Back to blog

Trading Bot in Practice: Overfitting, Risk Management, and What Backtests Don't Tell You

In part 1, I covered how to decide if your strategy can be automated and how to get from idea to a running bot in 5 phases. Now the hard part. Your bot is live, the backtest looked great, and real money is on the line. Here's what goes wrong, how to protect yourself, and what tools to use.

Key Takeaways:

  • Backtests always overestimate results. Expect 30–50% degradation in live trading (slippage, spreads, execution quality)
  • The biggest killer is overfitting: a strategy with 15+ parameters tuned to historical data will almost certainly fail live
  • Kill switches and drawdown limits are mandatory. Without them, you risk your entire account
  • No strategy works forever. Regular monitoring and re-optimization every 3–6 months

Where Automation Fails: Why Backtests Always Lie

Backtests assume perfect fills at perfect prices with perfect timing. Reality is different.

Overfitting: How It Sneaks Past You

A strategy with 15 optimized parameters. Looks amazing in backtesting on 2019–2022 data. Forward test on 2023? Significant loss. The strategy memorized patterns specific to high-volatility periods (COVID, post-COVID recovery) that didn't repeat. The more parameters, the more the strategy "learns" noise instead of real patterns.

Warning signs of overfitting:

  • Profit factor above 3.0 in backtesting, too good to be true
  • Strategy only works on one pair or one specific time period
  • Results change dramatically with a small parameter change (17-period EMA works, but 16 and 18 don't)
  • You need more than 5–6 rules for entry

Execution Reality vs. Backtest

  • Slippage: 0.1–0.5 pips in liquid markets, 1–5+ pips when liquidity thins
  • Spread variability: backtests typically use a fixed 1.0 spread. In practice: 0.1–8.0+ during news events
  • Broker execution model: ECN vs. market maker fundamentally affects fill quality
  • Latency: a bot on your home PC over Wi-Fi vs. a VPS colocated with the broker (50ms vs 500ms+ adds up fast)

Market Events Backtests Miss

Most backtests don't account for high-impact news events. Solution: connect to an economic calendar so the bot knows when to sit out.

Pre/post-news windows (30–60 minutes before, 15–30 minutes after high-impact events), smart filtering by currency pair (NFP affects USD pairs, not AUD/NZD), and volatility-based filters (ATR above threshold or spread above Y = don't trade).

Other blind spots include low liquidity sessions (Asian session for EUR/USD, rollover periods) and survivorship bias in historical data.

Real-world failure examples: An EA with a lot size bug (an extra zero = 10x larger position = margin call within an hour). A broker switched from fixed to variable spreads, and a strategy optimized for fixed spreads stopped being profitable. Knight Capital lost $440 million in 45 minutes due to a code deployment error, an extreme example of what happens without a kill switch.

Risk Management: Temporary Loss vs. Blown Account

Position sizing:

  • Fixed risk percentage (1–2% of account risked per trade), simplest and most common
  • Volatility-adjusted (ATR-based): position size automatically shrinks in volatile markets. Better for strategies trading multiple instruments
  • Kelly Criterion exists as a theoretical concept for advanced traders. In practice, most end up with fixed percentage or ATR-based sizing

Protective mechanisms (mandatory):

  • Max drawdown: 15–20% of account → bot stops trading, requires manual review
  • Daily max loss: 3–5% → no new positions until the next day
  • Kill switch: X consecutive losses (typically 5–8) → pause and diagnose
  • Correlation guard: maximum exposure to a single currency/sector. Long EURUSD and long GBPUSD is essentially the same trade

"Nuclear option" protocol: upon system failure (connection loss, unexpected volatility): close all positions at market, halt the bot, log the state, send notification. Manual restart only after review.

Tools and Platforms

Platform Language Best For Notes
MT4/MT5 MQL4/MQL5 Forex/CFD, algo beginners Widest broker support, largest community
cTrader C# Forex/CFD, modern MT5 alternative Growing broker adoption
TradingView Pine Script Screening, visual strategy development No native auto-trading (needs a bridge)
Python Python Crypto, custom infra, ML strategies Requires programming skills
NinjaTrader C# Futures (CME), advanced traders Popular in North America
StrategyQuant X No-code Strategy generation + testing Watch out for overfitting!

Infrastructure and running costs: VPS with low latency to your broker ($10–50/month), data feed $0–200 depending on market. Minimum capital for forex with micro lots: realistically $2,000–5,000 for position sizing to make sense.

ESMA leverage limits (30:1 major, 20:1 minor pairs) affect position sizing, so your bot must account for this. Higher trade frequency also means more complex tax filing.

After Deployment: Monitoring and Maintenance

Deploying a bot on a live account is where the real work starts (and where most people stop paying attention). No strategy works forever.

  • Weekly review: equity curve vs. expected drawdown from the backtest
  • Rolling metrics: track win rate, profit factor, and average trade over the last 50–100 trades, and compare with the backtest
  • Strategy degradation: if rolling Sharpe drops below 50% of the backtested value → re-optimize or shut down
  • Regime detection: trending vs. ranging market. Either two bots for different regimes, or a filter (ADX, volatility)
  • Update cycle: re-optimize parameters every 3–6 months on fresh data (walk-forward principle)

The "set it and forget it" trap: a bot requires regular monitoring, maintenance, and adjustments. A strategy that returned 40% annually in the backtest quietly bleeds down to breakeven over 6 months because volatility regime shifted and spread conditions changed.

Without monitoring, you won't notice until the drawdown is already significant.

I want to automate my strategy