Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Alastair Parr, CTO, Spur
In 2026, AI will change not just how people interact with the internet, but how the internet behaves beneath them. Automated systems will generate more activity on behalf of users, and the infrastructure carrying that traffic will become harder to classify or trust. These shifts will alter how organizations interpret behavior, manage risk, and verify the integrity of the sessions reaching their platforms. The predictions below highlight where these changes will surface first.
AI-Driven User Journeys Will Outpace Traditional Detection Approaches
AI agents will begin performing user journeys – from account creation and management to purchasing and engaging directly with various platforms. This will introduce a layer of automated service-to-service traffic that seamlessly blends into normal patterns while operating at scale and speed, which traditional controls struggle to detect or validate. Many of today’s defenses for spotting cookie and session replay attacks will fail as these agents coordinate activity across distributed environments. Organizations will need new ways to verify automated actions and to identify when AI activity routed through residential proxy networks is malicious.
Residential Proxy Networks Will Become an Invisible Layer of AI Infrastructure
Residential proxy networks will increasingly sit underneath AI-driven tools that require broad data access or steady, real-time connectivity. These networks often draw from ordinary consumer devices – TVs, phones, and apps – that quietly contribute bandwidth without users realizing it. As AI systems increasingly rely on these distributed paths, the volume of traffic originating from residential connections will grow and become more difficult to distinguish from normal user activity. This expansion will renew questions about how these networks are sourced, the degree of consumer consent involved, and the ease with which bad actors can abuse them for scraping, fraud, and high-volume automated operations.
Passive Security Will Become a Core Requirement for Reducing User Friction
Organizations are making efforts to reduce CAPTCHA usage, repeated logins, and other controls that aren’t user-friendly and slow down conversions. As security teams work to reduce user friction, they will rely more on passive signals – such as location integrity, network quality, and obfuscation checks – to determine who gets an easier path with less friction and which sessions require targeted verification.
Accurate Geo-Verification Will Rise to the Forefront of Compliance and Risk Management
Companies in regulated industries will face greater pressure to verify the geographic location of users, not just where the IP address appears to indicate they’re located. As it becomes easier for users to hop resources and mask their location, teams will require precise real-time geographic signals to enforce gaming rules, Office of Foreign Assets Control (OFAC) restrictions, financial controls, content streaming restrictions, and state-based consumer protections. Geo-resilience will shift from a background check requirement to a priority on the front line for security and compliance.
The themes spanning these predictions point toward an internet where automated agents act on behalf of people, and where residential devices form a significant layer of the traffic powering modern applications. Security, risk, and compliance programs will need to adapt quickly to this reality. Gaining visibility into the true origin and intent of traffic – human or automated, commercial or consumer-sourced – will be essential. The organizations that can pair passive trust signals with accurate geographic and behavioral insight will be in the strongest position to protect users, reduce friction, and navigate an environment increasingly defined by AI-driven activity.
##
