• Rising AI traffic can increase costs for Malaysian businesses.
• Businesses must balance AI visibility with content protection and business value.

AI assistants are increasingly retrieving information, comparing products, checking availability, and supporting transactions on behalf of users. That is changing the mix of traffic reaching company websites as automated systems account for a larger share of online activity.

Fastly found that machine-generated traffic crossed 50% of traffic on its network in July and August 2026. AI traffic also grew 6.5 times faster than human traffic between January and May.

“AI-generated traffic is creating a new audience: machines acting on behalf of people,” Rachel Ler, Area Vice President of Asia at Fastly, said in an exclusive interview with Tech Wire Asia. “AI fetchers can answer questions, compare options, check availability and support transactions, so businesses must ensure their content is easy for AI assistants to access and understand.”

Ler said businesses also need to decide how much access these automated systems should receive.

“Visibility must be balanced with control,” Ler said. “Businesses should identify which AI systems are accessing their content and decide which interactions to allow, manage or block.”

AI traffic can reach deeper into infrastructure

The infrastructure impact differs from conventional human web traffic. Fastly found that more than 51% of AI requests reached a company’s origin servers, compared with less than 9% of human requests.

Because these requests reach the origin rather than being served from cached content, they can place more demand on infrastructure, consume additional bandwidth, and increase operating costs. That makes the proportion of traffic reaching origin systems as important as the overall volume of AI requests.

Ler said organisations should first understand how much automated traffic they receive, where it comes from, and how it affects website costs and performance. They can then establish rules for which AI systems should be allowed, limited, or blocked.

“Businesses must balance useful AI activity, such as checking products and prices, with preventing harmful scraping, fraud and abusive bots,” Ler said. “Blocking all AI bots could reduce visibility in AI-generated recommendations, while allowing unrestricted access could expose valuable content and create security risks.”

This is particularly relevant in Malaysia, where ICT and e-commerce contributed RM451.3 billion to the economy in 2024. Business-to-consumer e-commerce income reached RM374.7 billion during the year, up 11.3% from 2023.

Ler said AI traffic can affect operating costs, website performance, and customer reach. Fastly found that AI requests grew by around 30% between January and May 2026, while a larger proportion of those requests reached businesses’ main systems than human traffic.

The issue therefore extends beyond cybersecurity. AI traffic can affect infrastructure spending and service performance, while access decisions can also influence whether a company’s products, prices, and other public information are available to AI assistants responding to customer queries.

Crawlers and fetchers serve different purposes

Fastly’s data showed that 85% of AI-bot requests on its network in May 2026 came from crawlers, while 15% came from fetchers. Crawlers systematically collect online content, while fetchers retrieve specific information in response to user requests.

“Malaysian organisations should assess AI traffic based on three factors: identity, intent and business outcome, rather than treating every AI bot in the same way,” Ler said.

The distinction between crawlers and fetchers also gives businesses a way to assess the intent behind machine traffic. A fetcher retrieving product information or availability in response to a user prompt is more closely tied to an immediate customer request, while a crawler may scan large portions of a website without a direct connection to a transaction.

That does not mean every crawler is unwanted or every fetcher is valuable. Ler’s approach is to assess the identity of the system, what it is trying to access, and whether the activity produces a business outcome that justifies its infrastructure cost.

Identity is one part of that assessment. Ler said organisations should look beyond a bot’s declared user-agent and examine request headers, IP reputation, and behaviour because malicious or unauthorised bots can impersonate legitimate AI services.

Traffic behaviour can provide further context. A verified fetcher making occasional requests for product information, availability, or documentation differs from a crawler repeatedly scanning large sections of a website or accessing uncached and commercially sensitive material.

Repeated access to uncached pages can be particularly relevant because it pushes more requests toward origin infrastructure. A crawler that repeatedly reaches commercially sensitive or resource-intensive parts of a site can therefore carry a different cost profile from a targeted request for a specific piece of information.

Organisations can then connect traffic data with outcomes such as referrals, qualified visits, conversions, API transactions, and infrastructure costs.

That assessment is not limited to traffic volume. Organisations can compare infrastructure metrics such as bandwidth consumption and origin-server requests with commercial indicators such as referral traffic, conversions, API transactions, and AI citations. This provides a way to judge whether automated traffic is producing value relative to the resources it consumes.

“The aim is not to block AI wholesale, but to make granular decisions about which bot can access which content, at what frequency and for what business purpose,” Ler said.

Controlling access without blocking discovery

Businesses seeking visibility through AI-generated answers do not necessarily have to provide unrestricted access to their websites. Ler said organisations can allow trusted AI crawlers to access public articles, product information, and corporate updates while protecting premium content, personal data, and customer portals.

That allows access policies to be applied at the content level rather than simply deciding whether an entire bot should be allowed or blocked. Public product information and corporate updates can remain available to trusted AI systems, while authenticated, proprietary, or sensitive material can be kept behind access controls.

“The aim is controlled visibility: provide trusted AI services with enough public information to represent the organisation accurately, while keeping sensitive material behind authentication and limiting unnecessary data exposure,” Ler said.

Ler also noted that organisations need to consider more than whether individual pieces of information appear sensitive in isolation. AI systems can infer sensitive information from seemingly non-sensitive online behaviour, adding another consideration when companies decide what information automated systems should be able to retrieve.

Businesses can also assess individual AI services based on their behaviour and impact. Ler said useful metrics include request volume and frequency, pages or APIs accessed, origin-server requests, bandwidth consumed, referral traffic, conversions, and AI citations.

“Businesses should avoid treating every AI bot in the same way,” Ler said. “Start by asking whether the bot has a verifiable identity, a clear purpose and a genuine business benefit, such as improving search visibility, directing potential customers to the website or retrieving information for a user’s request.”

Looking at those measures together gives organisations more context than a simple allow-or-block decision. A bot that generates high request volumes but little referral or transaction activity can be assessed differently from one that consumes fewer resources while supporting customer searches or API transactions.

AI traffic becomes a cross-functional issue

Managing this traffic is also becoming relevant to Malaysia’s broader AI plans. The country aims to become an inclusive and sustainable AI nation by 2030, while its Digital Trust and Data Security Strategy 2026–2030 places cybersecurity and data protection alongside its AI agenda.

The issue is not limited to security or infrastructure teams. Decisions about AI access can also affect online visibility, customer acquisition, digital channels, and the cost of running web services, which gives commercial teams a role in setting those policies.

Ler said companies should involve digital, security, infrastructure, and commercial teams when setting policies for AI agents. Those decisions can be based on identity, behaviour, infrastructure cost, security risk, and business value.

Bringing those teams together also allows organisations to weigh competing priorities: allowing useful AI services to access public content, limiting unnecessary infrastructure demand, and keeping sensitive or proprietary information protected.

Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.

Tech Wire Asia is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.