What’s a Bot?

A bot is a program that does a task on its own, over and over, faster than a person could. That covers the search engine crawler that indexed this page, the chat assistant on a support site, and the software that tried to sign in to your Microsoft 365 account four thousand times last night with passwords from a stolen list. The word is the same; the intent is not. This article explains what bots are, which ones you want, which ones you do not, and how the bad ones reach a small business.

The bots you want

Most of the internet runs on bots. Google’s crawler reads websites so search works. Monitoring bots check that your website and servers are up and raise an alarm when they are not. Backup jobs, patch installers and the agent that reports a failing hard disk to your IT provider are all bots in the plain sense. Chat assistants and AI agents that answer questions, draft email or move data between systems are the newest kind, and a growing number of businesses now run their own.

These bots are welcome, but they still need rules. A monitoring bot needs a login, an AI assistant needs limits on what it can read and do, and every automated account needs to be owned by someone who will notice when it misbehaves.

The bots you do not want

Credential-stuffing bots

When a website is breached, the email addresses and passwords end up in lists. Bots take those lists and try them everywhere: Microsoft 365, Google, your bank, your accounting system. Because people reuse passwords, a meaningful share of attempts succeed. This is the single most common bot attack on small businesses, and multi-factor authentication stops nearly all of it; our guide to setting up multifactor authentication covers the how.

Spam and phishing bots

The phishing email that looks like a password notice was assembled and sent by a bot to millions of addresses. So was the form submission on your website offering SEO services, and the fake “new voicemail” message with an attachment. Bots also scrape websites for email addresses to feed the next campaign, which is one reason we do not publish staff email addresses on this site.

Scrapers and scanners

Some bots copy content and prices from websites; others scan every address on the internet for a remote desktop port, a VPN with a known flaw or a camera with a default password. The scanners are not personal. They find whatever is exposed, and what they find is sold to whoever wants to break in.

Botnets

A botnet is a crowd of infected computers, phones, cameras and routers under one criminal’s control. Each device was infected with malware that made it a bot; together they send spam, attack websites, mine cryptocurrency and hide the criminal’s own traffic. A small business computer can join one without anyone noticing. The only symptoms may be a fan that runs at idle, a machine that is slow for no reason, and eventually a notice that your company’s email has been blacklisted for sending spam.

How bots reach a small business

• Through logins. Any account without a second factor, reachable from the internet, will be tried by a bot eventually. Microsoft 365 accounts are tried constantly.
• Through email. Attachments and links delivered by bots install the malware that makes the next bot.
• Through exposed equipment. Remote desktop open to the internet, a firewall that has not been updated in years, a camera or printer with the factory password.
• Through websites. Contact forms without protection fill your inbox; an unpatched WordPress site becomes a bot itself.
• Through people. Bots write the bait; people take it. See what social engineering is for how the human part works.

AI made bots better at pretending

Until recently, bot-written email was easy to spot: odd grammar, generic greetings, one message for everyone. Language models removed that tell. Phishing is now written fluently, personalised from LinkedIn and your website, and produced at a scale that would have needed a room of people. Voice bots can call your accounts payable clerk with a convincing imitation of a supplier. The defences below have not changed, but the margin for error has shrunk.

Keeping your computers from becoming bots

1. Multi-factor authentication on every account, especially email and remote access. It defeats credential stuffing outright.
2. Endpoint detection on every computer and server. Antivirus catches known bots; managed detection and response adds people who notice the unknown ones and isolate the machine.
3. Email security in front of every mailbox, so most bot-sent mail never arrives, and SPF, DKIM and DMARC records so bots cannot send as your domain.
4. Patching on a schedule, including the firewall and anything with a web page, because scanners find the unpatched.
5. Nothing exposed that does not need to be: remote desktop behind a VPN, default passwords changed, cameras and printers on their own network.
6. Training with simulations, so the person who receives the well-written bait knows what it is. Try our phishing quiz to see how good the bait has become.

What to do if a computer is already a bot

Disconnect it from the network, do not turn it off, and call whoever handles your IT. Turning it off destroys evidence of what it was doing and where it was reaching; isolating it keeps the evidence and stops the spread. A proper response finds how it got in, checks the other machines, and changes every password that was used on it. Our managed cybersecurity services include that response as part of the plan.

Common questions

Is a bot the same as a virus?

No. A bot is any automated program. Some are useful, such as search engine crawlers. A virus is malware that spreads itself. The overlap is the botnet: malware that turns an infected computer into a bot under a criminal’s control.

Are chatbots and AI assistants bots?

Yes, in the plain sense of the word: they are software that responds automatically. The risk with them is different, though. It is less about infection and more about what your staff paste into them and what the assistant is allowed to do on your systems.

How do I know if my computer is part of a botnet?

A fan that runs at idle, a computer that is slow for no reason, outbound traffic when nobody is using it, or your email provider reporting that your address is sending spam. Endpoint detection software sees the hidden process; a person usually only sees the symptoms.

Can bots be blocked completely?

Not completely, because the good ones are welcome and the bad ones imitate them. The practical goal is different: make sure a bot cannot log in without a second factor, cannot install itself on your computers, and cannot send email as your company.

Talk to us

If you suspect a computer in your office is doing work for someone else, we will check it and the rest of your network. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.