## TL;DR
Total usage going up is not always good news. When bot traffic, scrapers, a misconfigured integration, or a customers automated job floods your events, the human decline underneath disappears from every aggregate, and health scoring congratulates an account whose people have quietly stopped showing up. Split automated from human traffic using identity, behaviour, and client evidence, rebuild the usage trend on humans, and put a permanent separation in the pipeline so the signal stays honest as traffic grows.

```text
usage spike from bot traffic masking a real decline in human usage: churn signal too noisy to trust
```

## Use this when
- Usage volume spiked while human shaped signals, sessions, feature breadth, human user counts, stayed flat or fell
- The spike concentrates in one account, one event type, one client, or inhuman hours and patterns
- Support or qualitative signals suggest real users are disengaging despite the green usage chart

## Not for this skill when
- The spike is a customers legitimate automation doing business work, which is real usage and should be classified as such, not excluded
- Human usage is genuinely growing and the suspicion came from one anecdotal account

## Steps
1. Characterise the spike forensically. Break the new volume down by account, event, hour, user or key, user agent or client, and session shape, and compare each slice with the pre spike baseline. Bots concentrate, humans spread, so the concentration pattern usually identifies the automated source within one analysis pass. Verify: the spike is attributed to specific accounts, clients, and event patterns with volumes
2. Classify with the account team before excluding anything. For the biggest automated source, determine what it actually is, a third party scraper, the customers own monitoring or sync job, a runaway retry loop, or your own load testing leaking into production data, because the right response ranges from blocking to fixing an integration to counting it as legitimate machine usage in its own category. Verify: each major automated source is classified with an owner and an agreed treatment
3. Define the human usage measure explicitly. Decide which identities, clients, and event patterns count as human usage, which count as machine usage to be reported separately, and which are abuse to be blocked at the edge, and write the classification rules where the pipeline implements them so they can be reviewed like code, because they now define your churn signal. Verify: the classification rules are documented and implemented in one governed place
4. Rebuild the usage and health trend on the human measure for the affected window, quantify how much of the apparent growth was automated, and identify accounts whose human usage actually declined under the cover of the spike, since those accounts need CSM attention now and may have needed it for weeks. Verify: the human trend is rebuilt and the masked decline accounts are listed
5. Fix the source where it is fixable. Rate limit or block abusive traffic with the platform team, repair retry loops and misconfigured integrations with the owning customer or team, and move your own synthetic and test traffic onto clearly marked identities and environments so it never blends into customer usage again. Verify: the fixable sources are actioned and synthetic traffic carries an unmistakable marker
6. Add a standing divergence monitor. Alert when total usage and human usage move in opposite directions for an account or for the whole base beyond a threshold, reviewed weekly by the data owner, because automated traffic will keep appearing in new shapes and the defence is noticing the divergence early, not perfecting a blocklist. Verify: the divergence monitor runs and a simulated bot spike triggers it in testing

## Why it happens
Usage pipelines count events, not intent. Automated traffic generates events at scales and regularities humans cannot match, so a modest bot source can outvote the entire human base in an aggregate. Health models reading the aggregate then score the loudest signal, the machines, while the humans whose renewal decisions matter drift away unnoticed. Separation is not cosmetic, it is what makes the metric refer to customers at all.

Compatibility: Product analytics and usage pipelines, server and edge traffic data, identity and client classification, and health scoring, in current versions.

## Variants and edge cases
### bot traffic masking usage decline churn signal
['The direct phrasing. Concentration analysis is the detection craft, bots cluster in identity, time, and event shape in ways humans never do.']

### usage up human usage down SaaS analytics
['The divergence variant. Report human and machine usage as separate permanent series, the blended total is the thing that lied to you.']

### automated traffic inflating product usage metrics
['The classification variant. Legitimate customer automation deserves its own category and its own value story, not deletion and not blending.']

Edge cases to work through before you close the incident:
- Shared corporate egress and VPNs make IP based human detection weak. Lean on identity, client, and behaviour patterns, and treat single signal classifications as provisional.
- A customers automation can be the product value, for API first products machine usage is the usage. The human measure matters most for seat based products, calibrate the approach to your model.
- Blocking traffic has product consequences. Coordinate with the account team before blocking a source keyed to a customer account, it might be their production integration.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_oTPqiP__j_ek11kskCsGgQ