Andy Still has spent nearly 30 years keeping high-traffic websites standing, starting in rock and pop ticketing before there was a cloud to scale into. Today he is CTO and Co-Founder of Netacea, a bot and agent trust platform. In this episode of the Smooth Scaling Podcast, Andy walks host Jose Quaresma through what automated traffic actually costs, from autoscaling bills and stolen loyalty points to skewed analytics that steer a business toward the wrong decisions. His starting point: bots are still a performance and availability problem as much as a security one. He gets into how cheap it has become to launch a bot attack (commercial tools with support agreements, up and running in about an hour) and why detection is now an AI-on-AI arms race, before the harder question of telling a real fan's AI agent from a scalper bot when the requests look alike. Then the data from one early-access event, where the share of visitors flagged as malicious rose from 17% entering Queue-it's waiting room to 59% leaving it, and what that says about time as a detection signal. A practical, technical look at what bot traffic costs and how you actually tell it apart.
Andy Still is CTO and Co-Founder of Netacea, a leading bot and agent trust platform giving enterprises complete control over their web traffic. Andy has nearly 30 years of experience working with the world's largest retailers and ticketing providers to operate the most demanding events online. Beyond his focus on how automated traffic, including AI agents, interacts with digital services, he's also the author of Web Performance Warrior (O'Reilly) and previously ran the Web Performance Group North UK.
Episode Transcript
Jose:
Hello and welcome to the Smooth Scaling Podcast, where we speak with industry experts to uncover how to design, build and run scalable and resilient systems. I'm your host, José Quaresma, and today we had the pleasure of talking to Andy Still, who's the CTO at Netacea. We had a great conversation with Andy, where we started with his journey in performance engineering, capacity planning and the focus on working with bot detection and mitigation. We also discussed how AI is having a huge impact in this field on both sides of the fight. And finally, on how time and the virtual waiting room can be used as a tool in fighting advanced bots. If you like this episode, please subscribe and leave a review. It really helps the podcast. Enjoy.
Andy, welcome to the podcast.
Andy:
Thanks, Jose. Good to see you.
Jose:
And good to see you too. And I would actually like to start straight in with your origin story. I know that you've worked with high-traffic websites all the way back in 1998, and you wrote a book on web performance. I would like to hear a little bit about that initial part of your career. And then also, how did a performance engineer like you then end up fighting bots?
Andy:
That's a good question. It's a long and complex story. So, yeah, my background was web development, but particularly in rock and pop ticketing. So we was always in a situation where there were far more people who wanted the product that we were selling than we had capacity to. And all this was back in pre-cloud days as well. So there was no option for scaling of systems without physically buying more servers, racking them up and rolling them out, which is a, you know, months-on process. So everything we were doing was about how can we squeeze the most possible performance out of that. And that was something that I took from my work with rock and pop ticketing to then becoming a much wider consultant in that area. So I was going out and talking to lots of companies about how they could maximise the throughput on the systems that they had, how they could optimise performance and things like that.
That led to actually getting into a similar game to yourself at Queue-it. So the concept of building a virtual waiting room, a queuing system for the times when there is just more demand than you can possibly supply. And there's no economic benefit in that situation to scaling up to be able to handle all those customers. You just have to deliver as good a performance as you can for those customers, whilst also maintaining high throughput. So that led to the development of a virtual waiting room. But what we saw quite often with customers was times when they didn't expect to be busy, and they weren't seeing actual uptick in sales or anything like that, but we were still triggering queues because there was a lot of customers there. We did some analysis and determined that actually a lot of that is just bots. It's automated traffic. We went to those customers and said, you know, if you want, we could probably stop this. How hard could it be?
And the answer was very hard, and took two years to get something that worked effectively. But that essentially was the start of the fight against bots. And, you know, ultimately it's still a performance problem. It's still an availability problem, as well as it is a security problem.
Jose:
And do you have a... was that all the way back to '98, or was that some point later that you start seeing the bots really becoming a big problem?
Andy:
It was around about 2014 when we first saw some bot activity. And then it was 2016, 2017 where we launched a dedicated bot protection product. And we've seen over that time the scope and activity of bots, as the size of a threat, has just expanded massively. You know, it was relatively kind of focused on certain very specific types of threat. Back in 2014, there was a lot of kind of scraping activity going on. And obviously in the ticket world, there was still the scalping activity. But yeah, the range of threats and the sophistication of bots is way different now.
Jose:
Yeah. And I would actually like to stay there a little bit, and maybe to double-click a bit on the bot part. And I would like to start maybe from a cost perspective, right? Can you share with us where do you see bot traffic actually costing business? So where does it show up in their bill?
Andy:
So you get some kind of very direct costs. So obviously, the more throughput that you've got on a website, the more infrastructure costs you have, and there's quite a direct correlation between those two. And obviously, when we were first engaging with, in the early days, that was very much in that area where they were just seeing a lot of traffic. They didn't know what it was, and they didn't know whether or not they wanted it, and they were paying for it. And as you, as we, as you move into the cloud era, and you know, you've got autoscaling and things, systems that do just scale up to meet demand, then you pay for that scaling. And if that demand is not delivering any benefit to you, that is a very direct cost.
There's other kind of indirect costs as well, when we get into the more kind of nefarious side of the bot world. So when we're looking at protecting accounts and compromised accounts, there's direct monetary costs there. So that could be actual credit values being stolen, it could be fraudulent orders, fraudulent refunds. Loyalty point theft is a very big... it's a difficult crime to track, and there's obviously direct costs there. Particularly when you get loyalty points and things like that, the company that those are stolen from is obviously paid out to the thief who's used them, but it's also then usually refunding the customer they've been stolen from as well. So there's a double impact on that.
So there's those direct costs. There's indirect costs associated with that as well, so the support overhead in maintaining compromised accounts and restoring those. And then you've got obviously the indirect cost, so there's brand damage. So if you have your account compromised, even if it's not the fault of that company, which, you know, isn't in this case, you still lose trust in that company. And when you get onto the scalping side as well, if you can't buy the tickets or the sneakers or the Pokémon cards that you want to buy, and you see those, they're sold out and they're already on sale in the resale markets, then again, you've lost a lifetime value of that customer, because they've gone off and bought them somewhere else or they've just lost interest in you.
So those are quite intangible benefits. So the costs associated range right from very, very direct costs to really, really indirect costs as well.
Jose:
And I think there's another component that I would like to touch upon, which is also from the capacity planning aspect. I think that one thing is planning for humans, and I think there's a behavior there, but the other one is to kind of plan for bots, right? I mean, do you see it as kind of bringing very different ways of planning to the table?
Andy:
Yeah, I mean, I think the whole subject of capacity planning is a very different world than it was pre-cloud. Now, like you say, capacity planning, you had to do a long time in advance, and then you would hit limits. Capacity planning on cloud-based systems tends to be sort of the other way around, in that there will nearly always be capacity, but you pay for that capacity. So your capacity planning then becomes less of a conversation about availability and more of a conversation about cost. But you still, as a business, need to look into: are you getting the value from that cost investment? Do you want to carry on scaling, you know, potentially infinitely, or do you want to actually draw a line somewhere, because that's the only amount you're willing to invest in this particular event? And once you've got to that point, you then can start to look at, you know, are these real customers? Are these customers that are delivering value to me? And therefore, how can I start prioritising the real customers over the non-real customers?
Jose:
I think it leads into maybe the other aspect that I wanted to talk about, which is also to come from a business forecast and analytics, right? I think we see it often with our customers that it's very important for them to understand who's in the waiting room, what is the demand in the waiting room, knowing kind of what you have for the on-sale. And with bots, that gets really... the water gets really muddy, right? So have you seen, have a feel for how often that leads to wrong decisions?
Andy:
Yeah, definitely. It's something that we see raised as a fairly common concern. Businesses are making decisions on the demand for products, and therefore they're making, you know, promotional decisions, procurement decisions based on that. And if those numbers are unreliable, then obviously they're making the wrong decisions. So yeah, removing inaccurate, skewed analytics is kind of one of the core things we quite often get involved in. And quite often it is an eye-opener to our customers when we get into some of the details and they realise that actually, we've been making kind of these decisions invalid. And sometimes we have to then take them on the journey where they're sort of arguing against, or "we don't want to stop that, because our basket figures will go right down through the floor." We'll sort of explain to them, but they're not real. You know, the figures that you're running your business on, if they're not accurate, it doesn't matter if you're hitting your target on them. You're targeting the wrong thing at that point, because they're not real people. They're not going to convert in the way that you would expect.
Jose:
That's an interesting point, right? It will make the KPI worse, but it was just an illusion to start with, right? So that's, yeah.
Andy:
That's exactly it. And sometimes you're in the situation where, you know, people's bonuses are relying on those KPIs, and therefore they're maybe not that bothered about how accurate they are. But in that place, it's the wrong KPI to look at. It's not accurate. It's not delivering business value.
Jose:
You mentioned... I would like to go a bit more towards the history of bots and the bots ecosystem. So you mentioned that you've been fighting bots over 10 years now. Can you share a little bit with us how has the ecosystem changed, and maybe end up with: what does it take to run a bot operation these days?
Andy:
Yes, it's changed massively. Back when we first got involved, the technologies being used by the bot operators were fairly straightforward, fairly limited in scope, and also fairly individually developed. Whereas if you look at the ecosystem now, there are a whole range of pre-built, commercially available products that you can use, and they operate kind of on... some of them are more or less legal than others, but they will be there. You know, they'll have support agreements. Some of them have Trustpilot ratings associated with them. So, you know, they're releasing updates constantly. So these are genuinely, you know, maintained commercial products. And they'll be combined then with kind of commercially available distributed botnets for launching your... distributing your traffic through. There's commercially available bypasses for a lot of the defences that are in place.
And, you know, as AI is coming in, those commercially available bypasses become available even faster. So if you want to launch a bot product now, it's essentially a matter of searching via Google, because a lot of this is not on the dark web. It's on the clear web. Downloading several pieces of software, combining those, downloading some data sets to target, downloading a plug-in for the software to target specific websites, plug those all in together, and you can be up and running with launching a bot attack. You know, that can be up and running within, you know, an hour or so. It is no longer a matter of being a technical expert in these things. It's a matter of being a consumer to plug these tools together.
And because the tooling is then focused on... needs to be successful, they need to stay ahead of the defences. That's where their business is. So they have to maintain that. That's how they drive their custom. So it's a very different ecosystem now, and the barrier to entry is so low. We have seen that a lot of the ransomware companies, you know, who used to specialise in building ransomware products, which they would then franchise out to other people, we've seen them starting to move into bot attacks as well, as an expansion of their range of products.
Jose:
And you mentioned AI, and of course, it's important to go into that. And you mentioned it from the perspective of kind of helping the bots perform their attacks, right? But we also have the other side of it, that it also can help you on the bot defenses, right? So how do you see that playing out? Is it one that is much harder than the other, or how do you see that balance?
Andy:
Yeah, so we've always been kind of quite AI-focused in our detection methods. When you're dealing with the amount of activity that we see on the sites we protect, and the sophistication of the attackers being able to blend in effectively with real legitimate visitors, then you can only really do that kind of processing with machine learning kind of approaches. So it's an ongoing battle, and AI has kind of accelerated it, but it's accelerated it alongside the other things we were just talking about, about the advances in attack software anyway. So it's kind of sped that up, but it's also aiding our defence. So it's an AI-on-AI battle, and it's increasingly about how quickly can we detect new methods, put in place new detection models for those, and then validate them and deploy them.
And what AI is enabling us to do on the defensive side is to remove the human element from more and more layers of that, so that we can defend a lot quicker, respond a lot quicker to new types of attack. But AI on the other side is enabling those new types of attack to come out quicker. So essentially it's removing the human element from both sides of that battle, which, yeah, I don't know who's benefiting most from that. I think it's just, with all these things, because it's an arms race, the defences speed up to match the attackers, and the attackers evolve to bypass the defences. So I think it kind of goes one way. Sometimes we'll see the attackers make some kind of major advances and we defend it. Sometimes we're ahead. It's just an ongoing battle.
Jose:
And it will probably go for many, many years.
Andy:
Yeah, I mean, it's not going away, because there's a lot of people making a lot of money out of this. So as long as that is still possible, the battle will carry on.
Jose:
And I think there's also maybe a third AI perspective to add to it, which is also the user perspective, or the visitor, right? That now more and more we're seeing agentic AI traffic online that is kind of representing real fans and has kind of legitimate intentions, right? But that, I could imagine, from a data perspective and what you can see from the request, will probably be very similar to a scalper bot that is also kind of trying to have access to the same. So how do you even start telling them apart?
Andy:
Yes, that is something that is definitely changing in the last two years. So previously you would have bots and humans, and then the bots would be broken up into good bots (Google, SEO tools, etc.) and then bad bots. But now, as you say, we've now got a new category of AI agents. They're essentially humans that have commissioned an AI agent to go and do something on their behalf. And that has been, if we look at how we've had to evolve the product in the last few years, that has probably been the thing that has been driving our thinking the most. From our point of view, because we made a decision early on that we were going to look at server-side behaviour activity, not kind of device-level decision-making, we're well positioned for that.
Because ultimately, if we look at what a bot operator is trying to do, they're trying to send out tens, hundreds, thousands, tens of thousands of fake visitors against a website, and they try to blend those fake visitors in with the legitimate visitors. An AI agent is only sending one visitor in there, and not actively trying to blend in with the real visitors, but may or may not do that. So what our detection has always done, but it's become ever more kind of useful, is that we're looking for patterns of activity that will say, actually, those 10,000 visitors are all trying to do something non-legitimate, are all joined together as part of the same attack. So we're looking for those characteristics. So we are understanding the attacker intent and how different visitors are grouped together.
And that allows us to be less concerned about the fact that this is actually being triggered by an AI agent. It's more what they're doing when they're doing that. Because going forward, it may well be that humans are actually a very small minority of direct users. Most people are using AI agents of one form or another. And whether that is then AI agents directly, or AI agents that are triggered by other AI agents, we've got that kind of future view of the world.
Jose:
And you mentioned there the... I think that's, as I said, one of the things that distinguishes you, Netacea, from some of the other bot detection mechanisms or tools, is that you work server-side, and a lot of the others work kind of client-side, right, or in the browser. And you told us a bit about kind of the benefits of running it server-side. Was there any consideration there when you were making that design decision? Is there something that you would see in the browser that you're not seeing, that you're missing out on?
Andy:
Yeah, so, I mean, we do take a different approach. And this was a conscious decision at the start, when we first got into this game. The standard way of detecting bots then, and still largely is to this day, is to deploy a JavaScript snippet within the website, or an SDK within the mobile app. And basically, it works on the assumption, or the premise, that a bot will use a different device, or use that device in a different way, to what a human will. And therefore, if we can detect that difference, then we'll be able to detect human from bots. Now, we took a different approach to that for two primary reasons. The first is kind of our background, as what was back then a traffic management tool. One of our kind of precursors to that was that we would never interfere with the customer's website. We did our job on the server side of it, and we got data in and out, and we operated at that level.
The second was a kind of core belief that you trust the data on the server. You can never trust the data on the client, because that is out of your control. So therefore, cybersecurity products should be server-side, because client-side data can always be spoofed, compromised, varied to meet their requirements. So we made that decision at the start, but it was a unique decision. At that point, there were no other operators operating in the way that we do. But what we've seen over the years is that, as we talked about the sophistication of the attackers earlier, the sophistication in being able to bypass client-side detection has increased exponentially, to the point where there's APIs you can call now and say, you know, I'm trying to bypass this tool, here's some information, and it will return back some data. Now, obviously, there's an ongoing arms race between client-side detection and those, to stay ahead. But we are starting to see that that area of detection is really not working effectively anymore, and we're seeing more and more of our competitors starting to take our approach.
Yeah, so we, when we started looking at it, weren't particularly comfortable with that as a way forward. So our premise that we set off was that every bot operator, it's not going to send one bot. It will send hundreds or thousands of bots. If we can identify those patterns of behaviour within the overall behaviour of legitimate users on that website, then we'll be able to isolate those, and we'll be able to effectively detect and stop that attack.
We also worked on the assumption that that attack would be ongoing, and that attack would continue to be distributed. So not only did we have to stop the instances that we'd already seen, we also had to try and detect where that attack would go in future. So that's part of our detection: it's not only what is unique about that set of visitors, but it's how do I detect all the future visitors that bot operator will also send. So we look at patterns of behaviour and patterns of distribution, so we can be ahead of that distributed attack.
Jose:
And one other aspect that I feel is relevant in this fight is something that we have recently talked about in the podcast here. It was actually episode 28, if anyone is interested. We talked about protocols that let AI agents identify themselves, right? And is that something that you see helping that fight? And how far do you think that will get us?
Andy:
I think it will help in some ways. So the protocols are out there, and they're all kind of quite evolutionary at the moment, as it's an evolutionary market. But those protocols are much more currently about what the AI agents want to do and what they should be allowed to do. They're not particularly about the enforcement level of that. So they're about defining the means of interaction for an AI agent to know what they should and shouldn't be doing, and agreeing the forms of communication. And that is helpful. It actually drives people around the right areas. What we do see, though, is that those are still abused. They're voluntary protocols at the moment, and our job is to sit in front of that and say: this is a legitimate person or AI agent that wants to do a thing; this is not legitimate.
And increasingly, we're also looking at these areas where they're not legitimate or not legitimate, but it's a business decision of: do you want to allow this particular agent through? So is this an agent that actually delivers conversions to you? Is it delivering value to you? Or do you know that it's scraping you for price comparison reasons, but they've got an advantageous agreement with one of your competitors, so they never actually convert, but they're using your data to feed back? And that's kind of the area that we are moving into more now, is into the whole analytics story of agent traffic. So what are the agents doing? Where are they coming from? Which are good and which are bad for you? Which convert? Which products do they look at? To give businesses insight into what the agents are actually doing.
And therefore, they can then start making the right business decisions of: I want to allow this agent, I want to not allow this agent, or I want to deprioritise this agent over the other agents. So they can get control back over it. The first stage at the moment is we're giving them understanding of what's going on, and then we will use our enforcement layer to allow them to actually control that.
Jose:
Yeah, very, very interesting. And when overall thinking about this fight, right, I think that one of the things for me, when I'm also involved in some of this work, is that it's always very hard to be absolutely sure that a detection is right, right? And at the same time, you always have this balance that, I mean, once you kind of tighten things further, you probably start getting more false positives, which means a real fan, a real customer, being potentially turned away or blocked. If you loosen them up too much, you're letting bots in. So maybe two questions here. How do you see kind of balancing these two? And then, how do we go about figuring out if we're getting better at blocking bots?
Andy:
Yeah. I mean, it's probably the question that gets asked by most customers: how do we handle that situation? And as you say, you've got false positives on one side, you've got false negatives on the other side. Where we try to get to with detection is obviously to be as accurate as possible, but there will always be a bit in the middle where we have to draw a line somewhere, and that will be either some false positives or some false negatives. And we will always work with our customers to get them comfortable with how aggressive do you want us to be. And then from that, we will then learn. You know, if there's reports of false positives, we'll feed those into our detection engine and figure out how we can optimise it. But there's never going to be a perfect line of detection, because obviously we don't know the right answers.
The customer kind of preference on that tends to be driven by, firstly, the area of the site that we're protecting and the impact of that. So they will often be willing to be a lot more aggressive on account protection, because the impact of missing some there is compromised accounts, but less aggressive on things like scraping, because the impact of it is a lot less. We also look at what is the response we're giving to customers as well. So if we are just hard-blocking that visitor, we need to be a lot more confident that that's not a real visitor, because hard-blocking a real visitor, obviously, that's something that none of our customers want. But if we can have a kind of more gentle experience, so maybe we're serving a challenge to that, and then the customer can pass that, then we can be more aggressive, because we know it's a slight amount of friction for a small amount of real users, but the benefit is we're stopping a lot more bad actors. And we'll always work with customers to get them comfortable where they want to be on that.
But it's the same conversation going into now with AI agents as well. And that's kind of where the visibility thing comes in. Which ones do you want to allow? Which ones do you not want? And what's the response that you want to give to those?
Jose:
That makes sense. Thank you. And before we wrap up, I would like to talk a little bit about our collaboration, right? Queue-it and Netacea, we now have a product together that we are very excited about on our side. And I just wanted to share with you and discuss some of the early access data that we have seen, right? And I wanted to pick a specific event where we had this, I think, very interesting data point: when visitors were entering the waiting room, we had around 17% of them tagged as malicious, having malicious intent. And then after they had waited, right, so once leaving the waiting room, that number was 59%. Can you shed some thought on what's going on here?
Andy:
Yeah, so one of the kind of, again, nature of how we go about detecting things is that we're continually assessing our opinion of every visitor. So every request that comes from any visitor can change our mind about any other visitor. Part of the fact, when we were discussing earlier, that we're looking for groups and patterns of behaviour, because they're parts of attackers: the more we see, the more it becomes clear that that individual visitor is actually part of a group. They've all come from the same source. So the longer we wait, the more detection we can do, which does mean that actually there's some benefit to this being within the waiting room, because it gives us that time to revise our opinion, learn more about what's going on. And then obviously at the point of exiting the waiting room, we will again re-evaluate our decision.
So we do see that the more we see, more activity, the more confident we can get. Over time, when we work with customers, we try and pre-empt that by kind of getting a better idea of the types of attack, as you see, and the longer we work with customers, the better we get, comfortable with the types of attacks we're seeing. But all our models are about looking for patterns of unusual activity. So as new attack vectors come out, we are still seeing that kind of malicious behaviour, regardless of how they're going about it. So, yeah, it was an interesting example of seeing how the attacks... because the scalping attacks, they ramp up very quickly, because basically the on-sale happens and the bots are already at the exact second, and we will see that. But they'll then carry on trying to get more and more visitors in the queue, so that the longer we see in the queue, the more we can see that those apart one at a time.
Jose:
It's a good point. While you were describing it, I was imagining that maybe if there's one bot in the queue, right, it's just not a very strong pattern, because there's only one. But then if all of a sudden there's a hundred thousand coming afterwards, and they all have the same pattern, and the same pattern as the first one, then you will kind of update the score, right? The assessment on that first one. That's very interesting.
Andy:
Yeah, that's right. And scalping is a particular, fairly unique use case, because the activity that the bots are doing is pretty much the same as what the humans will be doing. They're going through the same process, all trying to go as fast as possible. So there's variance that we can see, but the more we see, the more coming from one place, the more that stands out.
Jose:
And another thing that I wanted to ask is that, so, one thing is detecting and spotting bots, right? And maybe not just bots, but malicious intention, right? So once that is done... We talk a lot about blocking bots. Is that always the right thing to do? Or do you have any other approaches or ways to deal with it that you also find interesting?
Andy:
Yeah, so blocking isn't always the right thing to do. And I think particularly in things like scalping situations, there's a lot of advantage in the bot thinking that they've been successful, or, in the waiting room example, the idea that the bot thinks they're still in the waiting room legitimately when they've maybe been pushed to the back of the queue or something like that. Then there's a lot of advantages in that, because if they know they've been blocked or the attack has failed, they can try again and try variants of it. But if you can deter them from doing that, there's a lot of advantages in doing that. We also see, on things like account protection, we have customers that will not necessarily just block the login. They'll lock down that account and basically ask the user to contact them or go through another process.
Depending on the level of risk associated with it, it might be they'll just ask them another couple of questions, you know, the security questions. It might be that they actually have to phone up and get their account unlocked. So we can take action on their behalf, or we can give them the information and they pass that into their systems and they take appropriate action. The most common way is still serving some kind of a challenge, whether that is an invisible kind of CAPTCHA replacement or whether it's an actual physical, you know, click-the-boxes kind of challenge. That's still the most common one that we see. I think that's largely for simplicity. But when we work closely with some of our kind of more advanced customers, we do work with them to look at how you could give a better response that maybe won't immediately give away your position to the attackers, but still giving the same reduction in friction for any false positives.
Jose:
Yeah, that makes sense. Thank you. And we talked about the waiting room giving some advantage because of time, an added time. And for the listeners that don't have a waiting room, is there a wider lesson there about time as a signal, or a means to get more signals?
Andy:
Yeah, I think it's an interesting way of looking at it, definitely from a scalping point of view. As I say, our original product we had was a virtual waiting room. We've migrated fully into bot management. But one of the ideas that we had originally was that anyone we suspected of being a bot, we would put them in the virtual waiting room and just basically put them in a holding pattern while we got a bit more information about them. So I think that kind of thing is an interesting kind of a way of dealing with... if I'm suspicious of you, but I don't really want to necessarily... if it's a real customer, you don't want to upset them by saying you're suspicious of them, but maybe you can do a more kind of lower-friction kind of thing where you say, actually, we're just going to test a few things with you.
And it's an interesting combination of things. And I think it's been interesting, as we've been working with Queue-it on the joint product, to start discussing future kind of ways of handling bots within the queue as well.
Jose:
It's using the queue as somewhat of a time capture for getting more information on the traffic.
Andy:
Yeah, basically it is like a holding pen, isn't it? You just push them off to one side. So I think there's an interesting element, which we've gone into in a little detail, but I think it's interesting in the future, is prioritising your customers: your good customers and your bad customers. So a lot of the time on scalping, selling products to bots isn't necessarily bad as such, but you want to prioritise your real human visitors first. But if you've got stock left over, then a lot of companies are happy to sell that to bots, because they want to sell all their stock, obviously. But actually, that idea of prioritising real humans, your real genuine customers, where you think you'll get a better lifetime value from them, you want those to go first. And the same thing we were talking about with AI agents going forward: maybe AI agents that you know always convert, so you want to prioritise those. And then if you've got capacity, the kind of lower-benefit AI agents, and then obviously you'd stop the risky AI agents.
Jose:
That makes sense. I can see that really being helpful for everyone out there selling things that are on limited stock or availability, right?
Andy:
Pokémon at the moment.
Jose:
Pokémon being one of them.
Andy:
Pokémon is what all the scalpers are after at the moment.
Jose:
That's true. And Andy, we are getting to the end. I would just like to wrap up with a couple of quick questions. One of them being around: do you have any recommendations for our audience? So within this area, especially, is there any book or podcast or blog or someone that you would recommend people to follow?
Andy:
It's a good question. It is a very fast-moving area. I think the area of agentic commerce, agentic interactions, the agentic web, is definitely a real cutting-edge area, and it's difficult to keep up with. It changes so fast. I'm going to do a shameless plug for one of my colleagues. Andy Ash, who's our CISO, is writing a lot about the agentic web. You can find his Substack out there. There's a lot of good things on there.
Jose:
Very good. Thank you. And by the way, totally allowed. So thank you for that. And final question that we ask everyone. Andy, to you, scalability is?
Andy:
For me, scalability is something that you need to... it's a problem you need to solve, and it's a problem that you need to be aware of the fact that it's not always good. It's about looking at the value associated with that scalability as well, and making sure that you are not scaling for things that are not delivering business value to you, and making sure that is under control.
Jose:
Awesome. That's a great way to end here. So, Andy, thank you so much for coming by and for the chat. Really appreciate it.
Andy:
Yeah, thank you very much for having us on. Been a pleasure.
Jose:
And that's it for this episode of the Smooth Scaling Podcast. Thank you so much for listening. If you enjoyed, consider subscribing and perhaps share it with a friend or colleague. If you want to share any thoughts or comments with us, send them to smoothscaling@queue-it.com. This podcast is researched by Joseph Thwaites, produced by Perseu Mandillo, and brought to you by Queue-it, your virtual waiting room partner. I'm your host, José Quaresma. Until next time, keep it smooth, keep it scalable.