Darwinium Network Insights: What 5.4 Billion Events Tell Us About The Importance of Intent Intelligence

Knowing who, or what, is interacting with your business is no longer enough. Intent Intelligence is the new path forward.

Traffic might be a genuine customer, that same customer on a new device, legitimate automation, an AI agent, or a fraudster using stolen credentials. It's a version of a mystery Scooby-Doo and the crew solved long ago: the mask looks convincing right up until you pull it off. Identity alone doesn't reveal intent: a recognized device can still behave unexpectedly, and valid credentials can still be used fraudulently. A layered approach with Intent Intelligence is the future of fraud prevention.

This is the first in a regular blog series aimed at sharing what we're learning across the Darwinium network. Since May 2025, we've analyzed 5.4 billion events across more than 3 billion digital journeys, spanning 1.26 billion devices and 66 million customer identities. Monthly volume has roughly doubled, from 185 million events in May 2025 to about 370 million in August 2026.

A note on the data: The data reflects anonymized activity across Darwinium customers, shaped by each one's traffic mix, integration method, and risk appetite. We use "actionable" login to mean one resulting in a reject, review, alert, or challenge, not confirmed fraud, since fraud-label coverage varies by customer.

AI agents make that distinction harder

Thus far, we've already identified more than 30,000 logins tied to agentic activity, with prevalence varying widely: over 5% of logins in some booking- and search-heavy environments like airlines, versus 0.5-1% elsewhere.

That share is growing fast across the network, and it's also measurably riskier: agentic transactions are rejected roughly 9x more often than other transactions, echoing the same kind of gap we saw between web and SDK logins above, and one worth watching heading into the holiday shopping season.

Just as notable, only about 1 in 4 agentic transactions self-declare, with Claude Desktop ranking as the largest self-declaring agent we currently see. That's not necessarily deliberate concealment (agent detection is still evolving), but it suggests self-declaration alone won't be enough. Even perfect self-identification wouldn't solve the problem: an agent searching for a flight, one accessing an authenticated account, and one initiating a high-value payment all deserve different trust decisions, even though all three are legitimately "agents."

Not all logins carry the same context

Login is nearly universal, but what happens next depends heavily on channel. Roughly 23% of web logins were actionable versus about 2.5% of SDK (app) logins, more than a 9x gap.

That doesn't mean web is inherently riskier; SDK traffic often carries richer native context and reflects established app relationships, while automated traffic tends to concentrate on the web. But it does show web logins generating a disproportionate, and growing, share of intervention: actionable web logins rose roughly 3x between the end of Q1 and Q2 2026.

Automation is becoming an intent problem

The more interesting finding isn't how many bots we detect: it's how much traffic doesn't behave like a conventional browser session at all.

Around 20-30% of web login interactions couldn't be profiled using JavaScript, and of the bots we did identify, only about 1 in 6 arrived in a way that allowed normal profiling.

Much of this traffic uses headless infrastructure or makes requests directly, bypassing the browser environment entirely. That changes the question: knowing something is automated doesn't tell you whether it should be stopped, since two automated interactions can look identical at entry while pursuing very different outcomes.

The more useful question is what an entity is doing, and whether that's consistent with what you want to allow. Sometimes the most telling signal isn't suspicious activity: it's the absence of telemetry you'd normally expect.

Identity + behavior + context give a better view of intent

Together, these findings point to a broader shift: digital trust won't be solved by another identifier or classification.

Fraud and intent rarely reveal themselves at a single checkpoint:

• A device from a suspicious account creation may resurface at login
• An account that looks legitimate at authentication may behave differently once inside
• And automation that looks benign during search can matter at checkout

An individual event tells you little; the sequence around it tells you much more. Darwinium observes overlapping journeys across web, app, and API, using device and behavioral signatures to recognize similarity over time rather than relying solely on deterministic identifiers.

• A new device shouldn't automatically mean a stranger
• A recognized device shouldn't automatically mean trust
• And an AI agent shouldn't automatically be trusted just because it identifies itself.

The better question: given everything we know about this entity's history and behavior, should we trust what it's trying to do right now?

What is Intent Intelligence, and why does it matter?

Intent Intelligence is the ability to continuously understand what a user, bot, or AI agent is trying to do across a digital journey, built from how they behave and the path they take, not just the credentials they present. Every step, not one checkpoint. Every transaction, whether from a human, bot or agent, in one model.

While traditional fraud prevention focuses on establishing who is interacting with a business, Intent Intelligence goes a step further to understand why they are acting, what they are attempting to achieve, and how their behavior changes over time.

By connecting device, behavioral, identity, and journey-level signals in real time at the edge, Intent Intelligence helps organizations distinguish legitimate customers and authorized AI agents from malicious automation, account takeover attempts, scams, and other emerging threats.

Why does this matter? Because knowing who someone is doesn't necessarily tell you whether their actions can be trusted. As digital interactions become increasingly complex, particularly with AI agents acting on behalf of humans, businesses need to understand intent throughout the entire customer journey, not just at login or the point of transaction.

Intent Intelligence makes it possible to identify emerging risk earlier, intervene more precisely, and protect customers without introducing unnecessary friction.

What we're watching next

This is only a first snapshot. As the network grows, the most valuable insight won't be absolute numbers but how they move: the web/SDK intervention gap, the growth of non-profileable automation, where agentic activity appears first, and whether self-declaration improves over time.

The biggest open question is what happens as AI agents move deeper into authenticated journeys: accessing accounts, managing personal information, initiating payments. At that point, human-versus-automated won't be enough, and neither will identity alone.