The field guide to every AI crawler and agent at the door, and the vendors who decide who gets in.
Vendors by type
Bot management vendors
In short
23 bot management vendors are profiled, from CDNs such as Akamai and Cloudflare to detection specialists such as Kasada and Verisoul. 14 of 23 document support for Web Bot Auth, 7 for published IP lists and 4 for reverse DNS.
The 23 bot management vendors run alphabetically from Akamai to Verisoul, and carry 181 sourced facts between them.
The price models on record include sales-led; per web ACL plus per request; monthly plan plus usage; usage-based plans; quoted per deployment; and 13 more. 1 profile carries our own probes of key directories or IP files. Each profile lists what the vendor does not do next to what it does.
CDN and security company whose Bot & Agent Control solutions judge AI agents at the edge, take identity from Visa's Trusted Agent Protocol and Know Your Agent tokens, and send AI traffic to TollBit or Skyfire for paid access.
Cloud provider whose WAF Bot Control labels and verifies bots, checks Web Bot Auth signatures and can charge AI bots with HTTP 402, and whose AgentCore Browser signs its own agent traffic with Web Bot Auth.
Developer security SDK for JavaScript, Python and Go that detects bots inside application code, lets developers allow or deny named bots or categories such as CATEGORY:AI, and adds runtime guards for agent frameworks.
Bot and account abuse API whose risk responses include an agent object that names AI agents and browser automation, identified by a verified Web Bot Auth signature, a browser fingerprint or a user-agent string.
Bot and AI crawler protection vendor whose edge integration verifies declared search and AI crawlers against operators' published IP ranges and detects scrapers that run real browsers behind residential proxies.
Application and API protection vendor whose Bot Management includes Agent Trust for personal AI shopping agents, and whose AI Gateway governs enterprise agents' tool calls behind OAuth 2.1 authentication.
Connectivity cloud whose AI Crawl Control, Bot Management and verified bot program sort crawlers by purpose, verify them by IP list or Web Bot Auth signature, and let site owners charge crawlers per request in a private beta.
Bot and fraud protection vendor whose Agentic Trust layer names each AI agent, rates how strong that identification is, applies per-agent and per-endpoint policies, and hands chosen agents to TollBit for paid access.
Application delivery and security company whose Distributed Cloud Bot Defense puts humans, trusted AI agents and malicious bots under one policy, accepts Web Bot Auth and Skyfire's Know Your Agent tokens, and runs on F5's platform, BIG-IP or public cloud.
Edge cloud vendor whose Bot Management adds edge detection (ContentGuard), TLS fingerprinting, client challenges and a verified bots signal, with separate AI crawler and AI fetcher signals for training bots and user-triggered fetchers.
Device intelligence vendor whose Bot Detection and Authorized AI Agent Detection signals separate good bots, bad bots and AI agents, and verify signed agents from providers such as OpenAI, AWS AgentCore and Browserbase.
Google Cloud's bot and fraud service, the evolution of reCAPTCHA, which verifies AI agents by Web Bot Auth signature or by user agent matched to published IP ranges or reverse DNS, and reports verified and suspected agent sessions.
Bot detection and CAPTCHA vendor whose Enterprise Agent Controls identify AI agents, verify partner platforms that sign with Web Bot Auth, and let sites allow browsing while requiring verification before an agent reserves inventory.
Bot and fraud defense vendor whose AgenticTrust module in Sightline names AI agents, grades them High, Medium or Low trust, verifies signed agents, and lets sites set what each agent may do from browsing to checkout.
Application security vendor owned by Thales whose Advanced Bot Protection sorts human, good bot and bad bot traffic across web, mobile and API; verified-agent controls so far ship in a controlled-availability Google Cloud offering.
Bot defense vendor founded in Sydney whose AI Agent Trust adds a verified agent directory with Web Bot Auth support and endpoint-level access rules, enforced at the edge before automated traffic reaches the application.
Agent analytics and access-control service, formerly Dark Visitors, that identifies AI agents and crawlers from server-side data, keeps an automatic robots.txt current, and blocks bots that ignore it or spoof trusted identities.
German security provider whose WAAP platform joins WAF, API security, Bot Management and Web DDoS protection, with a setting to monitor or block AI crawlers; the reblaze.com domain now redirects to Link11.
Server-side bot protection vendor that integrates at the CDN or load balancer without client code, classifies humans, good bots, bad bots and AI agents, and enforces access by intent rather than declared identity.
Web hosting platform that blocks chosen AI crawlers by user-agent string through an Edge Function extension and offers IP, geography and header-based traffic rules and rate limiting; it does not verify bot identity.
Application security vendor whose Bot Manager and Agent Trust Management identify Web Bot Auth-compliant and non-compliant agents, capture an agent's declared intent in conversation, and restrict actions such as login or checkout.
Hosting platform whose firewall verifies known bots by IP, reverse DNS and Web Bot Auth, offers an AI Bots managed ruleset that treats AI crawlers and AI assistants separately, and sells BotID checks for high-value routes.
Fake account and fraud detection platform whose Agent & Bot Detection names AI agents by signature, self-declared user agent or inference, and whose public Agent Atlas documents how each agent shows up on a site.