Learning to Bot Changed How I Think About System Misuse

Reading time: ~2 minutes
Key Takeaways

• Technical misuse is not always malicious, and controls often block legitimate users.
  
• Static defenses fail quickly in adversarial, fast-iterating environments.
  
• Every software release teaches both sides something new.
  
• System misuse is rarely treated as a strategic business concern, but it directly impacts trust and customer sentiment.
  

Why I StartedI originally started learning how botting actually works out of frustration. Limited-release items would sell out instantly, and I was fascinated by the psychology behind scarcity and how it activates the brain’s seeking center. That intersection of neuroscience and technology pulled me in. I wanted to understand the problem, not just react to it.

What Surprised MeWhat surprised me most once I got hands-on was how sophisticated anti-bot operations are behind major retail platforms. Controls change with every release, and botting communities test those changes immediately. Every release teaches the other side something new. This is a continuous, adaptive loop.
What I did not expect was how many legitimate users were affected. Watching real customers get blocked and grow frustrated made it clear that controls are often designed for known behaviors, not emergent ones.

The Human Signal in the DataI was not trying to scalp. I sold items locally to neighborhood kids at cost, covering only the tooling expense. Seeing the relief from parents and the joy from kids reframed the entire problem. Access, fairness, and intent matter alongside detection.

The Leadership LensMy experience with Duke CISO shaped how I think about this at an executive level. Anti-bot work is not about stopping criminals in the traditional sense. It sits at the intersection of brand trust, customer experience, equity, and business strategy.

The Question That Stuck With MeIs technical misuse even being captured as part of enterprise strategy? In most organizations I’ve worked with, it lives in silos across IT, security, and operations, if it shows up at all. Learning to bot made that gap impossible for me to ignore.