BOTS. DDoS. Defending the Autonomous Internet.

Most internet traffic today isn’t human.

Cyberattacks are no longer just human vs human. They are increasingly machine vs machine. I sat down with **Michael Tremante (Cloudflare)** to discuss the latest:

• 1️⃣SPEED: #Vulnerabilities exploited within 22 mins.
• 2️⃣SCALE: Record 31.4Tbps #DDoS attacks (#Aisuru botnet).
• 3️⃣STEALTH: Millions of #IoT devices silently weaponised.
• 4️⃣SERVICE: #Cybercrime becomes DDoS-as-a-Service.

We are entering a new phase of AUTONOMOUS INTERNET — where machines increasingly interact, defend, and attack beyond human oversight.

It is no longer just stopping a “hacker.” It’s understanding intent, automation, and identity in a world, where we are no longer the primary actors.

[embed]

00:46 — Intro — Cyberthreats — Stolen Credentials

• 01:24 — Weakest link is still the human
• 01:46 — AI social engineering is accelerating
• 02:13 — Traditional attacks continue — at greater scale

02:55 — Flaws exploited in 22 minutes?

• 03:17 — Early warnings of vulnerabilities enabled by large network monitoring & threat research
• 03:45 — And collaboration with researchers and ethical hackers (e.g. bug bounty)
• 04:12 — CVEs exploited as fast as 22 minutes after proof-of-concept published
• 04:43 — Researchers published sample attack code; Exploits used by attackers within 22 minutes.

05:14–22 minutes to prepare for defense?

• 05:38 — CVEs (Common Vulnerabilities and Exposures)
• 05:50 — Thousands of new Common Vulnerabilities and Exposures (CVE) tracked
• 05:57 — More software, more vulnerabilities/ bugs for attackers to exploit

06:09 — DDoS attacks in numbers: 29.7 Tbps

• 07:08 — Aisuru breaking records with ultrasophisticated, hyper-volumetric DDoS attacks
• 07:26 — Aisuru botnet sets new record with 31.4 Tps DDoS attack
• 07:37 — Without DDoS protection, large attacks can take sites offline

07:58 — What is AISuru botnet?

• 08:08 — AIsuru botnet compromises millions of smart devices

08:18 — How Botnets like Aisuru are turning Smart Devices into Cyber Weapons

• 08:25 — Botnets have grown stronger: more devices, & each device is more powerful.
• 08:43 — AIsuru : available for sale on the darkweb

09:02 — What is the Aisuru-Kimwolf botnet?

• 09:17 — New DDoS botnet: AIsuru: Kimwolf — more difficult to detect
• 09:32 — Digital transformation fuelling botnets?
• 09:47 — Certain Android TVs reportedly ship with built-in malware

10:15 — Future evolution of Botnets?

• 10:35 — Cloudflare’s 2025 Q3 DDoS threat report
• 10:57 — Inside the infamous Mirari IoT Botnet: A Retrospective Analysis
• 11:05 — Hacking is now organized, funded, AI-enabled.
• 11:39 — Early botnets lacked strategy and attacked randomly.
• 11:56 — Attacks are now strategic, not indiscriminate.
• 12:15 — DDoS attacks on AI firms surge 347%
• 12:25 — One example: Financial firms — target for ransom.

12:35 — What is a ransom DDoS attack?

• 12:51 — Botnets sold as services to cybercriminals.
• 12:57 — DDoS-as-a-Service open for business
• 13:19 — State-backed botnets turn attacks into cyber warfare

13:27 — DDoS risk for everyday user?

• 13:58 — Cyber awareness is key
• 14:27 — Smart devices may hide malware, silently participating in botnets.

14:57 — “Good” vs “Bad” bots?

• 15:02 — Cloudflare Radar — Bot vs Human traffic
• 15:44 — Most internet traffic today is automated bots, not humans.

16:28 — Cybersecurity in the “Autonomous Internet” era?

• 16:48 — Old cyber defenses still matter — but need upgrading
• 17:12 — Today’s priority: detecting intent, automation, identity. Understand who is accessing your systems — and why
• 17:50 — Beyond bots vs humans: detecting the many bot types and AI agents

18:13 — Understanding bot’s intent?

• 18:22 — Identify bot intent via its behavior /action (e.g. scraping)
• 18:59 — Other examples: account takeovers & inventory hoarding (bots fill carts to block real buyers).
• 19:24 — Tracking machine behavior /actions to detect anomalies?
• 19:36 — Each industry faces different attacks. Detection must be tailored
• 20:17 — Building trusted agent directory for safe website access.

21:04 — Tips for building resiliency?

• 21:22 — Continuous innovation is essential to stay ahead of cyber threats

Michael Tremante, VP of Product for Application Security & Threat Intelligence

Michael Tremante joined Cloudflare in 2015 as a Solutions Engineer and has since held roles including Product Manager. He is currently the Senior Director of Product, responsible for a number of core application security products offered by Cloudflare. Prior to joining Cloudflare, he served as Technical Director at Spesati, an Italian online-only grocery platform. Michael holds a BSc (Hons) in Computer Science from the University of Bath.

Recorded (virtual) — 4th March 2026 (Singapore, UK).