By Lester Laine · October 2026
Most ABM programs decide which accounts are in market from engagement: visits to key pages, email clicks, reactions to posts, profile views. The more of these an account produces, the higher it scores and the sooner sales gets an alert.
Research on web traffic, email security and social platforms points to a problem with that logic. A growing share of the activity that feeds those scores comes from bots, from AI agents researching on a buyer's behalf, and from the security software that inspects corporate email.
Below is what the data shows for each channel, where each source stops, and how I would rebuild account scoring so that a machine can't push an account into the sales queue on its own.
Thales's 2026 Bad Bot Report, built on the bot mitigation activity of its Imperva business, found that automated traffic made up 53% of all observed web traffic in 2025, up from 51% the year before. Bad bots accounted for 40% of all traffic and benign automation for 13%. Human activity was 47% (Thales, 2026).
The growth rates point the same way. HUMAN Security, which analyzed more than one quadrillion digital interactions in 2025, reported that automated traffic grew 23.51% during the year while human traffic grew 3.10%. Traffic from AI agents and agentic browsers grew 7,851% year over year (HUMAN Security, 2026). That last figure is a growth rate, not a share of traffic, so it says more about direction than about volume.
Thales adds that the daily volume of AI-driven bot requests it blocked rose from 2 million to 25 million over 2025, and that a much larger part of AI-driven automation remains unverified (Thales, 2026).
My reading for ABM: reverse-IP tools resolve a visit to a company, not to a person, and a corporate network sends traffic from crawlers, monitoring tools and assistants as easily as from a buyer. A pricing-page visit from a target account is now something to check, not something to act on.
Forrester's Buyers' Journey Survey of nearly 18,000 business buyers found that 94% use AI during their buying process. The same research counts, on average, 13 internal stakeholders and nine external participants influencing a purchase (Forrester, 2026).
Some of the activity an ABM platform records is therefore real research done by software for a person. It carries interest, but no name, no role and no stage. An account can look busy because one analyst asked an assistant to compare five vendors, while the other people who decide the deal haven't engaged at all.
This is a different problem from fake traffic. The signal is genuine. What it can't tell you is who in the buying group is behind it, or whether that person has any say in the decision.
Email clicks are a common trigger in ABM sequences. Microsoft's documentation for Safe Links in Defender for Office 365 explains how a click can happen without a person: while the feature is on, URLs are scanned before the message is delivered, and URLs without a valid reputation "are detonated asynchronously in the background" (Microsoft, 2026).
Microsoft is one vendor among several. Omnivery, an email deliverability company, describes secure email gateways such as Proofpoint, Mimecast and Barracuda routinely following the links in inbound messages before the recipient sees them (Omnivery, 2026).
My reading: a click from a corporate domain that lands seconds after delivery, or a click on every link in the same message, tells you more about the recipient's security stack than about their interest. Treat it as proof of delivery, not as engagement.
LinkedIn's User Agreement prohibits using bots or other unauthorized automated methods to comment on, like, share or re-share posts, or otherwise drive inauthentic engagement (LinkedIn, 2025). In March 2026, LinkedIn said engagement pods and automated comments aren't allowed, that it limits the reach of inauthentic activity, and that it may restrict members who take part (LinkedIn, 2026).
Enforcement confirms the behavior exists. It doesn't show how much of it gets through. Academic research explains why detection is hard. Studying a network of 1,140 accounts that used ChatGPT to post and to reply to and amplify each other on Twitter, Yang and Menczer found that state-of-the-art classifiers for AI-generated content failed to tell those accounts apart from humans. What exposed them was their coordination patterns (Yang and Menczer, 2024).
For ABM, that is the useful part. Reading a comment won't tell you whether a person wrote it. The pattern can: who engages, how often, alongside whom, and whether that person belongs to the buying group of an account you target.
This is how I would translate the evidence into account scoring. These are recommendations, not findings.
| Area | Measure | Move to the appendix |
|---|---|---|
| Signal quality | Share of engagement events marked unverified, by channel | Total engagement events |
| Qualification | Share of in-market accounts with two independent channels and a named buying-group person | Accounts above an engagement score threshold |
| Own automation | Reactions inside the exclusion window after automated touches | Connection accept rate counted as interest |
| Conversion | Meetings held per in-market account, by signal combination | Email click rate |
| Speed | Hours from verified signal to first human touch | Alert volume sent to sales |
Each source measures something different, so it's worth being precise about what they show.
None of these sources measures how much of the engagement inside an ABM platform comes from machines. The link between internet-wide automation and account scoring, and the scoring model above, is my interpretation.
I was recently invited to work as an expert reviewer on a project that trains AI models on revenue operations work. The brief is to review realistic material built from RevOps practice, such as opportunity exports and forecast snapshots, and flag whatever doesn't look like real work. It's the same skill account scoring now needs: noticing when data is too clean, too fast or too consistent to come from people.
Much of my client work starts inside the CRM: cleaning the pipeline, defining stages that mean something and making the forecast something leadership can trust. Scoring breaks the same way stages do, when nobody has written down what counts. In the SCALING™ method, that sits in the Integration pillar, which sets what counts as qualified, who works it and how fast. For buying groups that barely use LinkedIn, social engagement can't be the signal at all, which I covered in Off-Grid ABM.
The Signal Verification Kit includes the HubSpot property set that separates engagement from verified intent, the two-channel qualification rule with the exclusion windows for email scans and for your own automation, and the scorecard above, ready to copy into a dashboard.
Send me a message on LinkedIn with the word SIGNAL and I'll send it right away.