A user accessing data from a server in an authenticated session is determined to be human, an authorized bot, or a non-authorized bot based on receipt of behaviometric information from the user's interactions and responses to and with the server. The user is then denied or granted continued access to receive data, such as financial data, after it is determined if the user is authorized to do so by way of comparing the behaviometric data to known prior behaviometric data for particular humans and bots in embodiments of the disclosed technology.