Today’s attackers use automation and AI to behave like legitimate customers, while real customers absorb the friction.