Vendor, ranked 10 of 15
Fastly
In short
Fastly is an edge cloud whose WAF signals and Bot Management product cover agents only in part: verification, per-purpose policy, charging and commerce agents each grade partial, and reporting is not published, for 4 of 10 points. Fastly publishes no price for Bot Management, which an Essential-tier Next-Gen WAF customer cannot buy at all.
Edge cloud vendor whose Bot Management adds signals for suspected and verified AI crawlers and fetchers, lets sites block, throttle, deceive or allow them, and can redirect them to a TollBit paywall.
Alternatives to Fastly ยท fastly.com
- Type
- Bot management
- Homepage
- fastly.com
- Last read
- 2026-11-05
The rubric, with evidence
| Question | Grade | What the vendor documents |
|---|---|---|
| Tells a verified agent from a spoof | Partial | verified-bot signals for AI crawlers and fetchers; Skyfire credentials at the edge (announced); Web Bot Auth not found in docs (checked 2026-11-04) |
| Per-purpose policy (train, search, answer, act) | Partial | crawler versus fetcher signals, suspected versus verified |
| Charging for access | Partial | through TollBit paywall redirect |
| Lets signed commerce agents through | Partial | Skyfire KYA/KYAPay partnership (Jun 2026); no Visa TAP or Mastercard Agent Pay found |
| Cost | no public price; sales-led | |
| Reporting | Not published | AI bot reporting not described on pages read (checked 2026-11-04) |
| Where it runs | edge: classification and actions on Fastly's edge network |
Cost
no public price for Bot Management or AI Bot Management; contact sales (checked 2026-11-04). Free tier covers up to 100,000 requests/month for delivery. Source, read 2026-11-04.
What Fastly does not do
- Bot Management is not available on the Essential platform for Next-Gen WAF (Bot Management docs).
- No native per-crawl billing; charging relies on TollBit (Fastly-TollBit blog).
- No public price for bot products (pricing page).
- Fastly does not sell Bot Management on its own; Full-Site Delivery or Streaming Delivery is a prerequisite.
Documented facts
- Primary source Fastly Bot Management identifies bots and reduces unwanted bot activity; the Essential platform for Next-Gen WAF does not support Bot Management. Source, read 2026-11-04.
- Primary source Bot Management deployments can optionally add client challenges and advanced client-side detections. Source, read 2026-11-04.
- Vendor claim Fastly says AI Bot Management lets sites detect, block, deceive or allow AI bots, and allow, throttle, monitor or block requests. Source, read 2026-11-04.
- Primary source Fastly exposes separate signals SUSPECTED-BOT.AI-CRAWLER, SUSPECTED-BOT.AI-FETCHER, VERIFIED-BOT.AI-CRAWLER and VERIFIED-BOT.AI-FETCHER. Source, read 2026-11-04.
- Primary source With the TollBit integration Fastly classifies an AI bot and redirects it to the publisher's TollBit Bot Paywall instead of blocking; bots with valid TollBit tokens get the content. Source, read 2026-11-04.
- Vendor claim The AI Bot Management page mentions ContentGuard for pre-cache inspection. Source, read 2026-11-04.
- Primary source Bot Management, Next-Gen WAF and the Security Core packages are contact-sales only; the free tier covers up to 100,000 requests a month. Source, read 2026-11-04.
- Primary source On 10 Jun 2026 Fastly and Skyfire partnered to bring Skyfire's identity and payment-backed agent credentials to Fastly's edge. Source, read 2026-11-04, dated 2026-06-10.
- Primary source On 21 Sep 2026 Fastly launched AI Firewall (prompt-injection filtering before models) and AI Runtime Control (routing, token spend, rate limits and budgets for model calls). Source, read 2026-11-04, dated 2026-09-21.
- Vendor claim Fastly reported AI requests grew about 6.5 times faster than human traffic in the first months of 2026. Source, read 2026-11-04, dated 2026-06-09.
Dated news
- 2026-09-21Fastly launches AI Firewall and AI Runtime Control. Fastly added AI Firewall, which inspects prompts in the request path to stop attacks such as prompt injection, and AI Runtime Control, which routes model calls and manages token spend, rate limits, budgets and failover. Fastly positions both next to Bot Management for agent traffic. Source.
- 2026-10-14Fastly named a Leader in 2026 IDC MarketScape for WAAP. Fastly announced it was named a Leader in the 2026 IDC MarketScape for Worldwide Web Application and API Protection platforms, which covers bot management among other capabilities. Source.
Compared with
- Fastly vs Cloudflare: Fastly exposes separate signals for suspected and verified AI crawlers and AI fetchers and redirects to a TollBit paywall; Cloudflare runs its own pay per crawl and per-purpose Search, Training and Agent controls.
- Fastly vs Akamai: Both route AI bot charging to TollBit, and both partner with Skyfire (Fastly 2026-06-10, Akamai 2026-06-15); Akamai documents Web Bot Auth verification and Visa TAP, Fastly docs read did not.
What Fastly does for this layer
From the vendor's own pages
Fastly's client fingerprinting uses JA3 and JA4 TLS fingerprints to identify client types. (docs.fastly.com, dated 2026-10-13) Fastly's client challenges come in dynamic, interactive and non-interactive forms; dynamic challenges can use Private Access Tokens and non-interactive ones use a JavaScript proof-of-work. (docs.fastly.com, dated 2026-10-13) Bot operators apply for Fastly's Verified Bot categories through a submission form on community.fastly.com. (docs.fastly.com, dated 2026-10-13) Fastly's VCL variable fastly.bot.category.is_verified reports whether a detected bot is a self-identified bot that Fastly has validated. (fastly.com)
Claims the vendor makes about itself
Fastly's AI Bot Management page offers to block, intercept or deceive verified or suspected AI bots that scrape content without consent. (fastly.com)
Products and plans
| Product | What it does | Price model | From | As of |
|---|---|---|---|---|
| Bot Management | ContentGuard edge detection, client fingerprinting, client challenges, advanced client-side detections and verified bots. | contact sales | Not published | 2026-11-05 |
| Next-Gen WAF AI bot signals | SUSPECTED-BOT and VERIFIED-BOT signals for AI crawlers and AI fetchers usable in lists, rate limit rules and request rules. | |||
Standards
| Standard | Status | Evidence |
|---|---|---|
| Web Bot Auth | No statement | The Bot Management product description (updated 2026-10-13) does not mention Web Bot Auth or HTTP message signatures. |
| Visa Trusted Agent Protocol | No statement | No statement found in the Fastly docs read 2026-11-05. |
| Mastercard Agent Pay | No statement | No statement found in the Fastly docs read 2026-11-05. |
Our checks
| Check | Result | Method | Date |
|---|---|---|---|
| Homepage fetch | HTTP 200 | GET with the crawl user agent after a robots.txt check | 2026-11-05 |
Related pages on this site
Sources
- fastly.com: fastly.com
- fastly.com: pricing
- fastly.com: how to control and monetize ai bot traffic using fastly and tollbit
- investors.fastly.com: fastly and skyfire partner enable trusted agentic commerce
- fastly.com: fastly ai bot management
- fastly.com: about bot management
- fastly.com: fastly launches ai firewall and ai runtime control to secure and scale ai
- businesswire.com: AI Traffic Grew 6.5x Faster Than Human Traffic This Year Creating New Business Challenges and Opportunities
- fastly.com: fastly named a leader in 2026 idc marketscape for worldwide waap platforms
- New Bot Signals: SUSPECTED-BOT.AI-CRAWLER, VERIFIED-BOT.AI-CRAWLER, SUSPECTED-BOT.AI-FETCHER, and VERIFIED-BOT.AI-FETCHER | Fastly Documentation
- Using system signals | Fastly Documentation
- Bot Management | Fastly Products
- fastly.bot.category.is_verified | Fastly Documentation
Last reviewed 2026-11-05