Are you able to identify when an automated program access your web application instead of a real person using a web browser? Sounds like a basic question--however the actual percentage of organizations that can confidently answer yes to this question is surprisingly low.
The Web Application Security Consortium (WASC) Threat Classification labels this weakness as Insufficient Anti-Automation.
Check out this brief paper to learn how Breach Security products help identify automated clients accessing your site and help enforce the desired rate-limit threshold.
Information Security Research Library
