve believed for a while: modern AppSec is enabling businesses to move faster, confidently.
More bots, more scrutiny
At the same time, bot traffic continues to rise – and get more sophisticated.
From our latest research:
We observed billions more bots quarter-over-quarter, a 2% increase – most of it “unwanted”
89% of headless bot traffic targeted transaction-heavy industries like financial services and commerce
Organizations are responding by tightening controls, blocking billions of “wanted” bot requests
Bots today aren’t just crawling pages; they’re attempting logins, scraping data, and exploiting workflows. That shift is pushing defenders to rethink how they manage automated traffic altogether.
Bolstering your AppSec foundation
In response, we’ve continued to invest in the three core areas to keep customers ahead of these threats:
DDoS Protection, now enhanced with our Adaptive Threat Engine that further reduced time to mitigation while increasing accuracy
Fastly’s Next-Gen WAF (Web Application Firewall), with ongoing UX improvements
API Security, including API Discovery and Inventory to review all incoming API traffic
A Different Way to Handle Attackers: Deception
As bots and botnets give attackers more scale, we’re also exploring a different approach: not just blocking attacks, but misleading attackers altogether. To combat malicious bots, organizations must go beyond blocking – and they can do it withMeet Deception for Account Takeover (ATO).
Instead of returning a standard success or failure response, this capability returns an invalid login response every time – regardless of whether the credentials are correct.
That means:
Attackers get no signal to refine their approach
They can’t confirm valid credentials
They’re more likely to abandon the attack
At the same time, defenders avoid repeated attack cycles and reduce the time spent responding. Deception for ATO is the first use case for our patent-pending capability, but we’re working on even more, with the next coming to beta just in time for RSAC.
New: Deception for CVEs
We’re also introducing a new Deception capability focused on common vulnerabilities and exposures (CVEs) that is now in BETA.
Inspired in part by the industry response to high-severity events like React2Shell, this feature allows defenders to present false indicators of exploitable vulnerabilities.
The goal is simple:
Increase attacker dwell time
Consume attacker resources
Redirect effort away from real systems
By making environments appear less predictable, defenders gain an advantage – without adding operational overhead.
See the Team at RSAC 2026
Attackers are evolving quickly – and we think defense should too, not just by getting stronger, but by getting smarter too.
Fastly's application security portfolio will be showcased at RSAC, March 23-26, and you can find us at South Expo Booth 1049 if you’d like to chat. If you won’t make it this year, you can contact us.