Key Takeaways
- Most bot management vendors still fall back on CAPTCHA or SMS codes when traffic looks suspicious — friction that AI now defeats more reliably than the humans it was built to test. A 2023 UC Irvine study found bots solving CAPTCHA at 99.8% accuracy against a 50–84% human range.
- CAPTCHA is a browser concept. It doesn’t exist for APIs, which is exactly where attackers move once they’re blocked at the app — Gartner has been predicting this shift for years, and API-related breaches were forecast to nearly double by 2024.
- Cequence Bot Management’s Biometric Check resolves this with a WebAuthn-based challenge enforced at the network layer, not in a browser script or an app SDK, and it’s backed by continuous behavioral analysis rather than a single static check.
Malicious bot detection is a probabilistic exercise: every vendor scores incoming traffic against signals like device fingerprints, behavioral patterns, and request anomalies, then flags anything that crosses a threshold. That threshold isn’t perfect — set it too high and real customers get blocked. Set it too low and bots get through. Every bot management vendor eventually has to figure out what to do with traffic on the wrong side of that threshold. Most vendors put it on the customer to solve a CAPTCHA, wait for a text message, or click a link in an email. Those challenges persist because they’re the easiest thing to add, not because they work well. The traffic that’s being challenged has changed considerably since CAPTCHA became standard practice, and the challenges haven’t kept pace with the automation attempting to pass them.
CAPTCHA’s Accuracy Problem
CAPTCHA was built on an assumption that’s now backwards: that solving a distorted image or picking out traffic lights is something machines struggle with and people don’t. A 2023 University of California, Irvine study led by Gene Tsudik tested that assumption directly — 1,400 participants working through 14,000 CAPTCHAs — and found bots solving them at 99.8% accuracy against a human range of 50% to 84%. Commodity solving services have since made that differential irrelevant at scale: reCAPTCHA and hCaptcha challenges clear for roughly a dollar or less per thousand solves, sub-second, no human operator involved. The result is a puzzle that fails real customers more often than it stops bots.
CAPTCHA Doesn’t Cover APIs
CAPTCHA is also a rendered-page concept — it needs a browser, a visible challenge, and a human to click it. None of that exists for APIs, which is exactly what attackers target once they’re blocked at the app. Gartner predicted this shift years ago, surmising that API abuse would move from infrequent to the most frequent attack vector for enterprise applications, and that API-related breaches would nearly double by 2024. The traffic behind that shift looks less like a login attempt and more like abuse of a legitimate workflow: an account API queried at a rate no human interface could sustain or impossible journeys such as a checkout process called out of sequence. That’s business logic abuse, not an authentication failure, and CAPTCHA was never built to catch it.
The Cost of Client-Side Verification
Even vendors who’ve moved past CAPTCHA often reintroduce friction somewhere else: a JavaScript snippet injected into every page for behavioral capture, or a proprietary SDK compiled into the mobile app for device attestation. Both approaches tie a security capability to the deployment cycle. A JavaScript-based check has to be re-tagged on every new page template. An SDK-based check waits on the next app release and whatever review cycle the app store imposes on it. Either way, changing how traffic gets verified means modifying code the security team doesn’t own or control.
How Biometric Check Solves This
Cequence Bot Management addresses all three problems with a single capability: Biometric Check. When Cequence flags a request as suspicious, instead of blocking it outright, Cequence issues a step-up authentication prompt. The user sees a simple “verify you’re human” message, confirms with Touch ID, Face ID, or Windows Hello, and the device authenticates via WebAuthn, verified against the configured identity provider. The whole exchange takes about a second and produces a hardware-bound cryptographic proof no bot can replicate.
Enforced at the Network Layer
Cequence sits in the traffic path, requiring no app modification. So no script tags or app dependencies. That means Biometric Check works the same way for a browser session and a raw API call, with no JavaScript required on the page and no SDK required in the app. It solves the API problem described above directly: the challenge lives where API traffic actually flows, not only on rendered pages built for a human to look at, completely missing API traffic. Updating the policy is a simple configuration change, not a code change or an app update.
Backed by Continuous Behavioral Analysis
Passing Biometric Check isn’t the end of the risk assessment, either. It’s a high-confidence signal that feeds back into the behavioral analysis Bot Management already runs on every session, continuously scoring traffic patterns based on behavior instead of relying on a one-time checkpoint. A page-level CAPTCHA or SDK integrated into an app can’t do either of those things.
Want to give your customers a break from doing puzzles and see how it holds up against your own traffic? Get in touch.
