Cloudflare launches precursor to strengthen bot detection through continuous behavioural analysis

Cloudflare has announced the general availability of Precursor, a browser-based behavioural validation engine designed to help organisations detect increasingly sophisticated automated bot traffic without relying on traditional CAPTCHA-based verification.

The launch comes as automated traffic continues to grow across the internet. According to Cloudflare, bots now account for about 57% of all web requests, overtaking human-generated traffic. The company said this shift is being driven by the increasing use of AI agents and advanced automation, creating new challenges for organisations trying to protect applications, user accounts and online services.

Unlike conventional security checks that validate users at a single point in time, Precursor continuously analyses browser interactions throughout an entire session. The platform evaluates behavioural signals such as mouse movement, scrolling patterns, typing cadence, clipboard activity and page visibility to distinguish human users from automated scripts.

Cloudflare said the system is designed to identify bots that can bypass one-time security checks but struggle to consistently replicate human behaviour over longer browsing sessions. The company added that behavioural data is collected in aggregate rather than recording user inputs, with keystrokes measured only through timing and cadence instead of capturing the actual content typed.

The service can be enabled through a single configuration setting and does not require changes to application code. Cloudflare injects a lightweight script through its network to collect browser telemetry, which is then analysed in real time to identify patterns associated with automated activity.

Unlike traditional bot protection mechanisms that evaluate each request independently, Precursor maintains behavioural analysis across an entire browsing session. According to the company, this allows security systems to continuously update a visitor’s bot risk score instead of restarting validation each time a page is refreshed.

Commenting on the launch, Dane Knecht, Chief Technology Officer at Cloudflare, said conventional security mechanisms are increasingly ineffective against modern bots that can imitate isolated user actions. He said analysing behaviour across an entire session provides greater visibility into automated activity while reducing friction for legitimate users.