Yesterday I was joining a session organised by Cloudflare. These are the input that may benefit all of us.

This session highlights steady global traffic growth, rising attack intensity, and accelerating adoption of new encryption and AI-related behaviors across the Internet. ​

Overall Internet growth and popular services

Global Internet traffic grew by just under 20% in 2025, following a familiar pattern of modest growth early in the year, then stronger increases from May and especially from late August onward. ​

The ranking of most-used Internet services remains very stable: Google leads, followed by Facebook, with Apple and Microsoft next, then major social platforms like Instagram, YouTube, TikTok, and services like AWS, Amazon, and WhatsApp in the top 10. ​

A new generative AI category shows OpenAI/ChatGPT at the top, followed by Claude, Google Gemini, Grok, and others; these AI services are growing quickly but still sit below the very largest “traditional” platforms in overall usage. ​

Category trends: crypto, finance, and bots

Cryptocurrency remains heavily used but relatively less volatile at the top; exchanges such as Binance, OKX, and Coinbase continue to dominate, alongside information and tracking sites. ​

In financial services, Stripe ranks first, with strong representation from Asia-Pacific (for example Alipay) and Brazilian players like Nubank and Banco do Brasil, plus wallets such as Google Pay and some crypto payment platforms. ​

Around 40% of global bot traffic originates from the United States, with other major sources including Germany, Singapore, the Netherlands, Ireland, and China, closely matching where large cloud regions are located. ​

Major cloud providers’ networks (Amazon, Microsoft, Google and others) generate much of this traffic; Cloudflare stresses that a significant portion are “good” or verified bots such as search crawlers, performance monitors, and rendering systems, not just malicious automation. ​

Security: DDoS, email attacks, and AI crawlers

DDoS attacks increased sharply in 2025, with peak attack size growing in “steps” over the year and culminating in a record of about 31 terabits per second after earlier peaks near 29.7 Tbps. ​

Speakers express concern that, as more insecure IoT and consumer devices (e.g., cameras, Android TV boxes, “smart” appliances) and even corporate devices are connected, attackers can build ever-larger botnets, potentially pushing future peaks even higher (they discuss the possibility of 60 Tbps raids). ​

Cloudflare’s email security data shows over half (around 52%) of malicious emails containing deceptive links that visually imitate trusted destinations but redirect to phishing or malware sites. ​

Other leading email threats are identity deception and brand impersonation, where attackers pretend to be a known individual or brand (for example, gift-card scams or fake vendor notices), exploiting user trust and psychological pressure rather than purely technical weaknesses. ​

AI-related crawlers are now a visible share of web traffic; Googlebot (used both for search indexing and AI training) accounts for far more traffic than other AI crawlers, while OpenAI uses distinct bots (GPTBot for training, ChatGPT-User for live requests, OAI-Search for retrieval) that can be differentiated by purpose. ​

Encryption and post-quantum readiness

Cloudflare has been working on post-quantum (PQ) encryption since around 2017, motivated by the “harvest now, decrypt later” risk that future quantum computers could break today’s TLS and expose long-retained encrypted traffic. ​

Post-quantum–protected traffic roughly doubled in 2025: it began near 27%, plateaued midyear, then jumped sharply when Apple enabled PQ support by default in its 2026 OS and Safari releases, pushing support from the high 30s to over 50% and then to above 60% of observed traffic. ​

Adoption is driven mostly by modern browsers, OS updates, and infrastructure platforms; older Android devices, older browsers, and embedded/IoT devices (like appliances) often cannot be upgraded and thus lag behind, leaving a substantial fraction of traffic non–post-quantum-safe. ​

Speakers expect 2026 to bring more concrete PQ deployments rather than just discussion, with particular emphasis on sectors holding sensitive data such as finance, healthcare, and government, while noting that not every low-risk device or dataset needs equal protection. ​

Geography, sectors, and future outlook

Country-level views show that even highly connected places can still experience very strong usage growth; for example, Singapore’s Internet traffic grew by roughly 50% year over year, with notable changes around June linked to local events such as elections and holiday behavior. ​

Vertical/industry analysis of Layer 7 attack traffic shows that “People and Society” organizations (including many protected under Cloudflare’s Project Galileo) are heavily targeted globally, alongside sectors like gambling, gaming, computers and electronics, and education in specific countries. ​

Starlink-related traffic tracked by Cloudflare has roughly doubled over the last year and is appearing in more countries, reflecting the rise of satellite connectivity. ​

Looking ahead, the speakers anticipate:

Continued growth in DDoS attack size and frequency, fueled by insecure devices and faster consumer connections.

Much broader post-quantum readiness as more OS/browser vendors and infrastructure providers ship PQ by default.

Rapid shifts in generative AI usage and AI-crawler behavior, with a mindset change from “all bots are bad” to assessing the purpose and impact of each bot in a machine-to-machine Internet.