Heading 1

Recently, the amount of coverage on credential stuffing attacks in the news has grown. Organizations that haven’t yet been hit by this type of attack can sometimes overlook the potential risk and cite that it’s an end user’s responsibility to use more secure credentials. However, following a successful attack, many the same organizations find themselves scrambling to respond and reposition platforms as ‘secure and private.’

We want to help companies avoid this by sharing some best practices that development teams can use when creating applications to protect their organizations and make it difficult for attackers to exploit APIs in use.

One of the main ways that developers can improve security posture is by keeping in mind what the CQPrime Threat Intelligence Team calls the Four Pillars of Detection— credentials, tools, infrastructure, and behavior.

A Quick Primer

With data breaches happening almost weekly, it’s easier than ever for bad actors to acquire fresh lists of credentials. Additional sources they leverage are various web, social media presence, and simple dictionary type lists (i.e., bob.smith@gmail.com or bob.smith@me.com). With little effort, they can quickly gather a few hundred thousand accounts to use in an attack.

These attacks often make use of commercial toolkits readily available from ‘cracking’ marketplaces, in addition to the tools bad actors create. These will then be used to test and orchestrate their attack once they identify a target.

Behavior is two-fold. It’s how the attacker and the user interact with an application. Many organizations fail to think about the security ramifications of application and user interaction.

How APIs Simplify Credential Stuffing

Here’s a recent real-world example for you: a development team published an API login endpoint to authenticate mobile application users. However, that login endpoint was shared by multiple services outside of the mobile application, making it easy for attackers to discover, analyze, and abuse it.

Our researchers created legitimate accounts for the service mentioned above and then created a small list of fake accounts to test.

If the account username and password were correct, the service returned “accountId”:”<useraccount>.”

If the username was incorrect, the service returned “Account not found.”

If the password was incorrect, the service returned “Password incorrect.”

From this behavior, researchers concluded that a simple script that tested a list of emails would eventually end up confirming valid user accounts. From there, an attacker might employ straightforward dictionary attacks, password reuse attacks, or even try to exploit a password recovery routine to develop their list of usernames further to include those with valid passwords.

Finally, when the credentials list is complete, the behavior of the application understood, and tools configured, the attack can begin. This could be a simple smash and grab attack that allows for millions of attempts to compromise data all at once. Or, this could dribble in one at a time over weeks. The infrastructure available to the attacker can be as simple as just their PC or be as involved as BOTs running as rogue services on compromised IOT devices or parts of a Bulletproof Proxy network.

Credential Stuffing Resistant Development Processes

How can development teams use the Four Pillars of Detection to their advantage during the application development process? Here’s how the methodology can help organizations create applications that are less susceptible to automated attacks:

• Credentials: Emails are easy to use as a username; they are also easily guessed. Ideally, you should suggest that the user create a unique identity for your service. If you want to make it easier for your customers, you will probably want the username to be an email. However, you should not make it easy for an attacker to validate an account without supplying a password (as illustrated in the example above).
• Tools: There are plenty of commercial attack tools available on the market. Have your security team find them, evaluate how they work, and look for predefined attack configurations that target your organization. Go a step further and subscribe to the cracking forums (if you do not already). Ensure that, if you find a configuration targeting your organization, you understand how it works and modify the behavior of your application to invalidate the tool or trick it into a honeypot. Eventually, the tool will stop working, and the attacker will have to change to match, so it will be essential to remain vigilant. Security is never a one-and-done exercise.
• Infrastructure: Be aware of your users’ compute environment. Are you a small government office that takes fees online for a small town in the US? If so, then why are 70% of your users from Somalia? Why do half of your users use an old version of Chrome on Android? Understanding what is connecting to your application is a step toward not only securing yourself but also tooling the application performance for your constituents. Tuning for your legitimate users makes it more difficult for attackers to succeed. These types of attacks happen regularly and are only becoming more sophisticated.
• Behavior: Most importantly, application behavior should be built so that it helps inform the user but does not enable an attacker. Error messages should be overt but should not include or expose lookup times, page sizes, or message bodies, all of which can help an attacker. Give them nothing. It might cause legitimate users to become confused, so your support team may need to have a way to see what is going on, but the user should be notified that something didn’t work with a generic message, free of details.

Credential Stuffing attacks happen regularly and are only becoming more sophisticated. Following the recommendations above can help knock the foundation out from under the attacker and give you the upper hand in an uncertain world.

When a hot product hits the market, it’s not uncommon to see multiple vendors follow the first market mover, selling the same or a very similar product. The 2019 research done by Brian Krebs and the CQ Prime Bulletproof Proxies research report both noted a few vendors who were marketing residential proxies (IP addresses) to the public.

As the volume of stolen credentials continues to climb with weekly breaches, new vendors are emerging to market their network of residential proxies, since this type of criminal infrastructure is popular with bad actors who use it to launch automated attacks. Today it’s easy to find multiple Bulletproof Proxy vendors marketing their residential proxies to the public.

Common Bulletproof Proxy Uses

The first legitimate proxy use case can be a pure desire from a user to avoid geolocation-based censorship of internet content. People seeking to maintain anonymity browsing the web have every right to do so, and, more importantly, a proxy can be a tool to provide whistleblowers and suppressed individuals a means to communicate anonymously. Though, it should be noted that an individual only needs a single proxy to maintain anonymity, not the millions that Bulletproof Proxy vendors advertise.

Another potentially valid use case is an organization using a proxy vendor to test new features that may appear different to users in different countries or with different types of IP addresses (e.g., residential vs. mobile). In this case, the organization can potentially take advantage of the high number of proxies offered to simulate large user populations.

While the above use cases are seemingly legitimate, unfortunately, one of the more common uses is bad actors who want to execute a cyberattack while masking their identity and location. Account takeovers, fake account creation, scraping, and API abuse are all types of automated attacks that frequently take advantage of the anonymity benefits offered by Bulletproof Proxies. To better understand the attack infrastructure our customers face, the CQ Prime Threat Research team compared the ‘base product’ of one of the new vendors to that of the older vendor used in our 2019 report.

No Honor Among Thieves

Comparing two Bulletproof Proxy vendor offerings showed that roughly 34% of 22,000 North American IP addresses were for sale from both vendors.

Essentially, they are both selling the same product. Both vendors offered country, state, and, in some cases, city breakdowns, allowing customers to choose the geography from which the traffic would originate. When the CQ Prime Threat Research Team drilled down into the source ISP for the overlapping IP addresses, they discovered that Cogent Communications owned 88 % (possibly a carryover from their purchase of PSI Net assets). The other 12% were distributed across the remaining ISPs.

100% Malicious Usage

Analyzing customer attack data showed that 100% of the overlapping IP addresses were generating account takeover traffic in both retail and financial services environments. Additional historical analysis of the overlapping IP addresses in those same customer environments showed they did not generate any legitimate traffic. Ever.

Retail Analysis

In retail environments, the attack traffic across the overlapping IP addresses heavily targeted web applications, with the bulk of the attack traffic originating from Cogent Communications. Interestingly, the mobile API attack traffic was more evenly distributed across several ISPs with Verizon Fios most heavily used.

Image 2: Overlapping IP address analysis for retail customers

Financial Services Analysis

Applying the same analysis to financial services customer data, the targets and the ISPs most commonly used were flipped. The mobile APIs were targeted almost exclusively, with 88% of the attack traffic originating from IP addresses owned by Cogent Communications. Whereas the retail analysis showed attack traffic against web applications more evenly distributed across several ISPs, the financial services data shows 88% of the web attack originating from Cogent Communications.

Image 3: Overlapping IP address analysis for financial services customers

Building a Case for Outright Blocking

In most customer environments, there is a reluctance to blacklist large blocks of residential IP addresses because there is always a possibility of blocking a legitimate user, resulting in a false positive and an unhappy customer.

In reality, what are the chances of a false positive occurring? When the data shows that the IP address is known to generate ONLY malicious traffic and has never generated any legitimate traffic, as mentioned earlier, the case for blocking becomes more powerful, and the chance of a false positive is low.

In cases where the probability is relatively high, for example, a retailer and a customer, both in the U.S., we observed less than 0.8% of the overlapping IPs EVER appearing in good traffic over a four-month period that included the peak periods of Thanksgiving, Black Friday & Christmas. The highest potential false positive rate observed was a maximum of 4% of all the overlapping IP addresses EVER generating legitimate traffic over an entire year (2019). The traffic from these IPs represented a minuscule < 0.1% of all traffic from known Bulletproof Proxy vendor IPs.

While some of these false-positive rates are still too high to be acceptable over a long period, we’ve found that during bot attacks, these IPs seldom generate any legitimate traffic. This is where learned models that can detect and block these Bulletproof Proxy IPs while they are committing abuse become important, and then automatically allow them to “become good again.”

RSA 2020 wrapped up last week, bringing to an end countless networking events, customer and prospect meetings, and a series of great sessions and keynotes on cybersecurity. Outside of the meetings we had, RSA 2020 will be remembered for the ubiquitous face masks in the city and hand sanitizer samples given away at almost every nook and corner of the conference for obvious
reasons.

A few of the more notable technology trends observed at the conference include an expansion of how AI and ML are being used to accomplish a wider range of security use-cases; tighter integration between security management and analytics solutions and the arrival of Privacy Ops as a major cybersecurity requirement.

In our conversations with customers, prospects and analysts, the topic that garnered the greatest interest and was top of mind for CISOs was API Security. For years, securing APIs has been talked about as a cool technology use-case, though what “securing” means has been ambiguous, to say the least – depending upon whether you spoke to an Identity Provider or WAF or API Management vendors.

In our meetings, CISOs cited the following reasons for prioritizing API security as one of their top 2020 initiatives:

• Enterprises are at the point where they have at least one or more digitally transformed applications developed with an API-first approach. In many cases, they are distributed globally, hosted on multiple data centers and are serving their customers, partners as well as internal teams.
• Enterprises have maintained a multi-cloud strategy for years to avoid getting locked into a single vendor. This has gotten them to a situation where they now have crown-jewel applications (and the supporting APIs) spread across AWS, Azure and GCP, as well as Alibaba for organizations that do business in China.
• APIs have been developed organically by application development teams to serve other internal teams, partners and customers. The lack of visibility into these APIs and their usage patterns is now a critical concern for CISOs due to the growing frequency of API breaches.

The CISOs we talked to have evaluated WAFs, API management vendors and a host of specialist API security vendors.
Here’s a list of what they need in API security:

1. Continuous Visibility and Alerting: Monitor the entire API attack surface of customer-facing, B2B and internal APIs and alert security teams of anomalies or threats detected in real-time.
2. Vulnerability Protection: Protect APIs from vulnerability attacks that may target the underlying application layer (e.g. SQL injection or XSS), or vulnerabilities in the Swagger/OpenAPI specifications.
3. Business Logic Abuse Protection: Protect APIs from attackers who commonly use automated toolkits and botnets to find and exploit business logic vulnerabilities. Recent API breaches have originated from exploiting hidden parameters, sensitive data leakage in error messages or responses, and weak access control in API implementations.
4. Threat Prevention: Prevent threats such as the OWASP API Top 10, Web Top 10, or sensitive data leakage from APIs.

Cequence protects APIs and web applications from business logic abuse like account takeovers, credential stuffing and content scraping. Our financial services, retail and social media customers are processing billions of requests each day, including large 5-10X spikes in traffic on Black Friday and other holidays. Our discussions at RSA are consistent with what we’re finding at each of our deployments where we’ve been seeing a steady increase in usage of APIs and attacks against them.

We’re also thrilled and honored that this week, Cequence received the 2020 SC Magazine Trust Award for Best Application Security Product. This is a testament to our growing product leadership in the Application Security market.

Third-party JavaScript is a common technique used to add functionality, user experiences, or security paradigms to your web site. However, these website additions can introduce significant friction. Not all users want to wait for the various JavaScript components to load, and no one is interested in losing their credit card info to Magecart-related content skimming. To gain a better understanding of the impact and risks of third-party code, the CQ Prime Threat Research team analyzed 60+ alerts from our news monitoring bots looking for Magecart in January 2020, and the results are surprising.

Magecart is Prevalent

Our first observation is that, in the 60 or so cases we reviewed, most of the affected organizations made use of third-party code. They appeared not to be tracking the externally sourced JavaScript for changes or monitoring its impact to their sites. Of the 60 web sites, analyzed from news reports of them being impacted by Magecart, all had a third party call to another site that houses the script for execution. Examples ranged from midsized retailers to larger organizations such as the Olympics Ticket Sales and Australian Bushfires Donations site.

Too Many Secrets

Many popular websites will use third-party code to support Ad Networks, Ad Trackers, Styles, and methods of moving data. Image 1 below highlights the impact on a web site that has Facebook as a third-party dependency. The Facebook dependency is the blue circle in the middle of the image that is connecting to many external script resources and is being called by many other organizations. Its popularity illustrates how interconnected dependencies can be and why Magecart is so prolific and hard to reign in, since attacking the Facebook dependency in this example could/would expand quickly to many targets.

Image 1: Adding third-party integration like Facebook dramatically increases the complexity of managing the interrelated dependencies and associated risk.

By itself, the sheer volume of interrelated dependencies highlights the security risk of third-party code. Call outs to image files, fonts, styles, and various other scripts are used on most basic of sites. More heavily trafficked, popular sites will call JavaScript from 50 places. Any one of those places can be compromised to point to a new piece of third-party code, or could have malicious code injected via some other attack vector. There are just too many places that are being pulled from to think this type of attack isn’t possible.

Adding to the risk of too many JavaScript callouts , is the fact that few organizations have complete visibility into their third-party dependencies. They are often unaware of changes, new additions, or when one begins redirecting credit card data to another site. In recent Magecart attacks, BASE64 encoding was used to obfuscate the JavaScript that was watching for specific checkout forms. If that form was loaded, the Name, Address, Phone Number, Credit Card, CVV, Expiry, was capture and sent to a server for collection in a database. Image 2 shows a
JavaScript snippet that loaded with the main page and quietly waited for the checkout sequence.

Image 2: An example of third-party integration code – an easy target for Magecart attackers.

This BASE64 encoded string simply opens a connection to post data back to the server “’open’,’POST’,’setRequestHeader’,’Content-Type’,’application/x-www-form-urlencoded’”

One of the suggested mitigations for this type of attack is Sub Resource Integrity (SRI). This means you includea hash of all of your third-party JavaScript in your code. The browser then pulls the hash, makes its own, and compares them. If it detects something has changed it doesn’t load that code. Though, there is a drawback to this approach. Since, if you or the vendor make changes you need to redo the hash and redeploy. It can be orchestrated but given that some popular browsers like IE and Edge don’t have full support; SRI hasn’t taken on huge amounts of adoption. As more third-party code is adopted, the number of secret hashes would have to grow dynamically, and something would have to become the single source of truth for all JavaScript on the planet –an unlikely proposition.

Too Slow to Execute

An often-overlooked impact of the increased number of third-party code snippets executing on a web site is their impact on the page load speed. Some of this code is used to build the page dynamically, for analytics purposes, to provide user experience feedback, or to protect the site from automated attacks.

Using Google’s PageSpeed Insights (https://developers.google.com/speed/pagespeed/insights/) to analyze commonly used web sites, demonstrates where the greatest page load impact was. In cases where the page had a third-party code performing obfuscation or just doing of-page calculation, the page loads were dramatically increased. Performance tuning for these sites would need to include removing some of these components as they are just getting in the way, causing user friction from load times and offering yet another third-party set of code being utilized.

Image 3: The impact on user experience when third-party code executes at page load.

In the more extreme cases, PageSpeed Insights showed that JavaScript designed to collect telemetry for automated attack protection added five seconds to a fairly simplistic page’s load time. In the age of password vaults, the authentication waiting game is no longer a hiding place for third-party code execution. Users have come to expect pages to load quickly and without much fuss.

Adding third-party code can be a great way to create interactivity with your end users and create a positive user experience. However, you should place it inline on your site only with an extreme amount of care and caution. Not knowing what that code does, how it executes, or its impact on the browser, can introduce risk.

As we begin to see more and more attacks happening on this layer, we need to realize that having a good inventory of our third-party resources and having policies to track when it changes is important. Otherwise attacks on this vector, such as credit card skimming, might go unnoticed. If your application has so many dependencies that you cannot effectively understand if one changes, you should look into having a better inventory of your dependencies and how they impact user security as well as user experience.

Looking for a way to protect your public-facing applications? Learn more about App Firewall in the video below.

For years, the security implications related to Industrial Control Systems, SCADA and Industrial Internet of Things have been treated as a low(er) priority because these systems were closed, embedded deep in the shop floor, and had minimal network connectivity. Today, these systems have network connectivity, and are accessible from the web, but the security stance remains largely unchanged. Recent joint research with a channel partner specializing in ICS in manufacturing environments confirms that security risks exist either through system vulnerabilities or via some other attack vector such as password spraying.

Imagine you are building an assembly line and you need to feed a process with parts that will come together as a sub-assembly. Computers do a great job of understanding if the right number of parts are available while Programmable Logic Circuits (PLCs) can be used to automate repetitive, singular tasks. In our assembly line, we are putting together Wheels and Tires that ultimately will be mounted on a car that hasn’t been made yet. As the tire moves down the assembly line it must be placed in the correct alignment to be put on the wheel. A camera takes a picture of the tire as it moves along and if the tire isn’t oriented correctly for the next machine to pick it up, a subprocess flips the tire over or turns it to the right orientation. This creates efficiency for the person loading the tires onto the assembly line because they don’t have to manipulate the tire, just get it from the truck onto the conveyer belt. These systems are simple and not much thought goes into them once they are in place. Eventually, however, someone will want to find another efficiency in this process.

Enter the connected world of data gathering for Industrial Controls. How many times has the tire been flipped? Is there some way to impact the speed of the downstream process if the tire was placed in the correct orientation when put on the truck? These are the questions that manufacturers iterate through to find incremental yet impactful efficiency gains. ICS manufacturers want to help and so, they have created modules that connect ICS components to the IT infrastructure. Slap in an ethernet module, run a cable to the closest switch and boom, online ICS. Connectivity, in this case, is both a blessing and a curse. The blessing is that we can now program the ICS logic for the PLCs, gather data on how many times it does its job, to better understand where efficiencies can be created. The curse is that the IP connected devices are now more visible to the outside world, specifically the bad actors.

Just because we can connect these devices to the web, does not mean one must connect them. Once connected, security for devices that ignored the concept in the past is now top of mind. Prior to connecting our ICS to the Internet, we would physically connect to it with a laptop to change the logic. This meant that a bad actor would have to have the technology but also the physical access to the systems they want to change. Now we have created a low-cost mechanism that allows for changes the logic on the fly but, we have increased availability of the system to a bad actor as well.

Old Habits Die Hard

The next phase of logic programming and reading sensor input was an interface between the humans and the machine was usually a dedicated device called an HMI (Human Machine Interface), basically a small keypad or touch screen. If used at all, authentication was usually a username and password that was shared or known by every person on the manufacturing floor and often, they were the default credentials when the system was installed. Again, these systems have been put on the internet and for simplicity’s sake, use the same credentials. With the average life of around 20 years, these systems came online with an immediate security debt that will be around for a long time.

Now that we have them plugged in, the HMIs aren’t as important. There isn’t a need to buy the HMI modules if you can just connect via a web browser. Many of the more modern ICS systems are ditching the HMI panel for a centralized control that is “online” and can be accessed from anywhere. Want to guess what the usernames and passwords are now? Our research shows that old habits die hard – customers still prefer having the same credentials as for all the users, making it easier for everyone to remember. Password reuse has been in the news quite a bit lately, a security best practice is to use a different password for each site. Credential sharing of both the username and password leads to the elimination of a control that is put in place to ensure the security of the systems and potentially the safety of the manufacturing floor. Password spraying techniques are certain to work in ICS environments and connecting them to the Internet means anyone could execute password spraying attacks.

Keep in mind, these are the same types of systems and controls that are used in critical infrastructure. Logic controllers, dependency driven activity, all that assumes the data take in is good and the action can be taken regarding the input. As we look at possible attacks here we can easily see that having the same authentication credentials as being right next to the systems, means anything can be changed remotely if the attacker has the password. The first phase of many of these attacks is to just try username and password combinations that will certainly work, or in the case of Mirai, the BOTs can just try the few they know will work. If Iranian driven BOTs are turned onto critical infrastructure, that has a common username and password and was never intended to be put on the Internet, it is possible simple password spraying is all they will need. We don’t want a group of attackers finding flaws on our onshore nuclear power generation sites, nor do we want them causing problems really anywhere.

Whether the system is simple, like in our tire flipping example, or more complex systems like our critical infrastructure, the need for better security is obvious. If the machines aren’t acting safely, are causing delays or over-consuming materials, the efficiency of the automation is working against the manufacturer and can cause severe problems that may not be noticed for weeks or months. When things are going well, we tend to not peer into the darkness.

During the month of January, we will be putting together a lab with the latest technology available and we will be digging into ICS systems, SCADA and Industrial Internet of Things components to look at what may or may not work from a vulnerability exposure and exploit standpoint. Stay tuned for the results of our research and what steps can be taken to secure your ICS and SCADA environments.

The cat and mouse game between bot operators executing automated attacks and prevention vendors has become increasingly sophisticated, with each side applying more intelligence to their respective prevention or malicious efforts. Prevention vendors collect increasingly sophisticated telemetry while bot operators reverse engineer to fully understand the detection techniques, creating single request bots that blend in among a sea of valid values.

A perfect bot, commonly referred to as a single request bot, is a tool that generates a perfectly unique, anonymized request that is different from other responses, yet is close enough to the universe of legitimate users such that it will be indistinguishable for prevention vendors. Bot operators know that prevention vendors can use browser fingerprints, IP addresses, credential/payload telemetry, and the elements in an HTTP request to detect malicious intent. The perfect single request bot attempts to randomize and anonymize its telemetry to effectively blend in with legitimate human transactions.

The Rise of Single Request Bots – How are They Created?

To create a single request bot, bad actors will analyze exactly how the site or application/API functions to more fully understand the application telemetry that needs to be submitted, copied from legit users, and spoofed.

For example, when attacking a web application this would mean understanding popular browser profiles and generating browser fingerprints that look exactly like the profiles, while diversifying values like User-Agents, Language tokens, etc. and ensuring that any telemetry gathered by JavaScript running in the browser is either blocked, spoofed or randomized. When attacking a mobile endpoint, the bad actor may decompile the app or scour the published API documentation to understand all the required request parameters, and then generate millions of unique requests. Finally, many single request bots also will fetch valid device tokens, session identifiers, and other stateful identifiers from the app or web server itself. In this case attackers, aren’t spoofing values, but actually using the app as intended, at large scale, all while appearing to look like millions of legitimate users.

Once a bad actor fully understands how the target application operates, the next step is to enable the attack. There is an ecosystem of services available that enable single request bots, particularly services revolving around tools and infrastructure.

• Tools: These services exist to make it incredibly easy to create single request bots. This includes forums where off-the-shelf tools are sold, customized and traded. These tools will include the
  techniques described above out-of-the-box along with Captcha bypass capability and top-of-the-line Captcha solving services. Finally, another set of enablers are markets like the Genesis Market, where browser fingerprints can be bought and sold, both allowing attackers to blend in with humans and understand what they look like from the perspective of prevention vendors.
• Infrastructure: Next, services such as Bulletproof Proxy Providers are purpose built for large scale IP rotation, randomization and blending in with a pool of legitimate humans. The BulletProof Proxy endpoints that attackers route their traffic through take care of the IP rotation for them, increasing the ease of use and lowering barriers of entry for attackers.

The combination of these sophisticated techniques, sharpened over time by the ongoing game of cat and mouse, combined with these enabling services like markets, tools and Bulletproof Proxies has led to an explosion in the use of single request bots to execute automated attacks.

The Fall of Single Request Bots – How They are Detected and Prevented

As single request bots continually adapt their behavior to blend in with legitimate traffic, common detection techniques based on rules and static heuristics are becoming less and less effective. Of our Four Pillars of Detection Framework (Credentials, Tools, Infrastructure, Behavior), the most powerful single request bot detection technique is the Behavior Pillar – looking for the unique, yet subtle characteristics that distinguish a single request bot from legitimate traffic. Detecting Tools, Infrastructure and Credentials are key factors, but the Behavior pillar is where the most sophisticated detections take place.

Fundamentally, the behavior of a bot attack is difficult to change, because doing so distorts the unit economics that make bot operating profitable or successful in the first place. For example, if an attacker is using real, freshly generated cookies fetched directly from the app that have some element of a timestamp incorporated, they are faced with a dilemma. For the attacker to throttle down and use values that are somewhat aged based on the timestamp, they would have to slow the bot down, consuming additional resources and costs to the point where it may no longer be profitable. This is an example of a technique used by single request bots that can be detected by our Behavioral Pillar.

In another example, if attackers want to use “sticky” IP sessions while using Bulletproof Proxy residential providers (detected in Infrastructure), they cannot outsource the IP rotation to the proxy provider, as that manner of rotation is easily detected by our Behavior Pillar. The attention to detail associated with IP rotation and when it occurs is time they must invest in customizing the bot, a behavior that is time-consuming to change and one that represents its’ own opportunity cost.

Finally, in the battle of automated attacks like credential stuffing, attackers rely on the law of large numbers to make sure they evade detection and get a return on their investments. As prevention vendors, we can turn that paradigm on its head and use the same large data set of user credentials to aid detection. An attacker may learn how to blend in with a particular type of user, particularly through fingerprinting markets like Genesis.

Prevention vendors have the unique advantage of understanding not just what each individual good user looks like, but also what a basket of good users look like, as we have gained over years of analysis of customer data, and we can use that information asymmetry to our advantage. As attackers attempt to rotate through a universe of valid values, the manner of rotation and randomization itself is in fact a feature that can be used in machine learning models to tell us if a client is lying about who they are. Cequence analyzes requests in batches, comparing them both to known good and to each other, with a focus on the Four Pillars of Detection allowing us to use this behavioral information to mitigate the threat of single request bots.

I recently joined Cequence as a Hacker in Residence and am excited to focus on the world of automated attacks and how BOTs are used for things like account take over and credential stuffing attacks. The research into the attacks and customer stories are incredibly intresting.

When I heard that roughly 10 million accounts were created on Disney+, my newfound interest in BOTs told me that the next thing we would start to hear about was compromised credentials. As well as being able to purchase lists of compromised accounts, and as often is the case, purchase a tool to utilize the service automatically.

The gaming and entertainment industries represent lucrative targets for account takeovers, so much so that a complete black market exists where a user can buy a plugin for any number of tools with the goal of committing fraud or theft on a specific target. No doubt, the Disney+ launch was on many bad actor’s minds as it moved towards launch, but it was a bit surprising how rapidly we saw Disney+ accounts for sale on the web.

Our CQ Prime threat research team maintains a list of locations where a bad actor can locate BOT configurations for various credential attacks. Sure enough, (very) shortly after the Disney+ launch, stolen account lists began appearing. The initial lists were not high quality, just a new and probably less famous BOT director trying to get the first cash for a new exploit list. However, then 7-day trial accounts began to appear followed by three year pre-paid accounts. The records even included the network and device type registered to the account in the event the BOTs need to change behavior for the next phase after Disney’s streaming service puts some mitigations in place.

The easy registration process that Disney + deployed was a double-edged sword. While it resulted in a successful launch, it also provided a terrific target for bad actors designing bots to attack accounts that they know aren’t expired and that possibly have credit cards associated with them.

The bot forums and Tweets are buzzing with information on the accounts that have been taken over. The highest value accounts are those that have tied a credit card to the account that can be used to purchase other services (fraudulently).

Utilizing the highly iterative lists and credential testing, the bot organizations can identify legitimate accounts that are likely to have a credit limit worth exploiting and might not notice a password change. In the event a user is reusing their email, the match means the end user could be locked out of both accounts while the attacker consumes content and products/services across the Walt Disney Family of Companies.

What Could Disney Have Done Better?

Multi-factor authentication as an option would have been nice. I know the account needs to be used by non-tech savvy individuals that might be on a ROKU, but it still should have been a consideration. Even if the two-factor authentication was done in their phone app, it would have protected a few of Disney + Customer from successful account takeovers.

BOT Detection/Mitigation, these were known sources and known attack vectors. At Cequence, we battle these ever-morphing attacks hour in and hour out. The BOTS are getting better and better, and we have to make sure we track their every move and watch for their changes to keep up. Cequence and our 4 pillars of detection strategy would have identified the attacks as coming from tools available on the market, bad networks (like bulletproof proxy networks), spilled credentials available through many sources including this data dump, and analysis of the attackers’ behavior. Our methodology has been proven to stop these types of attacks.

Learn more:

watch a 5 minute demo of API Spartan

Next week we will be at FS-ISAC in Washington DC (booth #60) to present (Monday, Nov. 18, 4:15PM-5:00PM) and talk with financial services organizations about how we can help them prevent fraud and theft that may result from automated account takeover attacks against their mobile and API-based applications.

It’s no secret that financial services organizations represent the crown jewels for automated account takeover attacks. More often than not, bad actors will execute their ATO attacks via the mobile application. The mobile application is decompiled and analyzed to discover how it works and how the APIs are used.

As highlighted in this video by Alissa Knight from Aite Group, the mobile APIs that enable the financial services application are used by bad actors to automate their account take overs. The Aite Group report found that 27% of FSI applications hard-code the API keys and private certificates in the apps or store them in files on the file system, thereby simplifying the execution of an automated attack.

This data point is supported by data published in the CQ Prime Bulletproof Proxies research report which showed that more than 70% of the automated attacks across financial services customers targeted the mobile application. APIs are an invaluable tool for application developers who are tasked with doing more with less. Driven by mobile device ubiquity and the move towards modular applications, APIs have become the foundational elements of the application business logic. By targeting the API instead of scripting a form fill, a bad actor can leverage the same benefits of ease of use, efficiency and flexibility that APIs bring to the development community.

This data point is proven accurate by this financial services example. A financial services customer was able to detect and block an account takeover attack that targeted the mobile application account login and if successful, would transfer funds to their own (fake) account using the OFX API – the financial services funds transfer protocol.

Bad actors decompiled the mobile application to (1) discover the account login APIs. An automated attack was then executed against the login API (2) and if successful the bad actors attempted to commit financial fraud by transferring funds (3) across the Open Funds Transfer (OFX) API.

Cequence was able to detect and block this ATO attack using our intelligence-based approach that automatically discovers all application endpoints – API-based, web, mobile. That visibility can then be used to protect the applications from automated attacks. The customer chose Cequence for the following reasons:

• Our AI-based, out-of-band approach was developer-friendly, eliminating JavaScript and mobile SDK instrumentation penalties such as:
  1. Application deployment delays caused by QA and App Store validation cycles;
  2. potential security gaps across application versions/channels including web, mobile and API-based;
  3. user dissatisfaction from slow page loads.
• Automatic and continuous application discovery and visibility: The AI-based approach automatically discovered all applications, both current and newly deployed/updated, giving them visibility and the power to immediately turn knowledge into policy actions.
• Open, extensible platform: CQ Insight management allows the customer to quickly discover and prevent automated attacks while the REST-based APIs allows them to export the CQ botDefense findings to their existing security infrastructure for log analysis and reporting.

To learn more, come see us next week at FS-ISAC in Washington DC where we will present (Monday, Nov. 18 4:15PM-5:00PM) and demonstrate CQ botDefense (booth #60).

Not going to FS-ISAC? Check out this 5 minute video of CQ botDefense.

Automated bot attacks are a bit different than other types of cyber-attacks in several ways. First, these attacks are difficult to defend against because they appear to be legitimate uses of the public-facing application business logic (e.g., login, account sign up, browse, shop, check out, etc.), and blocking the seemingly real traffic without due cause can result in lost business or customer dissatisfaction.

Another key, yet subtle difference is the bad actor’s persistence. Whereas a bad actor looking for, yet not finding a specific application vulnerability may move on to a new target, those who are executing automated attacks are persistent, continually changing tools and tactics to achieve their end-goal of committing loyalty points fraud. These characteristics are exemplified in a summary of attack activity targeting a large retail customer over the long Labor Day weekend and into the early part of September.

The weekend began with a massive, sustained, multi-application attack campaign of more than 23 million requests. For perspective, these attacks were 3X the total amount of traffic – both good and bad – observed in an entire normal week. The attacks observed and repelled can be broken down into five distinct campaigns summarized below:

• Campaign #1: This first attack of the weekend was relatively small, sending roughly 1.5M requests distributed across 3,800 unique IP addresses owned by a known Bulletproof Proxy service documented by the CQ Prime Research team. Lasting more than 5 hours, the target of this attack was a legacy, deprecated mobile login API endpoint and all requests were successfully blocked. This campaign is a good example of garden-variety ATO behavior that exhibits obvious characteristics that make it easy to block. However, in the context of the rest of the holiday weekend, this campaign functioned almost as a diversion, drawing attention away from other endpoints open (and targeted) for abuse.
• Campaigns #2 and #3: These two distinct attack campaigns targeted the current, active Mobile Login API endpoint. Campaign #2 lasted only two hours and was seen attempting to emulate the Android version of the mobile application. This attack campaign was more of a recon attempt, peaking at about 40k requests per 5 minute period and was more widely distributed than most ATO campaigns. Each transaction request used at least one unique IP address sourced from organizations in Taiwan, China and Vietnam, specifically HiNet, TE Data, and Vietnam Posts & Telecommunications (VNPT). In many cases, for some US-based companies, appropriate geo-fencing can help provide zero-day mitigation to these recon attempts. Campaign #3 was a multi phased effort that also attempted to spoof the Android application. The first phase was a series of reconnaissance probes that were then followed three days later by the attack itself. Peaking at roughly 73k requests per minute, the attack lasted a mere two hours and was unique in that the source of the traffic originated primarily from cloud provider organizations such as Digital Ocean and resources within AWS. This retooling was likely in response to a lack of success with foreign residential proxy IPs, and the attackers attempted to evade geo-fencing by using cloud providers in the United States. One of the common threads between campaign 2 & 3 is the focus on targeting the mobile login endpoint spoofing the Android application. We find that Android emulators are some of the most frequently used attack tools against retailers, as reverse-engineering the application is less difficult than others.
• Campaign #4: This effort featured the reappearance of an attack tool that had not been seen at scale in many weeks – SNIPR. The attack targeted a deprecated version of the mobile login API that has been unsupported for more than three years. This campaign was widely distributed across organizations in the US., Russia, Indonesia and India. What was notable about this campaign was the persistence of the tool to send bursts of attack traffic throughout the weekend. This is likely due to the ease-of-use of the tool SNIPR and how easy it is for many disparate attackers to get their hands on a copy and launch an attack campaign, during a weekend they know will be popular for shopping.
• Campaign #5: This effort was the largest campaign of the weekend, hammering the current, active web login service with more than 20 million requests distributed across roughly 33,400 IPs, with approximately 55k requests per IP. The vast majority of the requests came from Performance Systems International (PSI) organization, known to be part of a US-based Bulletproof Proxy service that is comprised of hijacked IP space from defunct companies (PSI was a large ISP in the first dot-com boom later acquired by Cogent).

Analysis of timing and traffic sources indicate that campaign #5 was a diversionary tactic to draw attention away from another part of the attack campaign – low & slow attack requests against the deprecated legacy Web Login flow. This campaign was persistent, lasting more than 24 hours despite complete blocking on both application endpoints. Furthermore, this attack campaign attempted to fool many common browser fingerprinting techniques by reverse engineering and trying to uniquely rotate through combinations to fool those techniques. That explosion in unique fingerprints, distributed across a period of a day-long campaign, can be difficult to detect without proper behavioral analysis that can connect the dots, linking the campaigns and focusing on [blocking] the account takeover behavior rather than attack tool signatures.

Observations

Based on the CQ Prime Four Pillars of Detection framework, the attack activity exhibits some of the following characteristics:

Tools observed: Off-the-shelf tools like SNIPR, Android emulators targeting the customer’s mobile app and custom attack toolkits designed to rotate and fool browser fingerprinting techniques.

Infrastructure used: Attackers used more than 38,000 high fidelity, residential proxies (IP addresses) distributed globally to make the activity appear to be legitimate while masking their identity and location.

Behaviors observed: The volume and variations observed in these campaigns highlight how persistent the bad actors are in achieving their end goal. Additional behaviors observed include:

• Several of the attack campaigns appeared to be diversionary in nature, drawing resources away from the ultimate target.
• Significant background work was done to find and target legacy, deprecated login endpoints in an attempt to avoid detection.
• Using a browser rotation toolkit, the campaigns spoofed thousands of browser fingerprints to avoid detection.

Credentials: The credentials used in these attacks were likely sourced from the billions of compromised records readily available on the dark web. As valid credentials were discovered within the
campaigns, they were sent to the fraud department for additional analysis and follow-up actions.

The customer’s security team successfully blocked a massive attack over a long weekend, ruining the efforts that the bad actors had put forth. The effort put forth by the security team was significant and took away from any Labor Day activities. However, this inconvenience was offset by the tremendous satisfaction derived in the successful defense of the customer’s loyalty points program.

Learn more: Watch a 5-minute video of API Spartan.

As the holidays draw nearer and consumers begin frequenting their favorite online retailers in search of the perfect gift, it seems an appropriate time to put the spotlight on a topic that gives shoppers heartburn as they search online: shopping bots that automatically buy up all inventory.

For example, it could be the latest Nike Air Jordan shoe, or the hottest items on Supreme’s clothing site, or any other site where the product customers want sells out almost immediately. Yet somehow these items always seem to be available for resale on the secondary market, at extraordinarily high markups, putting a dent in the holiday budget for the most fashion-forward folks among us (known to some as “hype-beasts”).

In this blog, we will explore bad actors’ motivations for carrying out this type of business logic abuse, some of the requirements to execute the attack, and finally some detection strategies for those retailers looking to ensure the best possible experience for their customers attempting to buy their products.

Attack Motivation

At a high level, the motivation for carrying out this abuse is simple – there’s a lot of money to be made. The demand for these popular items vastly outpaces the supply, as is natural with many “limited-edition” items. Any adversary with computer skills and the desire to hustle can easily tap into the arbitrage this creates in the market, where the original retail price is much lower than the price consumers ultimately pay on a secondary market.

In some ways, the relationship between retailers and “botters” began in a somewhat symbiotic way. Retailers were essentially guaranteed sell-outs, tremendous growth numbers for their online business metrics, and lots of buzz for their products. However, as more consumers purchase online, the “soft” costs (bad press, poor customer experience, etc.) become more of a problem. If customers can’t buy the products they really want, it can generate frustration. And if they buy from a secondary market, they can be left with a bad feeling of getting ripped off. Nevertheless, the growth and subsequent value of secondary market sites have soared over the past few years, providing legitimacy and a well-functioning market for legitimate retailers, bad actors, and consumers alike.

Attack Requirements

To analyze what a person needs to carry out one of these campaigns, it helps to relate back to our CQ Prime Four Pillars of Detection framework.

• Tools: there are many types of “botting” tools that can be used by almost anyone. These include AIO Bot, SupremeBot, EasyCop, NikeSlayer, etc., and are available for purchase on many marketplaces These tools are effectively customized platforms designed to attack specific targets, and due to their popularity, are continually updated and refined through crowd-sourcing. Terminology such as “grails,” “cooking,” “copping” and more are all examples of lingo that is specific to this category of attack tool.
• Infrastructure: Once again, this component of the campaign offers many services specifically for attackers trying to abuse retail sites, by automating the entire purchase flow thousands of times and anonymizing themselves. One example of these services is the popular “Rotating Residential Proxy” service offered by many providers. These proxy services allow attackers to blend in amongst the exact same type of IPs used by legitimate customers. Blocking these IP networks outright is functionally impossible from a detection perspective, and the bad guys take advantage of this loophole and drive a truck through it, using services that take care of the IP rotation for them.
• Payload & Behavior: With these attacks, bad actors have two more requirements that are essential to their monetization scheme. First, attackers need target brands and exact dates during which to run/use their bots. They must know which items they want to procure, and they must know when the items will “drop” so they aren’t burning through resources before the items are available. This frequently manifests itself in operators writing a “recon bot” that crawls and indexes sites and monitors for the first hints of a sale or item release. Second, they need a mechanism to quickly and efficiently carry out the purchase process, have credit cards to make payments, locations to hold inventory, and most importantly – efficient markets to quickly resell their goods at a high margin.

Detection Strategies

The markets for tools and infrastructure are so well developed that trying to develop signatures and block IPs will be a fruitless game of whack-a-mole forever. So the focus, in this case, needs to be on the underlying attacker behavior. Fundamentally, these bots want to purchase hot brand items, lots of them, as fast as possible. There is an extremely competitive landscape among bot operators themselves, and they are resource-constrained. They must be fast and efficient, and can’t waste time or money introducing human-like behavior that will send spurious requests. But forcing them to change their behavior can negatively impact the operators’ ability to earn a profit.

At its core, our detection strategy rests on understanding the transaction flow for good humans, at large scale. We can then use the knowledge of “good-at-scale” to detect behavioral anomalies, some of which include:

• An abnormal ratio of requests targeting exclusively popular brand items, without appropriate browsing requests to get to those pages or requests to other products that a normal user would at least have a high likelihood of visiting.
• IP-rotation patterns that are characteristic of using rotating residential proxy services, particularly the rotation of an IP address throughout one shopping session.
• The presence of the “recon bots” that are watching for drop dates and sales, and seem to continually look for items and pages that may not exist yet.

These types of automated bot attacks are a problem that is not going away, and retailers need strategies to mitigate and reduce the damage these bots can do to their brand, their customers, and their user experience. After all, robots don’t wear sneakers and real humans would like to know they’re not engaging in an unwinnable “race against the machines” just to buy a holiday gift before it’s gone.

It’s no secret that APIs are an invaluable tool for application developers who are tasked with doing more with less.

Driven by mobile device ubiquity and the move towards modular applications where APIs are used as the foundational elements of the application business logic, organizations are using APIs for many things, including to facilitate interoperation with other applications, reduce development time and extend functionality.

Source: SmartBear State of the API, 2019 Report

Unfortunately, APIs are commonly used for automated attacks against public facing applications, as shown in the Prying-Eye vulnerability attackers. According to Gartner, by 2021, 90% of web-enabled applications will have more surface area for attack in the form of exposed APIs rather than the UI, up from 40% in 2019¹. By targeting the API instead of scripting a form fill, a bad actor can leverage the same benefits of ease of use, efficiency and flexibility that APIs bring to the development community.

An example of an API-based attack against a financial services mobile application is shown in the image below. Bad actors decompiled the mobile application to (1) discover the account login APIs. An automated attack was then executed against the login API (2) and if successful the bad actors attempted to commit financial fraud by transferring funds (3) across the Open Funds Transfer (OFX) API.

Bad actors will deconstruct the mobile applications which are heavily reliant on APIs to then launch an automated attack. For example, a financial services customer was able to detect and block an account takeover attack that targeted the mobile application account login. The bad actor, if successful, would then try to transfer funds using the OFX API.

Cequence was able to detect and block this ATO attack using our intelligence-based approach that allows API Spartan to discover all application endpoints – API, web, mobile – protecting them from automated attacks. Our unique approach to detecting and preventing automated attacks eliminates application instrumentation and mobile SDK penalties that may result in application deployment delays, security gaps and user dissatisfaction. An added benefit is consistent protection against all manner of automated attacks – ATO, fake account creation, content scraping and more – regardless of which application channel is being attacked.

Learn more:

• Watch: Cequence Unified API Protection

1) Gartner, API Security: What You Need to Do to Protect Your APIs, August 2019

A leader in online dating, Zoosk is committed to delivering personalized matches to its 35+ million members. With the ultimate goal of creating lasting and meaningful relationships, protecting their users from fraud that may be caused by automated bots is a top priority for the Zoosk security team.

Finding Love and Romance – Securely and Safely

Finding a lasting relationship often means letting your guard down. Unfortunately, bad actors are adept at taking advantage of this to execute romance scams. To do this, scammers infiltrate popular platforms and attempt to build connections with legitimate users before asking them to part with their money.

However, to bait other users, they first need accounts and lots of them. The two easiest ways to get them?

Fake Account Creation

Bad actors analyzed the Zoosk user interface and mobile applications to understand the platform’s account creation processes, including the identification of APIs to exploit. In one example, they used the Android mobile application APIs to programmatically establish fake accounts, leveraging compromised infrastructure to execute their attack and masking their identity and location.

Account Takeover (ATO)

Also known as ‘credential stuffing,’ bad actors use this method to validate sets of stolen credentials en masse through automation. And, with 52% of all users reusing login credentials, the success rate makes it an effort worthwhile. Accounts with credentials that are successfully verified are either resold or used by the same attacker as a vehicle for their romance scams.

These automated threats often lead to high-volumes of malicious traffic. In Zoosk’s case, they determined that, on an average week, 80 to 90% of their traffic was synthetic, which significantly increased AWS infrastructure spend.

Zoosk Looks for Their Match

Zoosk’s primary mission is to help people connect and find love on their platform. So, with a goal in mind to protect their users from fraud and improve their application security posture, the IT security team began evaluating possible solutions.

One of the first bot detection and mitigation solutions they implemented leveraged client-side JavaScript injection and mobile SDK to defend against ATO attempts and fake account creation. At first, the approach seemed effective enough. However, as time progressed, two key issues arose:

• With the client-side approach, attackers were able to catch on and began to examine and reverse-engineer the deployed solution. Their new understanding subsequently helped them evolve their attack strategy to avoid detection. Eventually, Zoosk saw that their new defense had a diminishing impact on stopping bad actors who leveraged bots.

• In addition to their web applications and APIs, Zoosk also needed to secure their mobile applications. Though they were provided with an SDK, deploying the new security measures with every new release for every OS began to introduce significant friction into their DevOps process.

Partnering with Cequence Security

Realizing they needed a different approach for protecting public-facing applications against bot activity, Zoosk considered other options. Ultimately, they discovered Cequence Security’s Application Security Platform (ASP) and opted to replace their existing bot detection and mitigation solution.

By tracking the unique multi-step behaviors of real attacks against Zoosk’s applications, Cequence Security gave the Zoosk security team the visibility they needed to distinguish malicious bots from legitimate activities and mitigate them.

The Cequence ASP analyzes every interaction from a user, client, network, and application perspective. It then uses the resulting data to build a syntactic profile through machine learning models, behavioral analysis, and statistical analysis. This approach allows Zoosk to accurately detect automated attacks and create informed policies to mitigate them – even as bad actors re-tool to avoid mitigation.

In 2018, a breach exposed the access tokens of more than 50 million Facebook accounts. With Cequence, Zoosk was able to detect and address the spike in login activity generated by bad actors that reused the exposed tokens in attempted ATO attacks against Zoosk.

After deploying the Cequence ASP, the dating company was able to future-proof its application security approach, reduce AWS spend, and improve user experience. Since, after deploying Cequence ASP on AWS, their platform efficacy improved.

While Cequence was founded to solve some of the hardest real-world application security challenges, this story is also about the teams behind both platforms. Zoosk cited that the support from the Cequence Team has been amazing, and delivered a great customer experience.

We can honestly say we’ve enjoyed working with them equally.

Want to know more?

Watch the full interview with Conor Callahan, Technical Lead of Platform and Infrastructure at Zoosk:

The Prying-Eye vulnerability is an example of an enumeration attack that targets web conferencing APIs with a bot that cycles through (enumerates) and discovers valid numeric meeting IDs. If the common user practice of disabling security functionality or not assigning a password is followed, then the bad actor would be able to view or listen to an active meeting.

Numeric or alpha-numeric sequences are quick and easy mechanisms used to grant access to online resources at scale. When deployed with security disabled or ignored, these numeric identifiers become easy targets for automated attacks. The widespread use of APIs that connect web forms to backend systems, or to other applications make these types of automated attacks easier to execute. In the case of the Prying-Eye vulnerability, users should adopt the best practice of using vendor-supplied security functionality to protect their meetings, and if possible, confirm the attendee identities.

This vulnerability highlights the astronomical growth of API usage and the need to secure them not only from traditional vulnerability exploits, but from seemingly legitimate, yet automated bot attacks. Driven by mobile device ubiquity and the move towards modular applications where APIs are used as the foundational elements of the application business logic, direct-to-API attacks are increasingly common. By targeting the API as opposed to scripting a form fill, a bad actor can leverage the same benefits of ease of use, efficiency and flexibility that APIs bring to the development community.

• APIs are the language of the Web: According to Gartner, By 2021, 90% of web-enabled applications will have more surface area for attack in the form of exposed APIs rather than the UI, up from 40% in 2019¹. Mobile and smart devices use API calls to ensure optimal performance and user experience. Yet at the same time, mobile applications can be analyzed to more easily program an attack, as highlighted in the Aite Group Analysis of Mobile Applications. As shown in the image below from SmartBear State of the API, 2019 Report, organizations are using APIs for many things, including to facilitate interoperation with other elements, reduce development time and extend functionality. In most cases, the APIs are exposed and commonly well documented, making the bad actors’ job easier.

• Stateless nature of APIs means better performance: By design, APIs are stateless, assuming that the initial request and response are self-contained, holding all the information needed to complete the transaction. Using an API directly, or in a mobile or web application improves user experience and overall performance. This makes it very easy for a bad actor to script and automate their attack.

The ubiquity and stateless nature of APIs are beneficial in many ways, but they also introduce numerous challenges that traditional security technologies cannot address.

• No client-side footprint: By design, APIs do not assume a client-side component, so traditional defense techniques like Captchas or JavaScript/SDK instrumentation cannot help. This was the case in the Prying-Eye discovery and would be the same for any direct to API use case.
• No corresponding browser application: The direct-to-API approach assumes that there is no corresponding browser or mobile app for user redirection and associated instrumentation and cookie assignment. The result is the API and associated application is left unprotected.

The Cequence Application Security Platform prevents enumeration attacks and API abuse using CQAI, a patented machine-learning analytics engine that detects the all of the application end points including web, mobile and those that are API-based. CQAI then analyzes the application requests to determine the intent and if deemed malicious, allows you to mitigate the attack through blocking, rate limiting, geo fencing, or deception.

Watch this 5-minute video to learn more:

1) Gartner, API Security: What You Need to Do to Protect Your APIs, August 2019

Average Theft Prevented Per Romance Scam: $12,000

Credentials represent one of the Four Pillars of Detection that the CQ Prime Research Team uses to help our customers understand and ultimately prevent automated bots and the associated fraud. It’s common knowledge that credentials are used to create fake accounts in an automated manner to achieve fraudulent goals such as spreading (dis)information on social media or scamming companies out of sign-up bonuses and referral bonuses.

One of the more elegant and financially lucrative fraudulent outcomes that can be achieved through manual, or semi-manual fake account creation are romance scams executed through relationship sites. Executing a romance scam requires the bad actor to analyze and understand the relationship site account registration business logic, finding potential holes that can be exploited to achieve the end goal.

Today we will discuss how our analysis of anomalies inside the (account) registration payload, and the associated attacker behavior allowed us to detect and mitigate a sophisticated, multi-application fake account creation and romance scam campaign.

The methodology of the bad actor, and the logic they abused in the defenses, can be best described as a thief who finds the front door locked, but through a bit of investigation, finds a side window open. With the scene of this analogy set, let’s dive into the details of how attackers abused the registration APIs to accomplish their goal of creating fake accounts.

First, the bad actors tried to enter the site through the main web registration page (front door) which was instrumented with device/browser fingerprinting and JavaScript-based telemetry designed to prevent automated signup fraud. The bad actors filled in the registration form manually through a technique best described as keyboard smashing to produce random character strings resulting in unique emails from the most common domains (ajkjqowllhlhu@gmail.com). This random character set gave them a high chance of creating an email that didn’t exist before, therefore moving them to the second step in the attack flow – the email verification.

The email verification was performed through an API that sent the link out to a third party for account verification and activation. Having analyzed the entire registration process, the bad actor knew that the random string emails didn’t exist, so the email was rejected, and the user was sent to another API (side window), where they were prompted to re-enter a valid email address.

The typo correction flow was not instrumented with the same device/browser fingerprinting and JavaScript-based protections, allowing the users to create legitimate (yet fake) accounts and associated profiles with valid email addresses following a distinct pattern themselves (jane456smith@gmail.com). Once the fake account had been established, the subsequent profile creation sessions did not have the JavaScript-based fingerprints and device identifiers used to protect the front door because the bad actor followed the application business logic to bypass the defenses.

In the case of this attack, step one was manually executed while step two, the email correction and subsequent profile creation were automated, giving this attack a sophisticated hybrid structure. With the profile created, the longer-term (manual) process of establishing a relationship to then commit financial fraud could begin.

Insights Gained

Now that we understand the bad actor’s flow, we can discuss a few insights we learned from the defensive perspective.

1. It’s impossible to predict how and where a determined bad actor will attack legitimate business logic flows designed to improve user experience (in this case, the ability to seamlessly correct an email error). These flows are ripe targets for abuse. It’s critical to have consistent telemetry and security baked into the application flows.
2. Focusing solely on automated behavior may be a red herring and is irrelevant to the actual attack outcome. The behavior that is a manifestation of the attacker’s goal – in this case creating large numbers of fake accounts – is what is most important to try and detect.
3. There is significant value in the ability to inspect the sensitive payload data values such as username and cookies to derive behavioral patterns.

Summary

This example is one of the many ways bad actors attempted to establish fake accounts. Rather than use credentials that are stolen and readily available on the web, the bad actor created credentials on the fly that they could then use to establish a fake account. With the fake account creation complete, they could then move on to the next, more lucrative phase of the attack: romance scam. By stopping the creation of fake accounts and subsequent profiles, our customer was able to stop romance scams which had resulted in an average theft of $12,000.

I’d like to introduce you to CQ Prime, the Cequence Security threat research team whose singular mission is to help the security industry and our customers understand the Tactics, Techniques and Procedures (TTPs) utilized by cybercriminals who execute automated malicious bot attacks against your public facing web, mobile, API-based applications. These attacks target your application business logic with what appear to be legitimate or syntactically correct transactions, making it difficult to determine whether or not the actual intent is malicious.

CQ Prime has developed the Four Pillars of Detection framework to help us consistently answer some basic, yet complex questions:

• What are my adversary’s goals?
• What does my adversary need to accomplish those goals?
• Who is my adversary, what resources do they have and how determined are they?
• What should my strategy be to mitigate my adversary?

Our framework focuses on how to think about, understand, and ultimately respond to these sophisticated attacks. At its most basic level, we want to understand what a bad actor needs to launch an attack. The answer lies within our Four Pillars of Detection, which form the foundation of our research framework and are defined below.

Tools

Tools represent the most basic components of these type of attacks. The research surrounding this detection pillar focuses on the heuristics that deal with the immutable characteristics of the code launching the attack or increasingly, the characteristics of an off-the-shelf tool that are difficult to change for novice bad actors. Examples of topics the CSRT will discuss include:

• Deep dives into popular off-the-shelf tools, like “SNIPR”, “SentryMBA”, “BlackBullet”, and “OpenBullet”.
• Analysis of the underlying ecosystem surrounding these tools including who the users are, who develops and distributes them.
• Pricing variations for different types of tools for different targets; a topic that opens a window into the successes and challenges the bad guys are facing.

Infrastructure

Simply put, Infrastructure represents the resources that bad actors need to distribute their attack and anonymize themselves. As such, infrastructure is an essential component to successful automated bot attacks. Our research team will publish findings on:

• The top offending organizations and networks we see being used for abuse across our customer network.
• Increasing use of high reputation Residential IP Proxies (RESIPs) through services like Luminati, StormProxies, and more
• The growth of “proxy-as-a-service” businesses that tacitly allow and encourage fraud through their networks, and are capable of fooling enterprise-grade IP geo-location at scale.
• The continued trend of using compromised IoT devices as semi-public open proxies (to launch the attacks).

From the perspective of a single, victim organization these attacking resources appear disparate, random and therefore more “legitimate”. By correlating data across a wide range of customers with a variety of attack types, distinct patterns have emerged.

Credentials

Credentials are essential for automated business logic abuse. Simply put, bad guys need user accounts – either legitimate and compromised, or fake– through which to carry out these attacks. Our research surrounding the Credentials detection pillar will rise above the “another high-volume breach” signal noise, focusing on how the credentials are used in automated attacks. Topics will include:

• Analysis of techniques and patterns used across many requests that could indicate credential abuse.
• Behavioral analysis of metadata to gain an understanding of a user’s behavior over time.
• Inspection of large-scale manual fake account creation to uncover patterns that may expose the bad actor’s intent.

Behavior

Behavior cuts right to the heart of automated bot attacks as it represents the unique fingerprint a bad actor creates when using Tools, Infrastructure and Credentials to launch the attack. Much of our research into “bot behavior” actually deals with the human element of automated bot attacks. How does the human operator(s) respond to mitigation, friction or any kind of defensive action? Research findings to be published will include:

• How “low & slow” is an bad actor willing to throttle their attack without negatively impacting their unit economics to the point where they are losing money.
• Different types of “fast & furious” attacks, and what the bad actor’s go-to moves are as they continue to try evade detection and carry on with their abuse.
• How qualitative behavioral analysis can aid in both attribution and understanding the bad actor’s motivations, resulting in improved mitigation techniques.

As a security research team, our goal is to analyze what we see within our customer networks and across the industry to better understand the inner workings of a bad actor and share that data to help improve prevention techniques as a whole.

Why CQ Prime?

Many will ask, were did CQ Prime come from? We chose CQ Prime because in mathematics, the prime is generally used to generate more variable names for things which are similar. CQAI, our machine learning-based analytics engine makes heavy use of mathematics to separate legitimate from malicious transactions as a means of detecting malicious bots and targeted application vulnerabilities. Much of our research will be rooted in the data that CQAI provides, so the name seemed to fit well.

What is Bulletproof Hosting?

The concept of Bulletproof Hosting is relatively well known in the security universe. These services allow customers to upload and distribute malware, illegal pornography, manage phishing sites, and host other well-known security threats. From the perspective of an attacker, a good Bulletproof Hosting service will:

• Provide anonymity and protection from prying eyes of law enforcement. This can include being located in countries and jurisdictions that will not comply with law enforcement in the victim countries.
• Be obscure enough to the general public, such that IP blocks will not be “polluted” by low-level criminal/spam operations resulting in the wholesale blacklisting of their IP ranges by most defenders.
• Be resilient to downtime. This could come in the form of downtime due to de-peering of an ASN or de-listing an IP block, as well as DDoS attacks on the servers in use. A Bulletproof Hosting service must be able to minimize downtime for their clients because margins in the hosting business are relatively thin.

Bulletproof Hosting services are key for cybercriminal activities like enabling malware C2, or hosting a phishing domain, all while maintaining safety and anonymity for the bad actor. To launch automated business logic abuse attacks such as account take overs/credential stuffing and fake account creation, bad actors require an infrastructure that provides the same safety and anonymity traits found in Bulletproof Hosting, but also provides global scalability.

The Rise of Bulletproof Proxies: A New Infrastructure for Automated Attacks

To fulfill these new infrastructure requirements, bad actors have created Bulletproof Proxies, a sophisticated infrastructure that builds upon the anonymity concepts of Bulletproof Hosting, yet is tailored to large scale, automated attacks. Bulletproof Proxy networks include millions of globally distributed residential IP addresses, often marketed under the pretenses of being used for legitimate purposes like avoiding censorship or benign crawling, while at the same time turning a blind eye to potentially malicious use. These networks compete against one another for their share of adversarial buyers through different pricing strategies and techniques to build up a network that is both the “easiest to use” and “most difficult to detect”. The combination of these elements makes it easy for bad actors to launch sophisticated attacks on public facing web, mobile and API-based application.

Bulletproof Proxy providers allow users to select a proxy package from their country(s) of choice, with IP blocks distributed across many ASNs, organizations and ISPs to avoid any kind of network-based blacklisting by the victim. When used in an attack, Bulletproof Proxies provide a series of options similar to a robust consumer VPN network, however even more exclusive than many widely available commercial VPNs. For example, an attack targeting a US-based retailer would choose a US-based residential proxy package as opposed to a package from a country where it does not do business. This allows the attack to blend in to normal traffic more completely.

Key Findings from CQ Prime’s Research on Bulletproof Proxies

The inaugural research report, Bulletproof Proxies: The Evolving Cybercriminal Infrastructure is based on the CQ Prime analysis of automated malicious bot campaigns targeting three industry verticals, where Bulletproof Proxies were used extensively to maintain anonymity and distribute the attacks across millions of high reputation, residential IP addresses (such as routers, refrigerators, IoT devices, garage door motors, and others). The report maps attack patterns observed within our customer base to one of the leading Bullet Proof Proxy providers. Among the key findings highlighted in the CQ Prime inaugural research report:

• The least expensive Bulletproof Proxy package allowed the CQ Prime team to send requests through more than 853,000 IPs that were distributed across 218 different countries. Some of the most robust providers advertise networks larger than 32 million IP addresses distributed globally;
• Attacks emanating from Bulletproof Proxy networks targeting Cequence financial services and retail customer environments increased 518% and 800% respectively between Q1-Q2 2019; and
• More than 70% of the attack traffic across Bulletproof Proxy networks targeted mobile endpoints.

The analysis of Bulletproof Proxies would not be complete without an exploration of why the abuse coming from these networks matters in the real world. While many of the uses (both legitimate and not) for these networks can appear innocuous at first glance, this infrastructure is ripe for abuse, and increasing awareness will both help defenders improve detection, and increase preparation for possible unforeseen cases of abuse.

Read our post introducing our Threat Research team.

The retail industry is commonly targeted by bad actors who use stolen credentials and automated bots to launch high volume account take over attacks that result in financial losses through theft and fraud, as well as damage to the brand. The ‘2018 Cost of Retail Fraud’ report published by LexisNexis states that every $1.00 lost to fraud results in an expense of $2.94, a 24% year-over-year increase. Identity theft and synthetic identities (account take overs) represented a whopping 39% of the fraud costs.

For one Fortune 500 retailer, attackers were targeting the loyalty program accounts and when successfully compromised, they would then steal the points or use them to commit fraud. The costs in terms of revenue and over provisioning the infrastructure ran into the millions. Harder to measure impacts were loyalty program participant dissatisfaction and damage to their brand.

After a rigorous vetting process, the customer chose to implement Cequence Security API Spartan and over the course of a year, their ability to prevent account take overs, and their ability to reduce the investment in the associated networking infrastructure came to roughly $2.3 million. Taking into account their investment in API Spartan, their savings amounted to $1.7 million. Their return on investment was 455%, resulting in roughly a two-month payback. You can read the full customer ROI study.

To learn more about how you might be able to achieve similar results, you can schedule a demo with an engineer here.

Back to work after the AWS re:Inforce conference in Boston and the July 4th weekend and I am super pumped about what I learned at AWS re:Inforce. Having attended a couple of AWS re:Invent conferences, which have become ginormous, it was refreshing to attend a security-focused AWS conference. It was a great opportunity to network with the security people at AWS, customers looking for security solutions for their AWS deployments and industry peers. AWS went out of their way to help us connect with their executives during the event, and we are grateful for that. But the most excitement comes from the number of new features that were announced and demonstrated during the conference.

First and foremost, we are very excited with the release of VPC Traffic Mirroring, a service that allows you to capture and inspect network traffic at scale. In traditional data center based deployments, it is common to find network TAP ports which mirror network traffic to network security devices for inspection. This allows for frictionless yet passive traffic inspection, minimizing any potential performance or availability impacts on the applications behind the TAP ports. This functionality has been mostly missing in Cloud environments. VPC Traffic Mirroring changes that. Enterprises can now use the same passive inspection security principles that they followed in physical data center environments, but with a cloud-centric approach.

Our Cequence Application Security Platform protects public-facing applications deployed on AWS from automated, malicious bots and vulnerability exploits using passive traffic inspection to provide complete visibility into the application traffic. Currently, we use NGINX on AWS to send a copy of the traffic to CQAI, our analytics engine, for passive inspection. If a malicious bot or vulnerability exploit is found, you can mitigate it with our lightweight, inline agent. With VPC Traffic Mirroring integration, our customers will be able to use native AWS services as an alternative to NGINX to send a copy of the traffic to CQAI for passive inspection, thereby streamlining deployments on AWS. If a threat is found, you can mitigate by using the REST APIs to send the findings to an AWS or other 3^rd party security infrastructure component (e.g., WAF, SIEM, Firewall).

We are currently testing our integration with VPC Traffic Mirroring with general availability coming in the very near future. We are committed to expanding our use of native AWS technologies to give our customers the best experience in their AWS environments. To that end, look for us to deliver integration with AWS WAF, AWS Security Hub, Amazon GuardDuty, AWS Data Lake, and AWS Simple Notification Service (SNS) in the near future.

We began using Apache Spark in 2015 as an integral component of our underlying data processing infrastructure. We chose to use it for the following reasons:

• It’s a single platform that allows us to implement both real-time streaming as well as offline batch processing. Both are critical elements in our architecture.
• It provides excellent support for machine learning, also a key element of our architecture.
• It is a modern, cloud-centric product, mapping well to our architectural vision; we can run it inside Docker and it has pretty much all the connectors we need for our data sources and sinks.
• Lastly, Spark has a growing body of developers, and the community support is maturing.

Having said that, useful Spark advice can be sometimes hard to find. There are still many uses that are “uncharted” with zero previous experiences to guide your decisions. Like many of you, we’ve had to “invent the wheel”, so in the spirit of open-source collaboration, I wanted to share how we have used Spark Streaming to implement a dynamic sampling strategy.

The Batch Processing Time Problem

Spark Streaming is famously known as a “micro-batching” based architecture. This simply means that the streaming engine is built atop the underlying batch engine, where the streaming engine continuously generates jobs for the batch engine from a continuous data source. Each batch arrives in regular time increments defined by the application which could be as short as a few milliseconds or as long as a few minutes.

Because the source continuously sends data, the streaming engine needs to ensure it processes that data before the next batch gets queued up. If the arriving batches take longer to process than the batch interval time, a “snowball effect” could take place. Eventually, Spark Streaming runs out of resources to keep up with the backlog and simply gives up, stalling or killing the whole application. Obviously, it is extremely important to keep the following to be true most of the time:

Batch Processing Time < Batch Interval time

Many articles have been written on solving this problem for Spark Streaming applications that need to run 24×7. Spark Streaming is extremely flexible, with many knobs that can be turned to help keep the processing time in check. However, as many of you have learned, tuning Spark Streaming is notoriously hard and difficult to predict due to factors largely out of the direct control of a developer. These factors include (but are not limited to):

• Sustained spikes in incoming data rate.
• Resource crunch due to being deployed on a smaller cluster than is needed to support the workload, or a shared Yarn/Mesos cluster being used for other jobs.
• External systems such as target databases/message queues or hardware NICs, routers or disks that are slow and cause processing delays.
• Add to this the vagaries of the software stack itself; the OS, JVM and Spark as well as the application all of which contribute to uneven processing times.

Here is an example where an increase in the input rate causes the processing time to increase which leads to scheduling and total delay to quickly go beyond acceptable (input rate) limits:

Fig. 1: Increased traffic flow results in an increase in total delay (avg. 7+ seconds) without dynamic sampling

Fig. 2: Queued active batches without dynamic sampling

Given the input rate management challenge, an adaptive system that continuously monitors the data processing rate and appropriately reacts by changing the incoming data rate, seems like a more effective strategy. This approach involves measuring the processing rate and applying it to do one of the following:

• Apply backpressure on the source: Reduce or increase the rate at which records are picked up as processing rate changes. Any records not collected are retained by the upstream source and are delivered in subsequent batches.
• Dropping data: Pick up the full complement of records from the source but simply drop the first N records to meet the processing rate. This is only a slight variation on the sampling approach we will discuss below.
• Dynamic Sampling: A better way to reducing inbound data load would be to drop a random sample from the received batch. This is what we term as Dynamic Sampling since the sample size is dynamically adjusted to processing rate.

Dynamic Sampling: The Details

A Backpressure implementation was introduced in an earlier version of Spark (v1.5). It picks up a variable number of input records from the source by continuously measuring and updating an internal metric of how long each batch is taking to process. This is based on a software implementation of a PID Estimator. Learn more about the PID Estimator on Wikipedia and on GitHub using the link spark implementation. The PID Estimator is used to keep track of the current best estimate of how well the overall system is performing and the ideal number of records that should be processed in the next batch such that we keep meeting our goal:

Batch Processing time < Batch Interval time

Spark’s standard backpressure can be enabled by setting a configuration property:

SparkConf conf = new SparkConf();
conf.set("spark.streaming.backpressure.enabled","true");

This works well for applications where the following criteria are met:

• It’s important to Processing each and every record, even with a delay is critical.
• Upstream source(s) can either absorb the backpressure or propagate it further up the chain where an eventual source of events can be throttled.

But what about applications that don’t meet the above criteria or specifically:

• Source(s) cannot absorb backpressure.
• It’s acceptable to drop a certain number of records in order to achieve the overall SLA at the expense of some accuracy.

While Spark Streaming does not have an implementation (yet) to meet these criteria, it’s straightforward to build one that works effectively.

Another useful concept from Spark Streaming is the StreamingListener. A class implementing this interface and registered to the SparkContext will be provided callbacks about various useful events. One of these events is a batch completion event where important information regarding the completed batch is provided. We can implement the method handling this event keeping track of how batch throughput performance and to provide a feedback mechanism to the application’s main loop to implement its own sampling.

The following code snippets shows one of the ways this can be implemented. We first define a class that can be instantiated once and used as a holder for the best estimate from the PID Controller for what the next batch size should be:

public class BatchSizeEstimate implements Serializable {

private long nextMaxBatchSize = 10000;

public long getNextMaxBatchSize() {
return nextMaxBatchSize;
}

public void setNextMaxBatchSize(long nextMaxBatchSize) {
this.nextMaxBatchSize = nextMaxBatchSize;
}
}

Let’s extend the JavaStreamingListener (StreamingListener in scala). In this class, we will instantiate an instance of the internal Spark class PIDRateEstimator and use that in the onBatchCompleted() method to update the next estimate for the batch size.

import org.apache.spark.streaming.StreamingContext;
import org.apache.spark.streaming.api.java.JavaBatchInfo;
import org.apache.spark.streaming.api.java.JavaStreamingListener;
import org.apache.spark.streaming.api.java.JavaStreamingListenerBatchCompleted;
import org.apache.spark.streaming.scheduler.rate.RateEstimator;
import org.apache.spark.streaming.scheduler.rate.RateEstimator$;
import scala.Option;

public final class MyStreamingListener extends JavaStreamingListener {
private final BatchSizeEstimate batchSizeEstimate;
private final RateEstimator rateEstimator;
private final long batchDurationSeconds;
private long nextMaxBatchSize;

public MyStreamingListener(StreamingContext ssc, BatchSizeEstimate estimate) {
batchSizeEstimate = estimate;
rateEstimator = RateEstimator$.MODULE$.create(ssc.conf(),
ssc.graph().batchDuration());
batchDurationSeconds = ssc.graph().batchDuration().milliseconds() / 1000;

}

@Override
public void onBatchCompleted(JavaStreamingListenerBatchCompleted batchCompleted) {
final JavaBatchInfo completedBatchInfo = batchCompleted.batchInfo();
final long processingEndTime = completedBatchInfo.processingEndTime();
final long numRecordsReceived = completedBatchInfo.numRecords();
final long processingDelay = completedBatchInfo.processingDelay();
final long schedulingDelay = completedBatchInfo.schedulingDelay();

final Option computedSize = rateEstimator.compute(processingEndTime,
Math.min(numRecordsReceived, nextMaxBatchSize),
processingDelay,
schedulingDelay);

if (computedSize.nonEmpty()) {
nextMaxBatchSize = Double.valueOf(
scala.Double.unbox(computedSize.get())).longValue()
* batchDurationSeconds;
batchSizeEstimate.setNextMaxBatchSize(nextMaxBatchSize);
}
}
}

Main Application code that sets up the Spark Streaming pipeline can then do something like the following:

import org.apache.spark.streaming.api.java.JavaDStream;
import org.apache.spark.streaming.api.java.JavaStreamingContext;
import org.apache.spark.streaming.api.java.JavaStreamingListenerWrapper;

public class TestApp {

public void setupSparkStreaming() {

JavaStreamingContext streamingContext;

// .... App Initialization code e.g. setup the spark context and streaming context.

final BatchSizeEstimate estimateProvider = new BatchSizeEstimate();

final MyStreamingListener streamListener = new MyStreamingListener(streamingContext.ssc(), estimateProvider);
streamingContext.addStreamingListener(new JavaStreamingListenerWrapper(streamListener));

// .... Any other code that sets up the processing

// Just a made up input DStream for illustration
JavaDStream stringJavaDStream = streamingContext.rawSocketStream("datasourcehost", 1234);

// Here we sample and transform the input DStream into the dynamically sampled DStream.
JavaDStream sampledJavaDStream = stringJavaDStream.transform(rdd -> {
long streamingMaxBatchSize = estimateProvider.getNextMaxBatchSize();
if (rdd.count() > streamingMaxBatchSize) {
double fraction = (double) streamingMaxBatchSize / rdd.count();
return rdd.sample(false, fraction);
}
return rdd;
});
}

//... Rest of the data processing code here.
}

Note that the Spark Backpressure property spark.streaming.backpressure.enabled should be left as false for this sampling strategy to be effective.

We re-ran the same application that we showed earlier in Fig. 1 and Fig. 2 and increased the input data rate in a similar fashion but with Dynamic Sampling turned on. And this is the resulting chart now:

Fig. 3: As traffic increases, total delay is lower (avg. 500ms) and more consistent with dynamic sampling

Fig. 4: Little or no queueing of active batches with dynamic sampling

As the images highlight, Dynamic Sampling helps keep the Processing Time and the Scheduling and Total Delays in check while not exceeding the target Processing time. It does so by continuously monitoring the throughput being achieved for recent batches and adjusting (up or down) how much data the application will process in the next batch. Spark Streaming is an important and exciting capability, but it needs a little care in managing it so that it works efficiently and performantly.

Good luck in your Spark Streaming Application development efforts.

Early use cases of fake account creation were to anonymously request info, avoid spam from an online merchant or participate anonymously in a conversation. Today, with so much of our lives managed behind rich, account-based application platforms, fake account creation abuse is commonplace and more often than not, used to execute a secondary attack such as fraud or theft.

The Rise of Fake Account Creation: From Reviews to Fraud

Using fake accounts to enhance product reputation on Amazon or Yelp is a practice that has become so commonplace, it has become its own economy with merchants who will create the reviews for you, and organizations who will analyze the reviews for you. Studies show that as many as 91% of us trust online reviews as much as personal recommendations, which in turn, can result in a significant increase (or decrease) in revenue for the vendor. With as many as 20% of the reviews being fake, regulators in both the U.S. and the U.K. are “encouraging” the vendors to take corrective action.

How Fake Accounts Are Impacting E-Commerce and Social Media Platforms

Whereas a fraudulent product review can have a direct financial impact for an e-commerce vendor, the purpose of fake account creation on other account-based application platforms is wide-ranging. The most well-known example of fraud using social media fake accounts was the findings surrounding the 2016 U.S. presidential election where many social media accounts were created using both automated and manual efforts. Other uses of fake social media accounts include:

• Reputation influence/bombing through fake likes, posting fraudulent comments and taking advantage of account sign-up bonus programs.
• Executing content/profile scraping to use for malicious or competitive purposes.
• Denial of inventory where the high demand item is placed into a shopping cart, resulting in an out-of-stock message to the real buyer.
• Automated shopping, where bots execute legitimate purchases of high demand items from multiple accounts, effectively bypassing purchase quantity limits.

One of the most significant challenges with managing fake accounts is the fact that establishing new accounts is a legitimate transaction and the lifeblood of account-based application platforms. For social media companies, their valuation is tied to the number of users they have, making the battle against fake accounts one that has a direct impact on their financial results. Retailers face the challenge of losing sales to competitors and a resultant decline in revenue; lost customers who go elsewhere to purchase out of stock items.

Taking action against fake account creation is a challenging game of cat and mouse between the application owner and the bad actor. Injecting too much friction, in the form of CAPTCHAs, JavaScript injection or other means, and the users may leave the platform. “Fakers” continually evolve, using automated tools and human farms to create the fake accounts, making adjustments in language, frequency of posting, and location to continue their fraudulent efforts.

How Cequence Security Prevents Fake Account Creation

Our award-winning platform prevents fake account creation and the resultant fraud or theft by analyzing your web, mobile, and API-based application transactions with the assistance of our patented machine learning analytics engine. Cequence is able to separate legitimate transactions from malicious, creating a fingerprints of each that can then be used for policy-based mitigation. Mitigation responses can be tailored to each application from outright block to customized deceptive responses that disrupt the economics of the bad actor. UAP can also be used to share the findings with other elements in your security infrastructure, such as the fraud department. This architectural approach eliminates the need for application instrumentation and provides you with the insight and intelligence to allow legitimate account creation while blocking automated or human-farm generated account creation.

Today we announced Cequence App Firewall, the second security module for our Application Security Platform that leverages CQAI, our patented AI-powered analytics engine, to prevent data loss and compromise brought on by vulnerabilities exposed in your web, mobile, API-based applications. App Firewall is not a WAF in the traditional sense. Yes, it has the necessary features to address OWASP Top 10 and PCI DSS Section 6.6 requirements – those are table stakes features.

App Firewall is founded upon our previous efforts to use intelligence and machine learning to help organizations stop automated business logic abuse – commonly known as malicious bot attacks – with API Spartan. Business logic abuse is a massive problem for many customers particularly those in financial services, retail, and social media. It’s made more difficult because the attacks appear to be legitimate login attempts, account registrations, or shopping purchases. This meant we needed to be able to distinguish between machine and human-generated transactions hitting ALL of your public facing web, mobile and API-based applications – not just web, or mobile – all three types. To accomplish this herculean effort, we approached the problem with three design principles in mind –

• Understand all of the transactions hitting your public facing applications WITHOUT requiring any application modification or SDK updates.
• Design the product with cloud-centric application development methodologies in mind to ensure that security can be “baked” into your iterative application development process.
• Utilize leading edge software components and technologies like Docker Containers, Kubernetes, and Kafka to create a modular architecture that scales as needed, and can be deployed quickly, in literally any environment.

The result of our design and development efforts is our Application Security Platform (ASP) which is founded upon CQAI, a patented machine-learning analytics engine that fully understands all of the transactions hitting your public facing applications. CQAI is deployed out of band and focused specifically on distinguishing between machine and human intent to uncover automated business logic abuse and prevent it through API Spartan, our initial security module. In some customer environments, we are analyzing billions of transactions per day, blocking as much as 90% of them due to their malicious nature.

Cequence ASP is typically deployed in front of all other application security elements, on the front lines so to speak. CQAI sees everything hitting your public apps – even before your WAF does. Without diminishing the effort required to create a WAF, extending ASP into application firewalling, for all types of applications was easier than solving the problem of business logic abuse.

API-based applications account for a large portion of today’s web traffic and it is expected to continue to grow as organizations build feature-rich applications to interact with customers and partners. Unlike traditional Web Application Firewalls (WAFs) that are focused on protecting web applications, App Firewall is designed to protect all applications alike web, mobile or API-based. As the development teams roll our new applications or update existing ones, Cequence ASP automatically detects and analyzes them, ensuring security does not inject delay into the deployment. – App Firewall and API Spartan are all managed via a unified dashboard, providing you with a single pane of glass for all application security.

Most enterprises are on their journey to the cloud, but they are in different phases of their journey. Some have totally embraced it while others are still running a good portion of their applications in data centers. App Firewall is designed with cloud-native architecture grounds up to protect applications wherever they reside – data center, private cloud, public cloud or even a container cloud like Kubernetes. This allows our customers to move application security with the applications, without worrying about where they are running, easing their journey to the cloud.

WAFs cannot understand the applications well for two primary reasons –

1. WAFs are signature based
2. WAFs are deployed inline, which means they are unable to learn the application behavior because of the latency/delay it will inject into the user experience.

And that’s one reason why WAFs struggle to effectively protect against Zero-Day exploits. As the number of signatures increase, so too does the latency, which negatively impacts customer experience. In contrast, CQAI applies machine learning to understand normal application and user behaviors, building a positive security model to prevent Zero-Day exploits – without the need to apply and manage signatures. CQAI is deployed out-of-band, allowing it to continuously learn and adapt to application changes without impacting latency or customer experience. CQAI engine then feeds these behavioral profiles to App Firewall to defend against vulnerability exploits in real time. This application-centric approach provides scalpel-like precision to prevent attacks without impacting users. The CQAI intelligence-based approach also ensures that customers don’t need to worry about overloaded WAF signature sets. The dashboard provides visibility and builds confidence in the effectiveness of App Firewall, without the need for constantly keeping up with the changing applications.

As the newest ASP security module, App Firewall takes full advantage of the ongoing customer feedback, threat research and feature enhancements we have made over the past three years in CQAI and API Spartan. With the two security modules deployed together, sharing signals with each other, customers will reap an opportunity to consolidate application security in a single pane of glass, effectively achieving a “1+1 = 3” effect.

Want to learn more about App Firewall? Read the datasheet today.

Cequence Security prevents business logic abuse with our AI-based Application Security Platform that discovers all of your public facing web, mobile and API-based applications, then detects
any malicious transactions targeting those applications, allowing you to then apply policies to prevent the attack. As co-founder and CTO, I wanted to take a moment to highlight what I think are some of our key advantages.

What is Business Logic Abuse and why do you need protection?

The security market we participate in is defined by industry analysts as Bot Mitigation. A more accurate description is business logic abuse which is an automated attack that targets your public facing web, mobile and API-based applications with transactions that appear to be legitimate or syntactically correct. Bad actors will use stolen user credentials, infrastructure (e.g., proxies, compromised servers and devices, etc), and management toolkits (e.g., SNIPR, BlackBullet, SentryMBA, etc) available on the Dark Web to deliver the attack. Using bots, the attack will attempt to repeatedly complete account sign up forms, account logins, partially execute online purchases, travel or lodging reservations, etc. Their goals are to validate credentials for resale, steal something (e.g., goods, money, IP, data), or commit fraud by using the value of the of their target for their own purposes (e.g., loyalty points, airline miles). In many cases, bad actors will deconstruct the web or mobile app itself to find the APIs in use and target those directly to complete the attack.

Since these attacks appear to be legitimate, your existing security infrastructure (e.g., firewalls, IPS, WAFs, Security Gateways, etc.) cannot see or stop these attacks, yet research shows that roughly 35% of all internet traffic is from malicious bots. For some highly targeted customers in retail, financial services and social media, malicious bots represent 90% or more of their web traffic. The impact of these attacks is wide-ranging and includes infrastructure costs to handle the higher traffic volume, loss of revenue from stolen goods, loss of user confidence from lost loyalty points, and increased manpower for fraud and security teams.

Gaps in first generation solutions

Web Application Firewalls

Web Application Firewalls (WAFs) cannot protect against business logic abuse attacks because the traffic appears to be legitimate. WAFs look for anomalies in the web requests and there is nothing wrong in the structure of the request when someone tries to do login to an account or create a new account. In addition, WAFs are focused primarily on web applications, and often times bad actors will bypass the web form, targeting the mobile client or the back end APIs directly.

First Generation Bot Mitigation Tools

First generation Bot Mitigation tools attempt to address the business logic abuse problem using application instrumentation to collect signals from the client by injecting Javascript code into the web application. This is a partial solution because attackers will target the APIs or the mobile application directly, which typically interact using XML/JSON and do not support Javascript. The workaround for mobile apps is to re-compile it with the SDK so that it receives the missing signal. There is no workaround to address the application APIs. While first gen bot mitigation tools do a better job at protecting your public-facing apps, the task of instrumenting all of your public facing web apps, and their respective endpoints will add development and QA cycles, ultimately slowing the application release process.

The Cequence Story

Cequence takes a unique approach to prevent business logic abuse that sets us apart from all first generation solutions. At the heart of our Application Security Platform is our patented CQAI engine, a multi-dimensional machine learning analytics engine that characterizes all of your public facing applications, differentiating between human and machine interaction. But it doesn’t stop there, CQAI is also able to determine the intent of the interaction. The result of the analysis is a behavioral profile that provides very high efficacy with low false positives in preventing business logic abuse. CQAI requires zero application instrumentation or SDK integration and continually analyzes all of your applications, detecting when updates or new versions are published. Every month, Cequence stops millions of credential stuffing, fake account creation, scraping, fake likes and other such business logic abuse attempts for our customers.

Here are three reasons why this approach is superior compared to the first generation Bot Mitigation solutions.

Impact on application user (customer) experience

Research from Google and others suggest that humans have a very short attention span, spending an average of less than 15 seconds on a web page. Web page load and first interactive time for desktop and mobile browsers are optimized to be as short as possible. Organizations will try to avoid adding any code to the application, particularly from a 3rd party, because it will negate the page load optimization efforts. Some customers will take the additional step of working with the CDN vendors to further optimize page load times. First generation Bot Mitigation systems provide their own Javascript for web applications and an SDK for mobile to collect client-side data to detect if it is a real device or not. The injected Javascript is obfuscated to protect against reverse engineering and replay attacks. When the page loads, this Javascript executes by de-obfuscating first and then collecting the attributes it is looking for. This negatively impacts the load times and first interactive time.

Using Web Page Test (www.webpagetest.org), a popular performance benchmarking tool, the page load times for an online retailer login protected by a first generation Bot Mitigation tool shows that the bulk of the load time is consumed by JavaScript execution. It takes roughly 15 seconds for the page to become interactive and the majority of the time spent is on cnc_commons_v2.js, the third-party code from the Bot Mitigation vendor. Execution (and therefore page load impact) for the remaining code is minimal. As mentioned above, Cequence does not require instrumentation to your web or mobile applications because CQAI is implemented on the server side, continually analyzing your applications with zero impact on page load and first interactive times. Our customers can protect against business logic attacks without impacting the customer experience.

Cost of application development

Anytime an application is changed, it will go through test and QA cycles to ensure it works as designed. Adding 3rd party code that your team did not develop to introduces additional risk and testing cycles. As organizations move towards more rapid, iterative application development methodologies, this is an additional tax that the development team has to pay to make sure that the third party code has no impact on the functionality of the core application. An additional tax is the process of re-certification for all your applications when the third party code is updated.

First generation Bot Mitigation solutions instrument the application by injecting Javascript or recompiling the mobile app with an SDK, effectively introducing foreign code and the additional risk of breaking the application. This code is heavily obfuscated, requiring additional time and effort for application teams to fully understand as they execute code review. The result is an extended or delayed release of new or updated applications. Most organizations have hundreds of applications which increases the potential for errors, making it cost prohibitive from an application development perspective to instrument and re-test all these applications. The image below is a snippet of Javascript code from an existing Bot Mitigation vendor. The first image shows the inclusion of the script and the second image is the actual Javascript that gets downloaded because of that inclusion. It makes very difficult to validate and certify the application with more than 180 kilobytes of heavily obfuscated foreign code.

Cequence, on the other hand, uses CQAI to intelligently analyze the applications, eliminating the need to change the original application. That means that new applications and updates can be rolled out rapidly, without any added risk. CQAI passively and continually analyzes all your application traffic and determines if the traffic is generated from a human or machine. Once it identifies it is a machine, it then goes a level deeper to identify the intent of the automation – all without the need for any application instrumentation.

Keeping up with the ever-changing attack surface of Web, Mobile and APIs

In the last few years, enterprises have gone from connected to hyperconnected – many applications each with multiple entry points. For example, a login application can be invoked from the home page, shopping cart, a mobile app or a rest API for partners. Every entry point needs to be protected from business logic abuse attacks. If any entry point is left unattended, bad actors will find it and rapidly exploit it. As applications are updated, new entry points are created by the application teams; sometimes without the knowledge of the security team.

First generation Bot Mitigation solutions require instrumentation for every entry point for complete protection. Missing even one entry point is quickly detected and attacked. It is still possible to instrument a Web application with Javascript and a mobile application with an SDK but for the application APIs that are exposed for non-mobile communication, there is no way to instrument them.

Cequence does not require any instrumentation to protect applications. The CQAI engine continuously discovers new applications across all of your web, mobile and API application channels allowing you to apply policies to prevent Business Logic Abuse. When the application team rolls out a new application, even without the knowledge of the security team, it is automatically discovered by CQAI and protected by our security platform.

To learn more about Cequence API Spartan and how it can protect your public facing web, mobile and API-based applications, please check out this on-demand presentation:

Over the last 10 years, we’ve seen the continuing growth and evolution of hyper-connected organizations. These are the forward-leaning enterprises that have embraced the Internet to connect customers, partners, and suppliers, enabling them to adopt digitally-driven business models that can eliminate boundaries and accelerate growth.

One of the key enablers of hyper-connected organizations are the various web, mobile, and API-based applications that facilitate communications and transactions between every participant across the digital ecosystem. Given the strategic importance of these applications, security teams are now giving top priority to protect these applications from both malicious bots and human-initiated attacks.

The most common tool in the arsenal of security teams has been the web application firewall (WAF). Each year, hyper-connected organizations spend billions of dollars on WAFs, and back in a simpler time, the WAF worked quite well. But attack targets have dramatically increased, and attack strategies have become very sophisticated, while WAFs themselves have seen very little innovation. It reminds of the early years at Palo Alto Networks, when we essentially re-invented the network firewall for the same reason – a total lack of innovation in legacy firewalls.

At Cequence Security, we believe the same disruption and innovation is necessary in the WAF market. This belief has been validated by a newly-completed WAF research project conducted with Ponemon Institute. We compiled detailed insights from 595 organizations across the US and discovered that overall WAF satisfaction was only 40%. That’s actually pretty horrible.

Several underlying data points reveal the cause of their dissatisfaction (with my commentary added):

• 65% of these companies have experienced application-layer attacks that bypassed their WAF in the last 12 months (Hmm, so it’s failing miserably in its primary security role.)
• 47% of organizations don’t even expect their WAF to stop all attacks on their applications (Wait, what? Then why even have a WAF?)
• Despite their frustrations, they spend an average $620K annually of WAF products and staffing support (OK, let me do the math: $620K gets you 40% satisfaction. Ouch!)
• Their staff spends an average of 61 hours each week responding to alerts and writing new WAF rules. (Somehow, that doesn’t seem like a fulfilling career. No wonder we have 2M+ IT job openings.)

Bottom line – WAFs waste time and money and barely do their job well. Hey, don’t shoot me, I’m just the messenger.

OK, now let me close by shedding some light on the curious second sentence of this blog headline: but help is on its way. As you know, Cequence Security has developed an award-winning application security platform, powered by a patented AI-based analytics engine. Customers love it because it actually protects their applications and their business. On June 3, 2019, we’ll be announcing another innovative new security module that takes advantage of the power of our platform. That’s all I’ll say for now, but if you’re a follower of Cequence Security, you’ll automatically get the full story on June 3.

Until then…

We recently joined CNCF for two specific purposes. First off, our application is a distributed, containerized architecture that runs in a Kubernetes environment and as such, we want to support the project as a whole. The second reason we joined is to help educate customers on ways in which Kubernetes security can be embedded into their containerized application development workflows.

Kubernetes, a CNCF project, is an orchestration platform for automating deployment, scaling and management for containerized applications. Although there are other competing technologies like Apache Mesos and Docker Swarm, Kubernetes has emerged as a leader and the container world is settling in for it to become standard in all environments, be it on premise or in the cloud. Enterprises are adopting Kubernetes to enable their application teams to move away from the monolithic application development approach towards a methodology that incorporates smaller micro-applications and services. This empowers the application teams to adopt a more iterative and agile development methodology, resulting in more rapid deployment of new applications and updates to existing applications.

As a platform with rich computing, networking and storage capabilities, Kubernetes can be fairly complex to implement. Enterprises can choose to implement Kubernetes themselves, or they can choose a commercial distribution such as RedHat OpenShift, Pivotal Container Service (PKS) and several others. For public cloud-based deployments, enterprises can use Google Kubernetes Engine, Amazon Elastic Container Service (EKS) and Azure Kubernetes Service. Regardless of which Kubernetes infrastructure deployment direction an enterprise takes, security remains a critical consideration before they make it available to their application teams.

The first step towards protecting your Kubernetes deployment is to ensure that the platform itself is secure. This includes keeping up with the vulnerabilities of the platform, firewall rules to limit access to the Kubernetes infrastructure, etc. These security responsibilities are handled by the platform providers in the case of commercial and managed environments. Moving up the stack, the next set of responsibilities to consider is security of the containers themselves through role-based access control segmentation and so on. These responsibilities can be addressed by container security and compliance companies such as Twistlock, Aqua and StackRox.

Once you secure the infrastructure and containers, the next step is to address the application level security challenges, which are the same, regardless of where the application is deployed – on-premises or in the cloud. The applications are prone to two types of attacks; syntactic abuse such as SQL injection attacks, cross-site scripting, buffer overflow, and business logic attacks which includes account take over, fake account creation, fake likes, shopping bots and more. The challenge for security teams is that they cannot keep pace with the speed that the applications teams are moving, resulting in delays or worse yet, degradation of the overall security posture.

Application security is where we can help. Our customers understand that we protect their external facing application attack surface that is constantly changing in the CI/CD world of Kubernetes. There are three ways that Cequence provides peace of mind to short-staffed security teams:

1. “Baked-In” Security: When monolithic applications are broken down into smaller microservices, the application developers are free to choose different application platforms. The security
   teams have the responsibility to protect these heterogeneous application environments; Java, Node.js, PHP, etc. to name a few. Enabling a unified and consistent application security posture across these heterogeneous environments is a significant challenge. Yet forcing the application teams to implement any kind of security injects friction and delay into the development process. Cequence Application Security Platform addresses both of these challenges by operating completely inside the Kubernetes environment, requiring no application instrumentation while protecting all applications automatically as they get rolled out. Security can operate at the speed of the application development team.
2. Continuous Application Discovery with Continuous Delivery: The ingress controller in Kubernetes is designed to manage access to applications from the outside world. The same IP and port can be used to serve multiple applications and their versions. Identifying the application just by their IP and port is insufficient to protect them. As new applications are on-boarded, the attack surface for the enterprise increases and its possible that each unique application is prone to different vulnerabilities. The first step to providing security is to automatically discover any new application that is being deployed. Cequence continuously discovers new applications as they are deployed, allowing the security teams to focus on the overall security posture, without worrying about which web, mobile or API-based endpoint developers are exposing.
3. Consistent Application Security Attack Protection, Regardless of Deployment: Cequence provides a consistent and unified way to provide application security wherever the applications reside; on premise, in the cloud or hybrid. It is a logical extension to protect all the applications in the Kubernetes environment as well. To enable unified security across any deployment location, Cequence eliminates the need for application instrumentation to protect against business logic attacks, which makes it very easy to embed application security into the CI/CD process in Kubernetes environments. In contrast, traditional business logic abuse/bot detection vendors can introduce delays by requiring JavaScript injection into web applications or re-compiling mobile endpoint applications with an SDK.

We are excited to join CNCF so that we can contribute and collaborate with other members that share our vision of application security. We seamlessly integrate our capabilities with Kubernetes to help ease the transition for customers adopting cloud-native architectures, no matter where they are running, on-premise, public cloud or hybrid environments.

RSA Conference, arguably the biggest security conference in the world, recently finished in San Francisco.

As I reflect back on my conversations at the conference with security practitioners from a broad range of industries, I realize that there are certain trends that these organizations are dealing with – and looking to vendors for help.

• It’s a multi-cloud and multi-CDN world out there – Enterprises are using multiple cloud and CDN offerings for various reasons – economic benefits, decentralized IT environments, preference for best of breed solutions, and more.
  • Security solutions must support multi-cloud, multi-CDN environments; but implementing application security in the CDN is extremely limiting in terms of flexibility. Application security solutions need to keep pace with these changing architectures.

• Dev-Sec-Ops has to be as fast as Dev-Ops – Powered by the elasticity of cloud environments, new automation tools and strong business needs, enterprises are now updating applications at a rapid pace. On average, a typical consumer-facing application gets updated every two weeks.
  • Application security solutions must not slow down the pace of rapid development and deployment of applications. Solutions that require time-consuming application integration or cause any kind of friction during deployment will not survive.

• Explosion of APIs and end-points – Due to the hyper-connected nature of today’s businesses, security teams are being asked to protect hundreds (sometimes thousands) of applications – web, mobile and APIs. Just to give you an example, a small but fast-growing social media customer of Cequence has close to 30 different APIs/end-points for users to log in. Therefore the attack surface has increased exponentially over the past few years.
  • Security solutions must cover ALL targeted end-points accessible from the Internet and therefore the bad actors. We met several happy customers of our competition, who have taken between 6 months to 2 years to successfully deploy these security solutions in front of their most critical application. But they are exhausted to now consider doing the same for hundreds of similar applications.

• Rapid movement towards microservices, serverless computing – Enterprises are moving fast towards using these new deployment models. It allows them to achieve the ideal scale, agility and flexibility that fits their business needs. But like many other technology trends and innovations before, security is an afterthought in these new deployment models.
  • Security solutions must blend into these new deployment models. Discovering new applications being deployed in the service mesh and automatically protecting them, without forcing inorganic routing of all application traffic is key requirement to support.

• Data Residency and Data Privacy is top of mind – With GDPR in place and more stricter regulations like CCPA impending, data privacy and data residency are top of mind concerns for enterprises, especially when it comes to application security
  • Application security solutions which are purely SaaS solutions or hybrid SaaS (analytics in the cloud) will have a couple of things to consider in order to comply to these regulations – Increase cost with geo distributed SaaS service and decreased efficacy due to loss of certain application data.

As I consider these trends in the context of our strategy at Cequence Security, I feel very confident that we have the solution architecture and underlying technology to meet and exceed our customers’ expectations. Our patented Application Security Platform (ASP) is built to support these emerging trends, and we have always maintained a few key design principles:

• Application security goes where ever the application goes
• Application security requires deep knowledge and context of the application
• Application security must not slow down application development and deployment
• Application security must treat all applications equally important – Web, mobile, API
• Application security must not be a headache for our customers with respect to compliance with new Data Residency and Data Privacy laws.

I’m pleased to say that we are winning with this strategy –winning customers, and winning awards, which you may have noticed on our about us page.

After a busy week sharing our news of $17M in Series B funding with the media, we followed that with a week of non-stop craziness at RSA 2019. And it was a good one.

We locked down prime real estate in the Early Stage Expo and spent 3 days discussing application security challenges – and the Cequence Security platform – with hundreds of prospective customers that came by to see us.

On day 2, Shreyans Mehta, Cequence co-founder and CTO, delivered an educational presentation on automated bot attacks and defense strategies to a standing-room-only crowd at the Expo theater. Clearly, there is strong interest in defending against this new #1 cyberthreat.

Apart from activities on the show floor, nearly every hour was filled with meetings, podcasts, and video interviews with more than a dozen members of the press and analyst community – and several more with prospective technology and channel partners interested in collaboration.

Finally, we hosted a private dinner with the most important audience – our customers – to spend some quiet time learning more about their challenges today, and their plans tomorrow.

All of this activity was very educational for us and positions Cequence Security well for continued growth and disruption of the application security market throughout 2019 and beyond.

Each week, we provide our customers with a detailed report on malicious bot attacks targeting their organizations with the intent of gaining unauthorized access to the critical applications that connect their digital ecosystems. Because the Cequence API Spartan solution protects all targeted channels–web and mobile apps, as well as strategically important API services–we’re able to determine what assets are being targeted precisely, what tools the attackers are using, and where they’re activities are originating.

Based on our experience thus far, our customers are “delightfully stunned” at the visibility they now have into the attacks on their organizations. It’s delightful in the sense that they’ve never had this level of visibility before. But it’s stunning in the sense that they also had no idea of the relentless volume of these attacks.

For example, we recently ran a report on web traffic for one of our Fortune 500 customers. Without revealing any confidential information, here are a few interesting data points:

• Cequence inspected nearly 150 million application requests over seven days
• Attacks originated from multiple countries, phones, tablets, and browser types
• Attacks targeted web, mobile, and API channels – especially backend APIs
• SNIPR was the most commonly used tool by bad guys to plan and launch the attacks
• The largest geo-distributed attack involved more than 3 million IP addresses worldwide

It was not a great week for this customer because 99%+ of nearly 150 million requests were determined to be malicious. Fortunately, Cequence detected and blocked all of them.

But what if we didn’t? Well, the customer might have over-provisioned its infrastructure to accommodate all this great, high-volume traffic. That would have been costly (and unnecessary). But not as costly as dealing with account takeovers, financial fraud, damaged reputation, and general business disruption.

Bot attacks now account for nearly 1/3 of all Internet traffic. That’s huge. But in the case of this customer, it was more than 99%! Fortunately, they had the visibility and control necessary to stop these attacks before they achieved their objectives. But what about your organization? Do you know what’s on your network? Contact us, and we’ll give you the answer.

By now we’ve all seen the news on the recent Marriott breach. Yup, it was a big one. But there have been many other significant breaches in 2018, including Facebook, Quora, Panera, and the list goes on. Those breaches grab the headlines for just a few days, but they have a long tail that continues to impact other organizations for years to come. Specifically, these big breaches breed bad bots – automated attacks that leverage previously stolen credentials to target the external-facing apps of other unsuspecting organizations.

To learn more about the impact of never-ending, post-breach bot attacks, we commissioned Osterman Research to dig deeper. They gathered data from 211 large enterprises across the US to learn more about their experiences with bots, as well as their attack defense strategies. The results have been published in a new report. But here are a few interesting nuggets:

• 100% of these organizations have been victims of bot attacks
• They experience more than 500 bot attacks each day
• Attacks target web/mobile apps and APIs deployed on premises and in the cloud
• Greatest damage is from account takeover, app DDoS, and API abuse attacks
• 91% rely on web application firewalls for defense (clearly, they’re not working well)
• Average bot attack detection/mitigation time exceeds 200 hours
• Cost for each IT security team to deal with attacks exceeds $175,000/year

As long as there are data breaches, there will be secondary bot attacks. And they will continue to become more targeted, sophisticated, and dangerous to today’s hyper-connected organizations.

Traditional best practices have proven to be ineffective. The companies involved in this research understand that, and have expressed a need for more advanced, automated solutions that can:

1. Accelerate detection and mitigation of bot attacks, and
2. Improve the operational efficiency of their security teams.

Fortunately, we’ve been able to address both items on their wish list with the Cequence Application Security Platform (ASP) and the API Spartan module.

Michael Osterman, CEO of Osterman Research, will share more details on this research during a live webinar on January 30.

Prospective employees frequently inquire about our company culture at Cequence Security, so I thought I would share my thoughts on the topic. Before I do that, it makes sense to define mission and culture, as those two topics go hand in hand.

A mission declares an organization’s purpose, or why it exists, while the company culture reflects the values and actions of each member of the Cequence team in pursuit of the company mission and goals.

So, what makes our company special and a great place to work? Let’ start with our mission – to empower our customers with innovative security solutions that protect their Internet-facing web, mobile and API application infrastructure from cyber-attacks, while also improving the operational efficiency of their IT staff.

The company culture that supports our mission has many components and is difficult to describe in a couple of statements, but at the core we’re fanatical about the following:

1. High growth/fast pace. Tripling our business and doubling our headcount year over year. Embracing agile development with 2-week sprints to deliver new features and capabilities that delight our customers. We are on a mission to rapidly improve application security.
2. Engagement up and down the company including our customers and business partners. We are passionate and committed to the mission. To paraphrase the fable of the Chicken and the Pig, we are a company full of pigs fully committed, there are no chickens in the building.
3. Not all heroes wear capes. We believe in frequently recognizing and rewarding the people on the team who are busting their tail and making a difference for our customers.
4. Teamwork. We are collaborative inside the organization and with our customers. We don’t have fixed organizational lines, everyone pitches in to reach our lofty goals. We don’t sell to our customers, rather we enter into partnerships with our customers and we become extensions of their team.
5. We have fun. We’re family, we genuinely like working together and have fun together. We laugh a lot. When you’re working at a startup, you see your startup family more than you see your personal family, so it’s important to have fun together.

Having worked in Silicon Valley for many years, it’s unusual to find a start-up where the mission and the culture are unified like this. It also creates great employment opportunities for talented people anxious to embrace the mission and culture; and make a positive difference. If this sounds compelling to you, let’s talk!

This past weekend, I needed to book my travel for an upcoming business trip. When I went to purchase my plane ticket, I found myself unable to login to my account. Instead, I encountered an ‘Access Denied’ message. I’ve traveled extensively with this airline for a while, enough to earn elite status in their rewards program, so I’ve booked enough flights to know that this message was not the norm.

I tried a few other login methods, including changing browsers and using incognito mode in Chrome, but nothing worked. Deterred, I decided to switch from booking my plane tickets to making my hotel reservations and found myself experiencing the same ‘Access Denied’ message. Having now spent a lot of time getting nowhere, I started to worry something might be amiss with my accounts or laptop. So I switched over to my tablet to try to isolate the problem. Fortunately, I was able to log in to my accounts at both the airline and hotel chain on my tablet and finish making my reservations. I was also relieved to discover my accounts with both companies had not been compromised in any way.

The next day, I again tried to log in to my airline account from my laptop… and again failed. Curious if other customers of the same airline and hotel chain were experiencing problems, I looked around online. On Twitter, I found other users complaining about similar issues.

Based on these reports, and my own odd experience, I asked our security research team if they knew of a solution to the problem. They asked if I use any ad-blocking software and, since a few decades in the security industry has made me sensitive to online privacy and security, I confirmed that I did and gave them the details.

We soon discovered the root cause of the problem. Both my airline and hotel chain use a bot detection product from one of our competitors to defend against automated account takeover attempts. Because this product collects device and user heuristics from customers by sending a piece of JavaScript to the browser making the login attempt, it looks similar to various tracking scripts used by the online advertising vendors. Consequently, a popular data feed referenced by many ad blockers recently added this bot management solution’s JavaScript to its master list and is causing issues with customers who, like me, are security conscious enough to use ad-blocking software.

Because many ad blockers are now blocking this particular JavaScript, when a customer like me submits their username and password, the request does not contain any user tracking of the information required by the bot management product when it reports back. As a result, the tool considers me to be a bot because it relies ONLY on this signal to make its block/allow decision. That’s why I got the ‘Access Denied’ message – it was from the bot management product, not from my airline or hotel’s web application.

What does this mean? Tens of thousands of security-minded users like me are now unable to log in to their accounts using a desktop browser on nearly 300 websites unless they disable their ad-blocking software. These unhappy customers have been complaining on various channels, including social media. The security vendors that use this JavaScript technique are scrambling to appease angry users, and are likely losing brand value and customers in the process.

Ironically, if my preferred airline and hotel chain had made use of Cequence Security instead of another bot management product, I would not have a story for this week’s blog post. From the beginning, we have taken a very different approach to bot detection and mitigation at large enterprises. Since Cequence Security’s solution doesn’t rely on client-side JavaScript injection, it’s much less intrusive when it comes to end user and customer experience. This innovative approach to solving the problem, which results in no friction with customers’ applications and APIs, led Gartner to recognize us as a 2018 Cool Vendor in the bot mitigation space.

Unfortunately, for both businesses and their customers, this problem is only going to get worse. In addition to ad-blocking software, several leading browser vendors have announced that they intend to start blocking third-party JavaScript in their default configurations. Fortunately, for companies seeking to future-proof their defense against bad bots, there is an alternative: Cequence Security.

The wide availability of attack components on the dark and public web makes it easy even for novice cybercriminals to conduct a successful attack on a website, API, or mobile application. With automated, ‘bot’ traffic quickly eclipsing legitimate user activity at some organizations, IT security teams, along with fraud teams, are keen to implement defenses to detect automated attacks using JavaScript injection. The goals of these two teams are similar, but their approaches are markedly different.

Fraud teams are mainly focused on discovering fraud by reviewing historical data, examining flagged transactions that need human analysis and rolling them back or canceling them if fraud is identified. In contrast, security teams are generally forward-looking, seeking to defend their environment from every future attack, which necessitates removing the human element from the process and acting automatically in real-time.

JavaScript Injection 101

There are two fundamental approaches to web application defense – one that focuses on changes to the web (or mobile) application and one that works stealthily on the server side. We are starting to see a shift by web application security products to stealthy, server-side detection, versus the traditional JavaScript (JS) injection method.

JavaScript injection is still commonly used as the standard approach, ironically, by both cybercriminals and many web application security companies. While it may detect and mitigate some attacks, there are several limitations and intra-organizational challenges that come with utilizing a JS-based approach.

The JS model works by inserting a script into your web application that “fingerprints” the user’s browser to differentiate between legitimate user activity and bot activity. When security solutions attempt to pinpoint anomalies across entire populations of large users or trends over extended periods of time, it’s common for them to use a combination of JS and a cookie to attempt to detect an automated attack. This mechanism requests that the client provide browser information so it can evaluate the user behavioral data from the session, such as whether mouse behavior is within the parameters of ‘human-like,’ in order to identify malicious automated activity or unwanted traffic.

Use Cases: Fraud vs. Security

The two primary use cases for JS-based detection are fraud prevention and bot detection solutions. In many cases, these activities often come down to verifying a known user is who they say they are vs. identifying a new user or a new device.

A JS-based technique is useful in the fraud case where a user, their device, location and usage pattern are known. Since the solution has a log of a user’s history, a notable deviation from that history is a good cause to suspect fraud. However, when it comes to the security use case, JavaScript injection is not as effective.

Limitations: Web Application Security

The biggest challenge with a JS-based approach to security is its practicality in the real world. Deploying it requires coordination across at least three organizations; development (build the integration), operations (ensure performance and availability) and security (monitor attacks). Sometimes, marketing and fraud teams are involved as well. The required coordination for a single remediation between multiple departments with differing priorities can take weeks, leaving websites, mobile applications, and APIs vulnerable in the meantime.

Additionally, though the JavaScript is commonly obfuscated, its presence alerts attackers of a security mechanism. Once identified, attackers can study the client code and its communication with the host site. And, because JS code executes in the attacker’s environment, where there is no control or oversight, the tracking code is vulnerable to being spoofed in any number of ways once it is detected. The attacker can mimic the characteristics of a browser, user mouse and keyboard interaction (through recorded human sessions), leveraging IP addresses through botnets. Even if an initial attack is blocked, the attacker can modify the behavior of their client until an attack is successful and then scale their offense using botnets. The defender then tweaks their system for the new form of attack, and the cat-and-mouse treadmill keeps rolling.

Lastly, browser makers are in the best position to address the bot detection problem, particularly since the bots are masquerading as their products, and we are seeing an increased amount of R&D in this area. For example, Google’s Invisible reCAPTCHA is a milestone in bot detection. The question then becomes: why do web app security vendors need to duplicate this functionality and execute the same detection twice on one client?

Limitations Mobile, IoT & API Attacks

In addition to the pitfalls of long remediation cycles mentioned above, solutions that rely on client-side code commonly provide a mobile SDK that the organization’s development team needs to test for behavior, performance, and compatibility with its host application. As with any mobile application, each CPU cycle and MB of memory consumed impacts the smartphone’s performance, data usage, and battery life. The organization must then build the integration, roll it out to each of its users through Google Play and Apple App Store, and make its best attempt to get customers to keep their mobile clients up to date. This is not a simple endeavor.

For IoT (including gaming stations) and API-based attacks, all of these points are moot. The good news is that there is no client-side code to integrate, and the bad news is that there is no client-side code to detect. All of the organizational and integration challenges mentioned above go away, but the security product’s server-side detection must be powerful enough to detect an attack without impacting your normal partners’ usage of your API.

And if the server-side code is smart enough to provide protection against botnet attacks, that warrants the question: “Why do we need to rely on client-side code for security in the first place?”

As security professionals, we have a bit of a reputation for melodrama. A breach happens, we make a lot of fuss for a few weeks, and then we quickly move on to the next topic dominating our news cycles. Even when a breach seems pretty dire to a particular company and its customers, it’s usually not the ‘end of days’ that we often predict it will be.

However, we’ve noticed that after last year’s high-profile breach of Equifax, a small handful of companies haven’t moved onto the next news cycle and are keeping their information security and fraud teams working overtime on one specific area with no end in sight – authentication and user verification.

Why? Because today’s processes for authentication and user verification are fundamentally flawed.

Why Traditional Identity Verification Is Broken

While traditional mail services like the United States Postal Service are sometimes used in heavily regulated industries, such as financial services, to identify a user by sending documents to their address, it introduces another involved step to the authentication and user verification process that creates friction. When I was at PayPal, I used to like to joke that the “F-Word” was really “friction” – something online businesses strive to aggressively reduce.

Because of this, most commercial approaches to identity verification are instead based on having some set of information about you that’s theoretically easy for you to verify, but hard for anyone else to guess correctly. The problem is that, following the Equifax breach, there is now no information with those characteristics for roughly 50% of the US population.

The Fallout: False Positives, False Negatives, and Real-World Friction

This leads to higher false positive rates, where criminals can access accounts illicitly, and higher false negative rates, where legitimate users are denied access to their accounts. We’ve already started to see examples of the latter in significant numbers. For instance, if you want to register on healthcare.gov under the Affordable Care Act, your identity will be verified via a credit bureau. However, if you’ve frozen your credit file due to the Equifax breach (which is the recommended best-practice), you’ll find yourself jumping through a lot of hoops before you can establish your account and get coverage.

It’s the false-positive problem that has had information security and fraud teams working overtime for the last several months. Market leaders are attempting to review every single business process involving authentication and user verification to see whether they are solidly defined or if there are systemic gaps. Everyone else seems to be mostly just pretending that life should go on as usual as the Equifax news cycle winds down. They move on to the Facebook breach, or the Panera Bread breach, or the Delta airlines breach, or… you get the point.

The Long-Term Fix Is Structural — and Slow

In the long term, these problems are structural, and the solutions are structural too, but the issue is that it will require governments to “belly up to the bar.”

In the real world, if you want to drive a car or board a flight, you must provide government-issued documentation that asserts your identity and your authority to do those things. There have been some experiments with governments verifying identities electronically in so-called “e-government” pilots, and there’s little doubt that this is the real solution to the problem. However, it would require a consensus both on the “business models”, through which governments and businesses would interact, and on a set of open standards that could be used for the purpose. NSTIC was the most recent attempt in the US to provide a framework for this, but it’s fair to note that NSTIC has not been a huge success and has lost most of the momentum that it once had.

Having twice led open standards organizations, my own expectation is that it would take five or ten years of effort to sort out – assuming the will to put together a process like the one described even exists. I personally believe we must do this, but I also fully accept that there is little evidence of it starting to happen yet.

Four Calls to Action for Security and Fraud Teams

Instead, and on a more tactical basis, I will close here with several specific calls to action:

1. Make sure that you do a realistic risk assessment of your authentication and user verification processes to ensure that you understand whether or not those processes are still suitable. Given the current reality that most user verification data sources should be considered tainted, ensure that the recent (Equifax) breach is factored in.
2. If your risk profile has changed, then start work re-engineering the affected processes.
3. While you are at it, don’t forget to look at your application and security infrastructure to determine what your exposure is to automated / bot attacks. This is one of the primary mechanisms that criminals will use to exploit the weaknesses discussed in this blog using credential exploitation. If you use a legacy web application firewall (WAF) solution that claims to have bot protection features, don’t take them at their word. Be sure to verify vendor claims thoroughly, as in our experience these are largely brochure-ware and trivially evaded by attackers in real-world attacks.
4. I will note that our solution is specifically designed to detect bot activity attacking your web presence, and bots tend to be one of the main attack tools whereby criminals will abuse stolen identities.

Interested in learning how you can protect your web applications, APIs, and mobile applications from automated attacks and unwanted traffic? Get in touch, and we’ll demonstrate how Cequence Security helps some of today’s largest organizations in the retail and finance industry detect and mitigate bot activity.

One of the first issues we tackled for customers was detecting and mitigating automated (i.e. “bot) attacks against web applications. As an ex-CISO who struggled with these attacks, I wanted us to build tools that would focus on that initial problem. Since then, we have expanded our product roadmap significantly and increased our scope to help customers extend protection to their whole environment, including mobile applications and APIs.

In the process of deploying our solutions, we see examples of the types of attacks taking place in different customers’ environments and industries daily.

In the coming months, we’ll be writing about what we’ve seen, as there are some takeaways and interesting conversations to be had about what we’ve encountered in real-world environments. Much of our focus will be on specialized tools that are directly designed to support automated attacks.

The issue I’ll cover today involves financial aggregators and is somewhat unusual. As a disclaimer, I don’t mean to criticize anyone in the scenario I’m about to describe, except the criminals who seek to exploit and profit from the system.

In case you need a quick refresher on financial aggregators, they are companies that specialize in aggregating a consumer’s financial data into a single view for reporting and analysis purposes. For example, if I have accounts at Bank 1, Bank 2, and Bank 3, I could use one of these services to deliver an aggregated and integrated view of all my accounts through a personalized portal. The best-known company to offer this service is Mint, now a subsidiary of Intuit. But, there are many others that provide similar services.

In some cases, aggregators utilize APIs provided by a particular financial institution; in others, they scrape the relevant data from web pages. And, to be entirely clear, the largest aggregators have very strong security best-practices in place to protect the data they collect. Of course, all of these services require the user to verify their credentials for any site the aggregator is accessing.

Unfortunately for all concerned, a small number of criminals have discovered that the infrastructures that aggregators use for their operations are largely whitelisted* by the various financial sites that they are pulling data from. If you are a criminal intent on performing credential validation attacks, an aggregator’s platform is an ideal place to piggyback.

Attackers have therefore started using automated tools to bulk upload test sets of stolen credentials to an aggregator to test them. Later, they can log in to the same aggregator with the same tool to determine which credentials in their stolen dataset worked.

Previously, when financial institutions trusted aggregators enough to whitelist them, the transactions were on the whole benign and brought a lot of value to consumers who used the services. The evolving issue now is that the transaction mix from aggregators has changed to be a mixture of both benign and malicious transactions, as criminals exploit the aggregators’ infrastructure.

You could perhaps argue that this isn’t intrinsically a problem – although I’d beg to differ – but what I think is reasonable is that companies need to know about how aggregator services can be and are being abused. Fundamentally, that’s why I’ve written this blog.  Both as a cybersecurity practitioner and a consumer there’s an obvious question that needs answering – “what should be done?”

Obviously, aggregators themselves need to improve how they detect and mitigate automated attacks against their platforms. In the discussions we’ve had with several of them, they are keenly aware of the issue and are working to beef up their own defenses to prevent criminals from being able to piggyback on their services. But it’s not clear how long that will take, nor how effective they will be.  It’s our experience that while the large aggregators are as committed to security best practices as anyone, the smaller ones simply have fewer resources to devote to it (although they do care too).

In the meantime what can financial institutions, who are ultimately responsible for protecting their customers’ data, do?

The answer is not clear-cut. Some automated attack detection platforms, like ours, are capable of spotting the patterns of a criminal attack, even though the attack itself is coming from an otherwise legitimate, and indeed whitelisted, source. But, most commercial solutions today can’t deal with this level of ambiguity, as they are focused on detecting the technical behavior of the source endpoint to determine whether a transaction is coming from automation or a “real person”. In the case of these attacks, there is no signal or context around the endpoint at all, and by definition an aggregator uses nothing but automation.

So, apart from finding and using a solution like ours that is capable of spotting that very subtle signal, companies don’t have many choices. Companies could start pressing harder on aggregators and threaten to cut off their preferred (whitelisted) status until they can detect this successfully themselves, but then they would face pushback from consumers, who find the services of financial aggregators useful.

As I mentioned at the start, this topic is one of those that doesn’t have a clear-cut “bad guy” – apart from the criminals, of course! – and doesn’t have an obvious solution either. But, I felt it was an important topic worth covering, so companies that might be targets of this type of credential exploitation attack are at least aware of the problem and can control the conversation and next steps. I typically think it’s helpful to end a blog post with a “call to action”, and this one is no exception.

Here’s what I suggest you should consider if you are responsible for protecting a company whose data is accessed en masse by an aggregator. (Typically, you will be working at a financial services firm.)

1. Determine whether your policy allows the whitelisting of aggregators at all.
2. Review which aggregators have in fact been whitelisted*.
3. Find the contact information for said aggregators, and reach out to discuss what steps they are taking to detect the problem of criminal piggybacking on their platform.
4. Review your current anti-automation platform to determine whether it’s capable of detecting aggregator piggybacking.
5. Review the historical logs of transactions from aggregators to determine whether the login success/failure ratio has changed significantly over time. (Typically, failure rates on aggregator initiated transactions are very low. If failure rates suddenly spike, it is a strong  indication of piggybacking.)
6. If you are seeing indications of piggybacking, and your current anti-automation platform isn’t capable of solving it, please reach out to us and we can jointly determine how we can help.

* Whitelisting
In the context of this blog, when I use the term whitelisting, I am not referring to whitelisting on a firewall, or similar network security appliance at the TCP/IP address level. Although it’s possible that some TCP/IP addresses of aggregators may indeed be whitelisted at that level – otherwise at peak traffic periods, such aggregator initiated transactions might appear to be a DDoS attack, and get shunned by DDoS prevention solutions.

Rather, I am talking about whitelisting in two separate senses of the word:

1. Many financial services firms offer aggregators either JSON or XML-based APIs, instead of using simple site scraping technology.  Typically, these APIs have an authentication/authorization component, and so the process of allowing a particular aggregator to use those APIs is one form of “whitelisting”.
2. Pretty much every firm will have some kind of fraud detection / prevention engine (whether home grown or a commercial product / service).  In that engine, the transactions that originate from aggregators will look unusual compared to the normal transactions that access your site. Depending on how your engine works, you will often need to “whitelist” those aggregator initiated transactions to ensure that they don’t trigger fraud workflows, CAPTCHAs, etc.  How that’s done will vary from one engine to another.

Interested in learning how you can protect your web mobile, and API, applications, and APIs from automated attacks and unwanted traffic? Get in touch, and we’ll demonstrate how we help some of today’s largest organizations in the retail and finance industries detect and mitigate bot activity.

Executive Summary

Cequence Security assisted the Ulta Beauty CTI team to mitigate a persistent, high-volume inventory API scraping attack. While the goal of the attack was initially uncertain, potential motivations included enabling real-world shoplifting opportunities by mapping popular inventory. The attack was executed across a third-party local-inventory search API, and mitigating it saved Ulta Beauty significantly across infrastructure and inventory costs.

Enumeration Attack Against Third-Party APIs

The attack unfolded as the volume of requests against local-inventory search APIs spiked at 700x normal volumes rotating through more than 153,000 unique product and SKU combinations while scraping 61,000 zip codes and 33,000 products. The local-inventory search API supplier notified the Ulta Beauty team of the sudden traffic surge, and an investigation uncovered an enumeration attack with the following characteristics:

• High-quality, residential proxy IP addresses were used to make IP blocking at the edge difficult.
• The attack enumerated through ZIP codes to find high concentration of specific products with high retail values.
• Initially, a web API was targeted but that quickly pivoted to the analogous mobile API which provides similar information.

Collaborative Efforts Save $80,000

Working together, the Ulta Beauty CTI and the CQ Prime threat research team put policies in place that have successfully blocked 85.9M total requests since April 1st resulting in $80,000 saved in infrastructure and loss prevention. Cequence was deployed fully on AWS with multiple availability zones and Auto Scaling groups enabling Ulta Beauty to scale up and down automatically as needed. At the height of the attack, policies were blocking upwards of 17M requests as shown in the following chart.

Policies block traffic that exhibit the following behaviors:

• Direct-to-API: The attack was designed to target the inventory API directly, without hitting any other app or web function. Normal behavior would show the user traversing multiple APIs.
• Volumetric threshold: The attacker used enumeration to rotate through the inventory at such a volumetric rate that it represented 90% of ALL the customer traffic at the time.
• Outdated browser: The attack was built to use very outdated or anomalous versions of Google Chrome.
• Single cookie generation: Each attack generated a single cookie whereas normal users would generate upwards of 40-50 cookies as they browsed the inventory.

A Win for All Parties

The rapid response and teamwork in blocking this attack resulted in a win for Ulta Beauty to the tune of $80,000 and a win for the local-inventory search API vendor, which no longer needed to bear the increased infrastructure costs. It’s also a win for the CQ Prime threat research team who mobilized quickly to identify the attack, motives, and behaviors and respond with appropriate blocking policies.

Customer Profile

Poshmark is a leading online marketplace that enables users to buy and sell new and secondhand styles for women, men, kids, homes, and more. Founded in 2011 in Redwood City, California, Poshmark has over 100 million registered users in its vibrant community across the U.S., Canada, Australia, and India. Today, there are more than 200 million available listings on its platform.

Increased Account Takeover Attempts Alongside Rapid Growth

Poshmark, a prominent social commerce marketplace, enables users to buy and sell new and secondhand styles on their the Poshmark website and mobile app. The ease, simplicity, and fun of the buying and selling experience has enabled millions of people around the world to bring their closet online with just a phone. As the marketplace grew, it attracted malicious activity that needed to be addressed to protect the company’s brand reputation and preserve the end user experience. Poshmark’s security team noticed an increase in the variety of new automated account takeover (ATO) attacks that used credential stuffing to compromise end user accounts. They saw this increase in attacks across both their web and API applications, neither of which had any API protection to detect or block these types of automated attacks.

Goals

• Inline Blocking: Real-time blocking of all malicious bot traffic with a very low false positive rate, ensuring that only real user traffic reaches the application.
• Reduce CAPTCHA: No longer rely on CAPTCHA as the primary way to identify bot activity.
• Fast, Easy Deployment: Quickly implement a new solution without disruption to buyers and sellers. Avoid integrating JavaScript SDKs into web and mobile applications which increase software and QA cycles for every product release.

Traditional Methods Disrupted User Experience

To identify and block suspected automated attacks, the security team had implemented a CAPTCHA challenge that disrupted the user experience and increased friction for user signup and login.

Poshmark needed a security solution that could block automated fraud attacks while improving the experience for buyers and sellers. Poshmark partnered with Cequence to deploy the Cequence Unified API Protection platform.

Immediate Bot Mitigation with Zero User Friction

After implementing Cequence, Poshmark was able to block malicious bot traffic in real time before it reached their application. This also enabled Poshmark to dramatically reduce CAPTCHA challenges, streamlining the user experience and ensuring that only legitimate users were on their platform. Additionally, Cequence was deployed fully on AWS with multiple availability zones and Auto Scaling groups enabling Poshmark to scale up and down automatically as needed during important sales events or high-volume attacks.

Poshmark is now able to do the following:

Results

• Real-time Blocking: Inline blocking of malicious bot traffic, ensuring that only legitimate user traffic reached their mission-critical applications.
• Prevent Fake Accounts: Block fake account creation used to conduct malicious activity across mobile and web sites.
• Block ATO Attacks and Malicious Signups: Significantly improve reliability and uptime while reducing fraud.
• Preserve Marketplace Social Integrity: Ensure comments originate from legitimate users on listed items and prevent fake comments from bots.
• Minimize User Experience Friction: Improve user experience by limiting CAPTCHA challenges to suspicious traffic, preventing malicious bot activity.

Success Metrics

• Reduced cancellations due to a decrease in malicious activity.
• Mitigated operational impacts like performance, reliability, and uptime.
• Improved the end user experience, reducing CAPTCHA challenges by 99.3%! Challenges were reduced from 2,600,000 logins to only 18,000 per week.
• Blocked over 609K attempted ATO attacks, saving an estimated $2,192,400* in potential account losses.
• Reduced hours spent by internal team members on manually battling malicious cyber attacks.

*Based on a $3.60 account loss per account LexisNexis® True Cost of Fraud™ Study.

A Leading Provider of Consumer Lease and Loan Solutions

Snap Finance provides a suite of very popular lease-to-own (LTO) and installment loan options for millions of consumers. The company serves a two-sided marketplace ─ with consumers on one side, merchants on the other. Snap Finance provides a high degree of customer engagement, a flexible consumer product line, as well as an optional virtual card. Its risk-based machine learning models allow for very fast decisions, simplifying the purchase process for consumers as well as the retail organizations they frequent.

IT and Business Challenges

Snap Finance is a cloud-forward organization. The company’s IT team manages some on-premises infrastructure at the company’s headquarters in Salt Lake City, UT, and a secondary center in Costa Rica, but all internet and business-facing applications are now in the cloud.

Gaurav Kohli, Snap Finance’s CTO, is responsible for managing all digital properties across both physical sites and in the cloud, with an emphasis on security and scalability. “We have several thousand API endpoints,” Kohli explained. “Not only do we serve our consumers through our own digital properties, we also have direct integrations with marketplaces and other large merchants that interact directly with our APIs. Making sure all of this data is secure is no easy task.”

Maria Ng is the company’s CISO. When she joined Snap Finance in 2022, her mandate was to optimize the company’s digital properties, using API-first approaches. She is now responsible for protecting all of Snap Finance’s corporate, customer, and merchant data. She also manages the company’s privacy, governance, risk and compliance, and cyber security programs. “Our strategy is to be omnichannel,” she explained. “We want to meet the customers wherever they are—whether that’s Android, iOS, desktop, or browsers. We recently launched our new mobile app and it has already surpassed 500,000 downloads with a 4.9 rating. This is why protecting our APIs is so important to us.”

Before moving to Cequence, Snap Finance used a collection of disparate fraud protection technologies. The company’s security team was able to identify and block many potential threats with those solutions, but they were unable to perform bot management in an easy and effective manner

Snap Finance started looking for an automated bot management solution two years ago. “We needed to find a partner with a broad understanding of the API and security space,” said Kohli. “We also wanted to work with a vendor that provided a managed service, rather than having to employ more security personnel to cover all of these necessary functions.”

Challenges

• Wanted to improve and automate bot management

Solution

Cequence Bot Management

Benefits

• Enhanced API security with better defense at the perimeter
• Effective bot management reduced the number of reportable threats to zero
• Eliminated the need to hire two full-time security professionals

Choosing Cequence Bot Management

Snap Finance chose Cequence after evaluating several potential bot management vendors. A module of the Cequence Unified API Protection platform, Cequence Bot Management was first deployed to protect Snap Finance’s consumer application portal – the platform consumers use to see if they are qualified, and where returning customers can log in and apply for new loans or leases.

“We haven’t found another bot protection solution in the market today that can compete with what Cequence is offering,” admitted Kohli. “None of them have a story that’s as compelling or a solution as robust as the Cequence Unified API Protection platform.”

The Cequence bot management and fraud prevention solution protects an organization’s web, mobile, and API applications from the full range of bot attacks to prevent data loss, theft, and fraud. Powered by an ML-based analytics engine that determines in real time if application and API transactions are malicious or legitimate, Cequence Bot Management natively mitigates attacks and eliminates harmful business impacts such as downtime, brand damage, skewed sales analytics, and increased infrastructure costs. Bot Management is available standalone or as part of the Cequence Unified API Protection platform.

Improved API Security Posture with Defense at the Perimeter

“In terms of bot protection, my philosophy is to ‘keep the fight outside my lawn’,” explained Ng. “I don’t want to have any interactions with threat actors on my edge — I want to push that perimeter out as far as I can. Cequence is able to intercept bad traffic from threat actors outside of our perimeter. With this capability, our threat posture has been significantly improved.”

Automating Bot Management

“The Cequence managed service has definitely reduced the number of things our security team needs to pay attention to,” noted Ng. “Cequence provides consistent, detailed reports on what threats were received, how much traffic was blocked, which threats were automatically mitigated, the ones advanced to manual review, and any threats we were notified on. The Cequence managed service gives us much more breathing room. By taking care of bot management for us, we can now focus on other strategic IT projects.”

Reducing the Number of Reportable Breaches to Zero

One of Ng’s responsibilities as CISO is to provide regular security updates to the company’s board of directors. “I inform them of any reportable breaches and attempted attacks,” said Ng. “At our last meeting, I was happy to inform them that we’ve had no reportable breaches since deploying Cequence.”

“When I first joined Snap Finance, there were some bad actors trying to use our applications to obtain confidential information,” Ng shared. “Fortunately, we were able to use Cequence to mitigate that attack, avoiding any availability or data loss issues.”

Benefits

• No CAPTCHA Needed Network-based approach requires no agents, JavaScript, or SDK integration
• Native Mitigation Attack identification and blocking without relying on third-party infrastructure such as WAFs
• Rapid Time to Value Deploys quickly and is immediately effective
• Flexible Deployment Model Supports on-premises, SaaS, or hybrid deployments
• Fraud Prevention Customizable, granular policies for organization-specific use cases

Reducing IT Expenses

Cequence is also enabling Snap Finance to reduce IT time and expense. “If we didn’t have the Cequence managed service, we would have to hire two full-time security professionals, in addition to purchasing and deploying another solution that would enable us to perform bot management by ourselves,” Kohli said.

Recommending Cequence to Others

When asked if he would recommend Cequence to other companies, Kohli replied, “Yes, absolutely. We have a very strong partnership with Cequence—they were right there with us all along the way. Our Cequence account rep meets with us regularly to discuss our deployment and listen to any suggestions we might have for future product enhancements. Unlike other partners or vendors, our relationship with Cequence did not end after we signed the sales agreement. They really care about our ongoing success with bot management. With Cequence, we worry less about malicious or suspicious traffic reaching our applications.”

About Snap Finance

Snap Finance harnesses the power of data to empower consumers of all credit types to get what they need. Launched in 2012, Snap’s technology utilizes more than a decade of data, machine learning, and non-traditional risk variables to create a proprietary platform that looks at each customer through a more holistic, human lens. Snap’s flexible solutions are changing the face and pace of consumer retail finance. For more information, visit snapfinance.com.

A Highly Successful Athletic-Inspired Fashion Retailer

Hibbett has grown rapidly in both size and popularity since opening its first store in Alabama in 1945. The company distinguishes itself from other retailers with its wide network of convenient locations in smaller cities that aren’t typically served by the larger brand stores, its personalized customer service, and comprehensive access to coveted footwear, apparel, and equipment from the nation’s top brands. In addition to its vast network of retail outlets located across the United States, Hibbett also supports a large on-line presence. Hibbett’s loyal customers can choose between visiting stores located in their own communities, or the convenience of ordering products from the company’s website (hibbett.com).

Challenges

• Needed better visibility into APIs to reduce the risk of data loss, theft, fraud, and business disruption
• Looking for a solution that was easy to deploy, without the need for third-party tools
• Wanted the ability to detect and remediate API vulnerabilities before moving new apps into production

IT and Business Challenges

Lee Morris has worked for Hibbett for over 30 years and is now the company’s Senior Director of Security and Infrastructure Architecture. “Security is no longer the department of ‘no’,” said Morris. “With all of the powerful technology solutions we have in place, we are now recognized as a business enabler.”

Hibbett relies on a hybrid IT environment for its retail and online operations. Several of the company’s critical services are supported on-premises, while others are now transitioning to the Oracle cloud, with a suite of SaaS products and Azure Identity Services. “Hibbett has gone from just a few API processes moving data between a couple of applications, to an environment where almost everything we do is through API communications,” said Stephen Scandrett, Senior Security Engineer at Hibbett Sports. “There’s a lot of data moving between all of our internal applications and external systems. Managing that communication from a security perspective is the ultimate priority for our team, given the importance of protecting our revenue stream, along with our proprietary and confidential customer information.”

Before implementing the Cequence solution, Hibbett was looking to strengthen their API security and bot management solutions. “We only have a modest number of APIs now, but that will increase rapidly as we move more of our infrastructure to the cloud,” explained Scandrett. “We needed a way to make sure everything was secure and built into the system before ramping up our API usage. We didn’t want to wait until it got beyond our control and became a headache to manage.”

Results

• Gained the ability to easily discover and protect all internal and external APIs
• Achieved a fast and seamless deployment, without needing third-party integration tools
• Obtained multiple API protection features with just one, integrated solution
• Increased data security by identifying and fixing API vulnerabilities before launch
• Gained the ability to create custom policies for mitigating and blocking bot attacks

Ensuring Availability

One of the IT team’s biggest challenges is protecting application availability during new solution deployments. “Everything needs to be operational 24×7, or it will have a negative impact on our business,” noted Scandrett. “Availability is a huge component of security, and I didn’t want any new security measures to affect our revenue streams or business partnerships in any way, shape, or form. We had to make sure any systems we implemented wouldn’t cause latency or throughput issues with our APIs or the data that’s transferred between them.”

Searching for a Way to Improve API Security

Morris and Scandrett started the search for an API protection solution by listening to peer reviews and reading industry analyst reports. They looked at the most recent Gartner Peer Insights data to identify the top API security companies.

Morris and Scandrett then created a list of the API security and bot management capabilities that were essential for their organization. “Discovery was the most important functionality for us because we had limited visibility into our internal and external APIs,” explained Scandrett. “The second criterion was the testing capabilities of the solution. Many of our APIs were developed in-house and we needed to strengthen the static and dynamic code analysis scanning to proactively identify vulnerabilities. We needed the ability to test all of our code and fix any issues before new applications were pushed out to production.”

Why Cequence Security?

After a thorough review of available offerings, including watching demos and attending several vendors’ presentations, Hibbett chose the Cequence Unified API Protection Platform. “Cequence was the only solution that met all of our criteria,” said Morris. “In addition to being named as an API protection technology leader in the industry analyst reports, Cequence had very positive customer reviews — not only for its API security products and capabilities, but for its high level of customer service as well.”

Another reason Hibbett chose Cequence was its out-of-the-box integrations with over 300 third-party APIs. “All of the other vendors’ solutions required some type of third- party tool to perform blocking actions for runtime protection,” Scandrett explained. “Whether a WAF or an API gateway, they all needed additional software to provide the necessary functionality. Cequence was the only vendor that was able to do everything we needed without requiring us to purchase and deploy any additional software.”

A Fast and Easy Deployment

The Cequence API protection solution was also very easy to deploy, requiring no changes to Hibbett’s on-premises, cloud, or SaaS infrastructure. Cequence was deployed fully on AWS with multiple availability zones and Auto Scaling groups enabling Hibbett to scale up and down automatically as needed. Traffic flowed in through the customer CDN, into AWS Cloud, through Amazon Route 53 DNS service, and into one of several Availability Zones. Within the Availability Zones, traffic flowed through a public subnet containing application load balancers and into a private subnet with an Auto Scaling group. From there, traffic was directed by a network load balancer and into the customer environment. All of this occurred within the Cequence AWS Cloud instance, ensuring a simple and straightforward deployment. “All we had to do was make a quick public DNS change to route our traffic through Cequence,” explained Scandrett. “It was as simple as that. We didn’t have to change any of our internal coding, and we experienced no down time or latency during the installation.”

Gaining Visibility into all APIs

Every API that Hibbett has is now going through Cequence. “One of the biggest benefits we’ve obtained with Cequence is the ability to identify all of our APIs and detect any flaws in our code before launching a new solution,” said Morris. “We see API breaches in the news all the time now, and this was an area where we really didn’t have enough insight. The Cequence Unified API Protection Platform is enabling us to ensure our critical services are adequately protected before deployment, allowing us to continue to grow and prosper in the highly competitive retail market.”

Saving IT Time and Accomplishing Multiple API Protection Goals

The Cequence solution has also eliminated the need for Hibbett’s security administrators to spend a lot of time on API management. “To put a number to the actual IT time savings we’ve obtained would have been impossible prior to deploying Cequence,” admitted Scandrett. “If we had attempted to do everything manually or seek out separate tools to accomplish what Cequence provides, it would have taken a huge amount of time. And even then, our efforts would have accomplished only a small portion of the work that Cequence can do as part of its comprehensive, API protection solution.”

Creating Custom Policies for Mitigation

“Our security team works with Cequence’s threat intelligence professionals in to create custom policies for mitigation and blocking bot attacks,” said Scandrett. “That’s another reason we chose Cequence. As far as I know, none of the other API protection vendors provide a 24/7 threat monitoring service. This visibility enables us to fine-tune our security policies based on threats that could potentially harm our operations. Knowing what’s out there and gaining the ability to proactively block malicious traffic is obviously helping us mitigate risk.”

Recommending Cequence to Others

When asked if he would recommend the Cequence solution to his peers, Scandrett replied, “Absolutely. Cequence is a great fit for any organization that doesn’t want to dedicate a lot of extra IT resources to deploying API protection using a mix of third-party tools. Cequence does everything we need in just one comprehensive, integrated tool.”

Final Thoughts

“At Hibbett, IT has been able to transform from being simply a cost center, to a strategic arm of the organization that is contributing to the bottom line,” concluded Morris. “We are now creating efficiencies in the processes that we couldn’t provide without the infrastructure and the systems we have in place. The Cequence Unified API Protection Platform is one of the key technologies that is enabling our IT security team to become a much larger contributor to our company’s success.”

TL;DR: Agentic AI security vendors protect agents that plan, call tools, and act on enterprise systems. Cequence is best for comprehensive agent containment, Zenity for SaaS agent governance, Noma for homegrown agents, Prisma AIRS for platform consolidation.

What Is an Agentic AI Security Solution and How Should You Evaluate One?

Evaluating agentic AI security vendors requires looking past marketing demos to assess core capabilities like data-layer controls, runtime behavior monitoring, and shadow AI discovery. Unlike conventional applications, agents may dynamically choose which APIs to call, access sensitive data, generate code, or modify external systems. This creates security risks that cannot always be addressed with fixed access controls or application security tools.

These vendors typically secure the full agent lifecycle. Their products may discover deployed agents, monitor prompts and tool calls, enforce permissions, detect prompt injection, restrict access to sensitive data, and log agent actions for investigation and compliance. Some also evaluate agents before deployment by testing how they respond to malicious inputs, excessive permissions, compromised tools, and other attack scenarios.

Key evaluation criteria

Use these five dimensions to compare vendors on the same terms:

• Agent and AI discovery: Whether the platform finds every agent, MCP server, tool, and model in the environment, including ones deployed without approval.
• Identity and least-privilege access control: Whether each agent gets its own scoped identity and permissions tied to your identity provider.
• Runtime enforcement at the tool and API layer: Whether the platform inspects and blocks individual tool calls and API calls inline, across a full session.
• Visibility, audit logging, and compliance evidence: Whether the platform attributes every action and retains it in a form auditors and incident responders can use.
• Deployment model and enterprise scale: Whether the platform fits your deployment constraints, throughput, and licensing model without rewriting agents.

Solutions covered in this guide:

Agentic AI Security Platforms

• Cequence Security: Inline agent identity, least-privilege access, tool-call enforcement, and AI discovery.
• Zenity: Agent discovery, posture management, and runtime enforcement across SaaS, cloud, and endpoints.
• Noma Security: Discovery, access control, runtime detection, and red teaming across homegrown, SaaS, and endpoint agents.
• HiddenLayer: Model, AI supply chain, runtime, and agentic security with attack simulation.

Enterprise Security Platforms with Agentic AI Coverage

• Palo Alto Networks Prisma AIRS: AI discovery, agent identity, runtime protection, red teaming, and AI gateway controls.
• Cisco AI Defense: Network-level AI guardrails, MCP security, AI discovery, and supply chain risk management.
• CrowdStrike Falcon Guardian: Endpoint-focused agent discovery, prompt-to-action tracing, runtime detection, and containment.
• Microsoft Entra Agent ID: Managed agent identities, Conditional Access, lifecycle governance, and agent registry capabilities.

In this article:

• Why Organizations Need Dedicated Security for Agentic AI
• How to Choose an Agentic AI Security Vendor
• Common Agentic AI Security Platforms and How They Meet the Criteria
• Notable Agentic AI Security Vendors

Why Organizations Need Dedicated Security for Agentic AI

Autonomous Decision-Making Expands the Attack Surface

Traditional applications generally follow predefined execution paths. AI agents can select actions dynamically based on their instructions, available context, model output, and intermediate results. The same input can therefore lead to different sequences of tool calls and system interactions.

Security teams need visibility into these decision paths rather than only the initial prompt and final response. Controls should detect unexpected actions, enforce boundaries at runtime, and prevent an agent from exceeding its intended role even when its reasoning or planning changes.

Agents Can Access Tools, APIs, and Sensitive Systems

Agents become more consequential when connected to databases, SaaS applications, internal APIs, code repositories, browsers, or infrastructure. An agent with broad credentials may be able to read confidential information, modify records, send messages, execute code, or change system configurations.

Security should apply least-privilege access to each agent and tool. It should also validate tool parameters, control credential use, restrict sensitive operations, and require additional authorization for high-impact actions. Monitoring should connect each action to the agent, user, tool, and data involved.

Prompt Injection Can Influence Multi-Step Workflows

Prompt injection occurs when malicious instructions alter how an AI system behaves. For agents, those instructions may come directly from a user or indirectly from content the agent retrieves, such as a web page, document, email, or tool response.

The risk extends beyond producing an incorrect answer. A successful injection can influence later planning and tool use, potentially causing data disclosure or unauthorized actions. Effective defenses combine input and content inspection with permission boundaries, tool-call validation, data controls, and monitoring throughout the workflow.

How to Choose an Agentic AI Security Vendor

Each criterion below covers a distinct control. Work through them in order, because discovery limits what identity can scope, identity limits what runtime enforcement has to catch, and logging determines what you can prove afterwards.

1. Agent and AI Discovery

Agents enter an enterprise from several directions at once. Engineering teams build them on cloud model platforms, business users assemble them in low-code tools, and employees connect coding assistants to MCP servers without telling security. A platform cannot protect agents it never sees, so discovery sets the ceiling for every other control in the stack. It also determines whether your inventory is a real picture of the estate or only a list of what was registered voluntarily.

Evaluation criteria:

• Does it find agents across cloud, SaaS, endpoint, and homegrown environments?
• Does it inventory MCP servers, tools, skills, and LLM providers, not just agents?
• Does it map each agent's connections, permissions, and data access paths?
• Does it surface shadow AI deployed without security approval?
• Does discovery run continuously rather than as a one-time scan?

2. Identity and Least-Privilege Access Control

An agent operating with a broad service account or an inherited user token can reach far more than its task requires. Many agent incidents involve permissions that were technically valid at every step. Controls here decide what an agent can touch before any detection is needed, so weak scoping pushes the entire burden onto runtime enforcement. Scoping should be per agent and per tool, not per platform.

Evaluation criteria:

• Does each agent get its own identity rather than sharing a human or service account?
• Does it integrate with your existing identity provider, including OAuth 2.0 or 2.1?
• Can permissions be scoped per agent, per tool, and per API?
• Does it manage token issuance, refresh, and revocation?
• Can agent access be time-bound and reviewed like any other account?

3. Runtime Enforcement at the Tool and API Layer

Prompt filtering stops some attacks, but agents cause damage through the actions they take. The meaningful control point is the call an agent makes to a tool, an MCP server, or an API. Enforcement should happen inline in that path and across a full session, because a chain of individually authorized calls can still add up to an outcome nobody approved. Detection alone is not enough if the platform cannot halt the agent.

Evaluation criteria:

• Does it inspect and block individual tool calls, not only prompts and responses?
• Does it evaluate a full session rather than one request at a time?
• Does it cover MCP traffic, direct API calls, and model routing?
• Can it halt an agent mid-execution, revoke access, or terminate a session?
• Does it detect prompt injection arriving from retrieved content, not just user input?

Related content: Read our guide to the top MCP security risks and how to prevent them

4. Visibility, Audit Logging, and Compliance Evidence

After an incident, the question is which agent did what, on whose behalf, with which tool, against which data. The same record carries the compliance load. The EU AI Act obliges deployers to monitor high-risk systems in operation, retain logs for at least six months, and report serious incidents, and auditors expect an inventory alongside them. Logs that stop at the prompt answer neither question.

Evaluation criteria:

• Is every tool call attributable to an agent, a user, and a data set?
• Do logs reconstruct the full action chain, not just fire alerts?
• Are logs retained long enough for your regulatory obligations?
• Does it export to your SIEM and existing investigation workflows?
• Does it produce inventory and policy reports auditors will accept?

5. Deployment Model and Enterprise Scale

Inline enforcement sits in the request path, which turns throughput, latency, and availability into security questions. Deployment effort matters just as much, because a control that requires rewriting agents or standing up new infrastructure tends to arrive long after the agents do. Licensing deserves the same scrutiny, since token and credit models behave differently from per-user pricing as adoption grows.

Evaluation criteria:

• Does it support SaaS, on-premises, or hybrid deployment to match data residency rules?
• Does onboarding require code changes to agents or applications?
• What latency does inline enforcement add, and is there a high-availability path?
• Are there separate pre-production and production modes?
• Is it licensed by tokens, agents, users, or traffic volume?

Common Agentic AI Security Platforms and How They Meet the Criteria

The table below summarizes how each platform measures up against the five criteria. Each one is explored in detail underneath, with a criteria-fit table of its own.

Category Solution How It Meets the Criteria Agentic AI Security Platforms Cequence Security Strongest on identity and inline enforcement at the agent-to-application path, with OAuth 2.1 integration, Agent Personas, and policy applied to every tool call. Discovery, audit trails, and SaaS or on-premises deployment are built in.  Agentic AI Security Platforms Zenity Broad discovery and posture across SaaS, cloud, and endpoint agents, with Runtime Boundaries that allow, block, or terminate an action in real time. Compliance evidence is less developed than detection and enforcement.  Agentic AI Security Platforms Noma Security Covers discovery, access control, red teaming, and runtime detection across three agent environments from one platform. Identity capability layers on the existing IdP rather than issuing agent credentials.  Agentic AI Security Platforms HiddenLayer Deep on model and supply chain security with agentless runtime defense and attack simulation. Little native identity or least-privilege scoping for agents, and deployment is reported as engineering-heavy.  Enterprise Security Platforms with Agentic AI Coverage Palo Alto Networks Prisma AIRS Covers all five criteria in one platform, including shadow AI discovery, agent identity, an AI Gateway, and posture management. Some modules are newer, and credit-based licensing complicates cost forecasting.  Enterprise Security Platforms with Agentic AI Coverage Cisco AI Defense Network-level guardrails and MCP scanning with no agents or libraries to deploy, plus standards alignment for audit. Agent identity sits in separate Cisco products, and coverage depends on Cisco network infrastructure.  Enterprise Security Platforms with Agentic AI Coverage CrowdStrike Falcon Guardian Runtime detection and containment at the point of execution, tying agent actions to endpoint telemetry. Coverage is anchored to managed endpoints, and the AI gateway capability is not yet available.  Enterprise Security Platforms with Agentic AI Coverage Microsoft Entra Agent ID Strongest on agent identity, lifecycle governance, and registry inside the Microsoft estate. Enforcement works at the identity and network layer rather than inspecting individual tool calls.

Notable Agentic AI Security Vendors

How we selected these solutions: We shortlisted agentic AI security platforms based on agent and AI discovery, agent identity and access control, runtime enforcement over tool and API calls, audit logging and compliance evidence, and enterprise deployment options.

Agentic AI Security Platforms

1. Cequence Security

Best for: Connecting agents to enterprise APIs and SaaS applications

Strengths: Agent Personas, trusted MCP registries, inline tool-call policy

Things to consider: Initial policy tuning takes time in large, complex estates

The Cequence AI Gateway sits between AI agents and the applications and data they reach. It authenticates the agent and then verifies every action the agent takes, enforcing policy inline in the request path for the duration of a session rather than at a single checkpoint.

The gateway treats an agent as a privileged insider rather than a tool. Access is bound to a written job description, and behavior is judged in context rather than on authentication alone. The product also converts existing internal, external, and SaaS APIs into MCP-compatible tools without code, which is how agents reach a catalog of more than 200 enterprise applications such as Salesforce, Jira, Slack, and Confluence.

Key features include:

• Agentic zero trust architecture: The gateway authenticates each agent and then verifies every subsequent action, applying policy inline in the request path across the full session and on each tool call.
• Agent Personas: An agent's job description, written in plain English, generates a persona carrying only the tools, APIs, skills, and permissions that job needs, with boundaries and guardrails applied automatically from that scope.
• Trusted registries and guardrails: The platform maintains registries of vetted MCP servers, APIs, LLMs, and skills. Prompt Guard screens prompts for injection, jailbreak, and system-prompt-extraction patterns, and organizations can add custom rules.
• End-to-end authentication and authorization: Integration with OAuth 2.1-compliant identity infrastructure applies organizational identity policies to agents, with built-in token lifecycle management and session binding that locks authenticated sessions to originating IP addresses.
• Monitoring and audit logging: Real-time visibility into AI-to-tool traffic records which applications agents access and which API calls they make, with tool-level and agent-level audit trails and SIEM integration.
• Sensitive data protection: DLP scanning is applied to agent requests and MCP server responses, with monitoring, redaction, and blocking across more than 100 out-of-the-box detection types, plus coverage across a sequence of calls rather than a single hook.
• AI Discovery and spend controls: The platform surfaces shadow MCP servers, agents, and LLM providers enterprise-wide from existing SIEM logs, and enforces token limits per minute, day, and month alongside monetary spend caps per team.

Criterion Solution Fit Key Considerations Agent and AI discovery AI Discovery surfaces sanctioned and shadow agents, MCP servers, and LLM providers enterprise-wide from existing SIEM logs, alongside API discovery and inventory. Discovery draws on SIEM log sources, so coverage tracks what those logs already capture.  Identity and least-privilege access control OAuth 2.1 IdP integration with token lifecycle management and RBAC. Agent Personas generate least-privilege scopes from a written job description. Personas need an accurate job description up front to scope an agent correctly.  Runtime enforcement at the tool and API layer Policy is enforced inline in the request path, for the full session, on every tool call. Prompt Guard, automated tool risk scoring, rate limits, and spend limits apply at the same point. Reviewers note that tuning detection and policy configuration takes time in large environments.  Visibility, audit logging, and compliance evidence Logs every user, agent, and tool action, with tool-level and agent-level audit trails that export to your SIEM. Cequence shares supporting documentation under NDA to help customers meet EU AI Act obligations. Confirm log retention periods and SIEM export formats match your regulatory obligations.  Deployment model and enterprise scale SaaS-based and on-premises deployment, horizontal scaling, no-code MCP enablement in minutes, continuous environment monitoring, and separate pre-prod and prod modes. Inline enforcement adds a single hop to the request path, so validate latency at peak agent traffic.

2. Zenity

Best for: Governing agents across SaaS platforms, cloud, and endpoints

Strengths: Runtime Boundaries, intent-aware AIDR, exposure validation

Things to consider: No documented sandboxed execution environment for agents

Zenity builds its platform around the moment an agent makes a decision, rather than around the prompt or the response. The architecture has three layers that operate as one system: Surface, Enforce, and Protect.

Surface builds a live inventory of agents, evaluates how each is configured, and tests which attack paths are actually exploitable. Enforce acts at the point a decision is made, allowing a safe action through or stopping an unsafe one. Protect watches what happens afterwards, reconstructing execution paths and turning each investigation into a sharper rule.

Coverage spans three agent types: agents embedded in SaaS products such as Salesforce Agentforce and Copilot Studio, homegrown agents on AWS Bedrock and Google Vertex AI, and personal or coding agents running locally.

Key features include:

• AI Observability: Builds a live inventory of agents across SaaS, custom, and endpoint deployments, and tracks the data each agent touches.
• AI Security Posture Management: Evaluates agent configuration and permissions against policy before an agent goes live, catching misconfigurations pre-deployment.
• AI Exposure Management: Validates which of an agent's attack paths are genuinely exploitable, scores each one, and produces a fix that can be applied directly in Runtime Boundaries.
• Runtime Boundaries: Evaluate every action an agent takes in real time and determine whether it proceeds, is blocked, or the agent is terminated, including for long-horizon agents running multi-step tasks over hours or days.
• Agentic Identity: Correlates enforcement with the credentials an agent actually holds, so a deactivated or over-scoped role is caught before it can be exploited.
• AI Detection and Response: Monitors execution step by step, reads a sequence of tool calls and retrievals together rather than in isolation, and maps findings to OWASP and MITRE ATLAS.
• MCP Security and DFIR: Covers MCP connections as a distinct control surface, while AI-powered forensics reconstruct the full decision chain when something gets through.

Criterion Solution Fit Key Considerations Agent and AI discovery AI Observability maintains a live inventory across SaaS, cloud, custom, and endpoint deployments, including shadow agents built on low-code platforms. Published peer review volume is limited, so coverage is best validated against your own estate in a trial.  Identity and least-privilege access control Agentic Identity correlates enforcement with each agent's actual credentials and flags deactivated or over-scoped roles. Works alongside an existing identity provider rather than issuing agent credentials itself.  Runtime enforcement at the tool and API layer Runtime Boundaries evaluate every action inline and allow, block, or shut down the agent. AIDR reads full execution chains rather than single events. No sandboxed execution environment for agents is publicly documented.  Visibility, audit logging, and compliance evidence Digital forensics reconstruct the full decision chain after an incident, and Guardian Agents convert investigations into policy. Compliance evidence automation is less developed than the detection and enforcement layers.  Deployment model and enterprise scale SaaS delivery covering SaaS agent platforms, cloud and homegrown agents, and local agents via lightweight monitoring. Available through cloud marketplaces. Coverage is broadest in Microsoft and SaaS-heavy estates; confirm depth for custom stacks.

3. Noma Security

Best for: Homegrown, SaaS, and endpoint agents from one platform

Strengths: AI-SPM, access control, red teaming, and runtime detection

Things to consider: Little independent review coverage to validate claims

Noma divides the enterprise AI estate into three environments and covers each with the same set of controls. Endpoint agents are the coding assistants and personal agents employees run on their own machines, connected to MCP servers that reach production code and internal APIs. Homegrown AI covers applications engineering teams build on AWS Bedrock, Azure AI Foundry, Databricks, LangChain, and CrewAI. SaaS agent platforms cover agents that business teams assemble in Copilot Studio, Agentforce, and ServiceNow.

Four products share intelligence across those environments. Discovery context makes access policies more precise, and a vulnerability found during red teaming becomes an enforced pattern in production.

Key features include:

• AI-SPM: Discovers every agent, MCP server, skill, and model across the three environments, then surfaces misconfigurations and combinations of agent capabilities that are risky together.
• Agent risk map: Shows each agent's blast radius, covering its connections, permissions, and data access paths, so cascading risk scenarios are visible before deployment.
• Access control: Policies govern which MCP servers, skills, and tools an agent may use, keyed to IdP groups or applied organization-wide by tool sensitivity, with a live registry of what is approved and blocking for everything else.
• AI-DR: Detects prompt injection, data exfiltration, scope violations, and agents drifting from their intent, evaluating each action against the session around it, the identity behind the agent, and behavior over time.
• Graduated response: Based on policy, runtime detection alerts, blocks, masks data, or routes an action to a human rather than applying a single response to every finding.
• AI red teaming: Compounds attack techniques into multi-turn campaigns that escalate at each turn, with prebuilt scan profiles and compliance presets, and findings feed directly into AI-DR runtime policies.
• Compliance and supply chain coverage: Produces inventory, framework mappings, test results, and audit trails, and scans models, MCP servers, tools, and packages across the AI supply chain.

Criterion Solution Fit Key Considerations Agent and AI discovery AI-SPM discovers every agent, MCP server, skill, and model across endpoint, SaaS, and homegrown environments, with an agent risk map of connections and data access. Discovery routinely surfaces far more assets than teams expect, which requires triage capacity at rollout.  Identity and least-privilege access control Access control policies are keyed to IdP groups or applied by tool sensitivity, and agentic identity use cases tie actions to the identity behind the agent. Layers on the existing identity provider rather than issuing scoped agent credentials itself.  Runtime enforcement at the tool and API layer Access control blocks unapproved MCP servers, skills, and tools. AI-DR evaluates each action in session context and can alert, block, mask data, or escalate. Enforcement depth varies by environment, so test in the one where your agents actually run.  Visibility, audit logging, and compliance evidence Compliance and reporting cover inventory, framework mappings, red team results, and audit trails from a single control plane. Independent review coverage is sparse, so reference calls carry more weight than published ratings.  Deployment model and enterprise scale One platform spanning three environments, with SaaS or self-hosted options and policies applied organization-wide or per group. Breadth across three environments can mean less depth than a specialist in any single one.

4. HiddenLayer

Best for: Model-level and AI supply chain security across the lifecycle

Strengths: Agentless runtime defense, attack simulation, model scanning

Things to consider: Deployment reported to need ML and infrastructure engineers

The HiddenLayer AISec Platform covers four modules across the AI lifecycle: AI Discovery, AI Supply Chain Security, AI Runtime Security, and AI Attack Simulation. Its origin is model security, and the platform still works closest to the model, validating integrity before deployment and detecting attacks against models in production.

Agentic coverage sits on top of that foundation. Agentic and MCP security protects autonomous agents from prompt injection, unsafe tool use, and harmful autonomous actions, and Agent Harness Security adds runtime visibility and inline enforcement for AI coding agents.

The platform is model-agnostic and agentless, and it operates without access to model weights, prompts, training data, or customer data. Native connectors cover cloud platforms, CI/CD, data platforms, SIEM and SOAR, API gateways, and MLOps tooling.

Key features include:

• AI Discovery: Builds a living inventory of AI across the environment, including shadow AI, showing where models are used, by whom, and with what level of access.
• AI Supply Chain Security: Scans models for malware, vulnerabilities, backdoors, and unknown components before they reach production, validating integrity and supply chain provenance.
• AI Runtime Security: Detects and responds to attacks in production without requiring access to intellectual property, weights, prompts, or customer data.
• AI Attack Simulation: Runs adversarial simulations continuously against AI systems rather than as a periodic exercise, uncovering weaknesses as the systems change.
• AI Guardrails: Enforce policies that prevent prompt injection, data leakage, and unsafe AI behavior in real time across applications, models, and business units.
• Agentic and MCP security: Protects autonomous and tool-using systems from misuse, privilege escalation, and cross-system exploitation, with Agent Harness Security covering AI coding agents specifically.
• Governance and posture: Provides organization-wide visibility into every model, applies consistent governance rules, classifies risk, and monitors posture against security and regulatory standards.

Criterion Solution Fit Key Considerations Agent and AI discovery AI Discovery builds a living inventory of AI assets across environments, including shadow AI, with visibility into how and where models are used. Inventory centers on models and AI assets more than the agent-to-application call path.  Identity and least-privilege access control Runtime controls prevent unauthorized tool usage, but agent identity issuance and permission scoping are not part of the platform. Requires a separate identity layer for agent credentials and least-privilege scoping.  Runtime enforcement at the tool and API layer AI Runtime Security detects and responds in production. Agentic and MCP security covers prompt injection, unsafe tool use, and harmful autonomous actions, with inline enforcement for coding agents. Reviewers report the integration is hard to deploy and demanding to maintain.  Visibility, audit logging, and compliance evidence Governance and posture features give organization-wide visibility, risk classification, and policy monitoring, with native SIEM and SOAR connectors. Peer review volume is low, so compliance reporting is best validated during a trial.  Deployment model and enterprise scale Model-agnostic and agentless, deployable across any architecture without exposing weights, prompts, or customer data. SaaS, on-premises, air-gapped, and hybrid are supported. Reviewers describe deployment as requiring a sizeable ML and infrastructure engineering effort.

Source: HiddenLayer

Enterprise Security Platforms with Agentic AI Coverage

5. Palo Alto Networks Prisma AIRS

Best for: Consolidating AI security inside a Palo Alto Networks estate

Strengths: Discovery, posture, red teaming, runtime, and AI Gateway

Things to consider: Some modules are early stage; credit-based licensing

Prisma AIRS organizes AI security into three stages: discover shadow AI, assess new risks, and protect against threats at runtime. The platform covers AI agents, applications, models, and data from development through deployment, and its modules can be adopted individually or together.

Agent coverage runs through two components. Agent Security verifies each agent identity and enforces real-time controls to stop unauthorized actions as deployments move from pilot to production. The AI Gateway acts as a control plane for enterprise AI activity, governing and securing how applications and agents reach models and services.

Deployment modes include Network Intercept and API Intercept, and a managed AI Runtime Security option removes the setup work for containers, applications, and cloud infrastructure.

Key features include:

• Agent Security: Verifies every agent identity and enforces real-time controls over agent actions, with defenses against prompt injection, tool misuse, and memory manipulation.
• AI Gateway: Serves as the enterprise AI control plane, discovering, governing, and securing AI activity across applications, agents, models, and services.
• AI Runtime Security: Monitors AI behavior during live interactions and enforces safeguards against manipulation, data exposure, and unsafe actions, with a managed option available.
• AI Red Teaming: Simulates real-world attacks continuously against AI agents and applications, including multi-turn attacks, multi-agent systems, and agentic target profiling.
• AI Model Security: Scans third-party models for tampering, malicious scripts, and deserialization attacks before they are adopted.
• AI Posture Management: Covers the data used for training and inference, the integrity of agents and applications, and access to deployed models.
• Discovery and reporting: Provides visibility into every AI agent, app, and model and how they connect, including endpoint and browser-based agents, plus API violation views and threat snippets in reporting.

Criterion Solution Fit Key Considerations Agent and AI discovery Discovers shadow AI and inventories every AI agent, app, and model, mapping how they connect across cloud, SaaS, endpoint, and browser environments. Deepest value comes when other Palo Alto Networks products are already in place.  Identity and least-privilege access control Agent Security verifies each agent identity and enforces real-time controls to stop unauthorized actions at production scale. Agent identity governance is newer than the model and runtime modules.  Runtime enforcement at the tool and API layer AI Runtime Security enforces safeguards during live interactions, and the AI Gateway governs agent access to models and services. Network Intercept and API Intercept are both supported. Reviewers describe some features as early stage, with a learning curve to use them well.  Visibility, audit logging, and compliance evidence AI Posture Management covers data, agent and app integrity, and model access, with API violation views and threat snippets in reporting. Reviewers report alerts and reports need extra tuning to fit a specific environment.  Deployment model and enterprise scale Managed AI Runtime Security reduces deployment friction, and the platform secures containers, multicloud environments, and high-throughput systems. Credit and token-based licensing makes cost forecasting harder at variable volumes.

Source: Palo Alto Networks

6. Cisco AI Defense

Best for: Network-level AI enforcement in Cisco-run environments

Strengths: Agentless guardrails, MCP scanning, Talos threat intelligence

Things to consider: Documentation reported as hard to navigate

Cisco AI Defense covers two paths: organizations using third-party AI applications, and organizations developing their own AI applications and agents. Both run through the same discover, detect, and protect sequence.

The distinguishing choice is where enforcement lives. Cisco applies AI security at the network level, without agents or libraries in the application, which separates AI development from the security controls around it. That same network position provides visibility into AI traffic across distributed environments.

Agentic coverage extends to the Model Context Protocol. The platform scans MCP servers for compromised or malicious assets, enforces runtime protections across MCP requests and responses, and detects agent-specific threats including memory poisoning, tool misuse, privilege escalation, intent hijacking, and deceptive agent behavior.

Key features include:

• AI Runtime Protection: Embeds guardrails in the network to block adversarial attacks and harmful responses in real time, covering prompt injection, model denial of service, code detection, and off-topic attacks.
• AI Model and Application Validation: Uses algorithmic red teaming to identify safety and security vulnerabilities across models at scale, with results returned in seconds.
• AI Cloud Visibility: Inventories AI models and connected data sources across distributed environments to show usage and gauge risk.
• AI Access: Surfaces third-party AI applications in use across the organization and enforces policies that manage employee access and limit sensitive data exposure.
• AI Supply Chain Risk Management: Identifies malicious code, poisoned data, unsafe tools, compromised components, and high-risk MCP assets using Cisco threat intelligence and proprietary scanning.
• Standards alignment: A single integration maps to NIST, MITRE ATLAS, and the OWASP LLM Top 10, with a published AI safety and security taxonomy.
• Threat intelligence and Explorer Edition: Detections are informed by Cisco's AI research lab and Talos, and a self-service Explorer Edition provides red teaming for agentic workflows and model testing.

Criterion Solution Fit Key Considerations Agent and AI discovery AI Cloud Visibility inventories AI workloads, applications, models, data, and users across distributed cloud environments. AI Access surfaces third-party AI applications in use. Discovery relies on network-level visibility, so activity outside Cisco's path is harder to see.  Identity and least-privilege access control AI Access monitors and manages access to third-party AI applications and enforces policies on that access. Agent identity itself is handled by Duo and Cisco Identity Intelligence rather than by AI Defense.  Runtime enforcement at the tool and API layer Guardrails embedded in the network block adversarial attacks in real time. MCP requests and responses are protected, and agent threats such as memory poisoning, tool misuse, and privilege escalation are detected. Reviewers report the features are powerful but hard to understand how to use correctly.  Visibility, audit logging, and compliance evidence A single management plane covers all AI, with Cisco Security Cloud integration and alignment to NIST, MITRE ATLAS, and the OWASP LLM Top 10. Reviewers describe documentation as difficult to navigate.  Deployment model and enterprise scale Enforcement runs at the network level with no agents or libraries to install, integrating with Cisco Security Cloud and Splunk data. Value depends on already running Cisco network and security infrastructure.

Source: Cisco

7. CrowdStrike Falcon Guardian

Best for: Securing endpoint and computer-use agents at execution

Strengths: Shadow AI discovery tied to existing Falcon endpoint telemetry

Things to consider: AI gateway capability announced but not yet available

Falcon Guardian applies AI detection and response at the point where agents execute. The argument behind it is that computer-use agents reach identities, data, files, browsers, shells, and system settings while acting with user permissions, so behavior at the endpoint is indistinguishable from legitimate user activity unless the AI context is attached to it.

The product connects agent activity to endpoint telemetry, tracing how a user prompt leads to downstream processes and system actions. It runs on the same Falcon sensor that CrowdStrike already deploys for endpoint protection, so no separate agent is required where Falcon is in place.

Coverage extends beyond endpoints to cloud and SaaS environments, and includes both workforce use of AI tools and homegrown agents and workloads.

Key features include:

• Shadow AI discovery: Identifies workforce AI use and endpoint agents, showing what is in use, who is using it, token consumption, and where unmanaged risk exists.
• Prompt-to-action tracing: Connects agent activity with endpoint telemetry to establish how a prompt led to specific processes and system actions.
• AI usage and access governance: Turns governance policy into enforceable controls over how users interact with AI tools and which AI agents are permitted to run.
• Prompt injection detection: Inspects AI interactions at runtime for direct and indirect prompt injection spanning more than 200 techniques, blocking malicious interactions before they manipulate an agent.
• Sensitive data controls: Identifies sensitive data in AI interactions and applies runtime controls to redact, encrypt, or block it before exposure.
• Runtime containment: Detects compromised agents, reconstructs what happened, determines blast radius across affected agents and systems, and deploys containment actions.
• SIEM integration: AI telemetry is brought together with endpoint, identity, cloud, SaaS, and third-party data in Falcon Next-Gen SIEM for unified detection and investigation.

Criterion Solution Fit Key Considerations Agent and AI discovery Discovers shadow AI agents on endpoints and across cloud and SaaS, showing what is running, who uses it, and token consumption. Coverage is anchored to managed endpoints, so unmanaged hosts fall outside scope.  Identity and least-privilege access control Governs how users interact with AI tools and defines which AI agents are permitted to run. Governs permission to run rather than issuing scoped identities and per-tool permissions.  Runtime enforcement at the tool and API layer Inspects AI interactions for direct and indirect prompt injection across more than 200 techniques, and deploys containment actions at the point of execution. Published detection and latency figures come from internal benchmarks, so test with your own traffic.  Visibility, audit logging, and compliance evidence Traces prompts to downstream processes and system actions, reconstructs incidents, and determines blast radius, with native ingestion into Falcon Next-Gen SIEM. Investigation workflows assume Falcon is already the telemetry backbone.  Deployment model and enterprise scale Runs on the existing Falcon sensor, so no separate agent is needed where Falcon is already deployed. The AI gateway capability is announced but not yet available.

Source: CrowdStrike

8. Microsoft Entra Agent ID

Best for: Giving agents managed identities inside the Microsoft estate

Strengths: Conditional Access, lifecycle governance, agent registry

Things to consider: Capabilities gated behind specific licensing tiers

Microsoft Entra Agent ID extends existing identity and access management to AI agents, treating each agent as a first-class identity that can be authenticated, governed, and protected in the same way as an employee account.

The controls are the ones Microsoft-centric security teams already run. Conditional Access evaluates each access attempt, identity governance automates the lifecycle from deployment to expiry, identity protection flags suspicious activity, and network controls log and restrict what agents can reach.

Agent ID capabilities are delivered through Microsoft Agent 365, the control plane for agents. Agent 365 maintains a unified registry covering agents from Microsoft AI platforms, partner agents registered through its SDK, and self-registered agents from platforms it does not manage.

Key features include:

• Agent identities at scale: Every agent receives a built-in identity that enables authentication, policy enforcement, and integration with existing organizational policies.
• Conditional Access for agents: Real-time policies evaluate agent access to resources, block risky agents, and apply granular access controls based on configured security attributes.
• Identity governance: Automates governance from deployment to expiration, assigns and maintains sponsors, and enforces access assignments that are intentional, auditable, and time-bound.
• Identity protection: Detects and flags unusual or unauthorized agent activity, traces agents with compromised tokens, and supports remediation of compromised agents.
• Network controls: Log agent network activity for audits and threat detection, apply web categorization to APIs and MCP servers, restrict file uploads and downloads, and automatically block malicious destinations.
• Unified agent registry: Agent 365 maintains an inventory of the agent fleet with usage insights and visual mapping of agent activity and connections.
• Integrated security stack: Access control and identity protection come from Entra, security posture and threat protection from Defender, and data security and compliance from Purview.

Criterion Solution Fit Key Considerations Agent and AI discovery Agent 365 provides a unified registry covering Microsoft AI platform agents, partner agents via SDK, and self-registered agents, with usage insights and activity mapping. Agents created before Entra agent registration existed cannot be assigned an Agent ID retroactively.  Identity and least-privilege access control Each agent gets a first-class identity with Conditional Access, lifecycle governance, assigned sponsors, and time-bound access assignments. Several controls require specific Microsoft 365 licensing tiers before they take effect.  Runtime enforcement at the tool and API layer Identity Protection flags unusual agent activity and compromised tokens. Network controls apply web categorization to APIs and MCP servers and block malicious destinations. Enforcement sits at the identity and network layer rather than inspecting individual tool calls.  Visibility, audit logging, and compliance evidence Logs agent network activity for audits and threat detection, with Purview covering data security and compliance for agents. Evidence gathering is strongest for agents inside the Microsoft estate.  Deployment model and enterprise scale Foundational capabilities come with Microsoft Cloud subscriptions; premium capabilities require an Agent 365 license or Microsoft 365 E7. Third-party agents that do not integrate the Agent 365 SDK remain unmanaged.

Source: Microsoft

Conclusion

Agentic AI security requires controls that follow agents from discovery and identity through runtime execution and audit. Organizations should evaluate whether a platform can find shadow agents and connected tools, assign or enforce least-privilege access, inspect consequential actions at runtime, and reconstruct activity for investigations and compliance. Deployment architecture also matters because inline controls must provide adequate performance and coverage without creating excessive integration work as agent adoption grows.

TL;DR: Agentic AI security tools control what AI agents do at runtime, which tools they call, and what data they reach. Cequence AI Gateway is best for governing agent access to apps and APIs, Zenity for multi-platform agent governance, Prisma AIRS for Palo Alto environments, and Lakera for real-time prompt and data guardrails.

What Are Agentic AI Security Tools?

Securing autonomous AI agents requires inline agentic AI security controls and runtime monitoring to manage permissions, block goal hijacking, and prevent data leaks. Traditional security assumes human users, but AI agents move at machine speed and use valid credentials.

Unlike traditional LLM applications that mainly generate content, agents can interact with APIs, databases, browsers, code execution environments, and other systems. This creates security risks beyond prompt and model behavior. Protecting them requires a focus on two main areas:

Runtime behavior and tool use:

• Detect unexpected or malicious agent behavior by monitoring execution traces for suspicious actions and policy violations.
• Restrict which tools agents can use based on identity, role, task, environment, and authorization context.
• Validate tool calls before execution to block unauthorized operations, suspicious arguments, and high-risk requests.
• Control tool parameters and allowed actions by limiting functions, resources, parameter values, destinations, and data scopes.
• Monitor MCP servers and external integrations for excessive permissions, unexpected tool changes, sensitive data exposure, and suspicious activity.

Data access:

• Apply least-privilege data access by limiting permissions according to the resource, operation, session, or task.
• Enforce agent identity and authorization so access reflects both the agent's permissions and those of the user it represents.
• Restrict access to sensitive data sources such as customer records, credentials, financial information, and production data.
• Detect sensitive data in prompts and responses and redact, mask, block, or restrict it when required.
• Prevent unauthorized data exfiltration by inspecting outbound tool calls, network requests, messages, uploads, and generated responses.

In this article:

• Agentic AI Security Tools at a Glance
• How Agentic AI Security Tools Secure Runtime Behavior, Tool Use, and Data Access
• Notable Agentic AI Security Tools for Runtime Behavior, Tool Use, and Data Access

Agentic AI Security Tools at a Glance

The table below summarizes the key differences between the agentic AI security tools covered in this guide. We explore each tool in more detail in the sections that follow.

Category Solution Best For Key Strengths Things to Consider Agent Runtime Governance and Access Control Cequence AI Gateway Governing agent access to enterprise apps, APIs, and MCP tools Agent Personas, inline tool-call enforcement, DLP on MCP traffic Initial setup and policy tuning can take time  Agent Runtime Governance and Access Control Zenity Securing agents across SaaS, cloud, and endpoint environments Intent-based detection across full agent execution paths Enforcement depth varies by platform; no public pricing  Agent Runtime Governance and Access Control Noma Security Discovery, access control, and runtime detection for AI agents Session-level behavioral context, IdP-keyed tool policies Integration into complex AI environments; pricing on request  Agent Runtime Governance and Access Control Prisma AIRS Agent Security Palo Alto Networks customers securing agents across the lifecycle Central control of tool calls, LLM traffic, and MCP connections Some features feel early-stage; tied to Palo Alto ecosystem  Runtime Guardrails and AI Threat Detection Lakera AI Agent Security Real-time guardrails on agent inputs, outputs, and actions Prompt attack detection in 100+ languages, sub-50 ms latency Multimodal inspection limited to text in some integrations  Runtime Guardrails and AI Threat Detection Prompt Security (SentinelOne) Governing workforce AI use, agents, and MCP servers together Shadow MCP discovery, least-privilege agent scope, audit log Full coverage may need extension, agent, and proxy setup  Runtime Guardrails and AI Threat Detection Lasso Intent-based runtime protection with discovery and red teaming Inline enforcement at proxy, API, or gateway; 3,000+ attacks Requires CI/CD and platform integration; few user reviews  Runtime Guardrails and AI Threat Detection HiddenLayer AI Runtime Security Runtime detection and enforcement for agents and MCP traffic Tool-use inspection and session reconstruction Needs SDK, proxy, or gateway instrumentation

How Agentic AI Security Tools Secure Runtime Behavior, Tool Use, and Data Access

Securing Agent Runtime Behavior and Tool Use

Agentic AI security tools apply controls while an agent is running, rather than relying only on safeguards built into the model or application. They observe agent decisions, tool calls, inputs, outputs, and interactions with external systems. This makes it possible to detect and block unsafe actions before they execute.

1. Detect Unexpected or Malicious Agent Behavior

Security tools can monitor an agent's execution trace for behavior that violates expected patterns or defined policies. Examples include:

• Repeated access attempts
• Unusual tool sequences
• Attempts to retrieve unrelated sensitive data
• Actions triggered by prompt injection

Runtime monitoring can combine fixed policies with behavioral detection. When suspicious activity occurs, the security layer can block an action, terminate the agent session, require human approval, or generate an alert for investigation.

2. Restrict Which Tools Agents Can Use

Agents should only have access to tools required for their assigned tasks. Security controls can enforce allowlists or deny lists based on the agent's:

• Identity
• Role
• Task
• Environment
• Current authorization context

These restrictions reduce the impact of compromised or incorrectly behaving agents. For example, a research agent might be permitted to search internal documentation but prevented from executing shell commands, modifying production databases, or sending external messages.

Related content: Read our guide to agentic AI governance

3. Validate Tool Calls Before Execution

Security tools can intercept tool calls before they reach the target system. The security layer can check whether the requested tool, operation, and context comply with policy before allowing execution.

Validation can also detect malformed requests, suspicious arguments, or calls produced after an untrusted instruction enters the agent's context. High-risk operations can be rejected or routed to a human for approval instead of executing automatically.

4. Control Tool Parameters and Allowed Actions

Allowing access to a tool does not mean an agent should be allowed to perform every operation that tool supports. Controls can restrict:

• Individual functions
• Resources
• Parameter values
• Destinations
• Data scopes

For example, an agent might receive read access to a database while write and delete operations remain blocked. A messaging tool could allow communication only with approved domains, while a file tool could limit access to directories. Parameter-level controls provide finer-grained protection than tool-level permissions alone.

5. Monitor MCP Servers and External Integrations

Model Context Protocol (MCP) servers can expose data sources and tools to agents through a common interface. Security tools can inspect MCP connections, tool definitions, requests, responses, and authorization decisions to identify risky or unauthorized activity.

Monitoring is also important when MCP servers or other integrations are operated by third parties. Controls can detect unexpected tool changes, excessive permissions, sensitive data exposure, and suspicious responses. Organizations can then enforce policies at the integration boundary instead of trusting every connected server or service implicitly.

Securing Agent Data Access

Agentic AI security tools control which data an agent can retrieve, process, and disclose. These controls are especially important because agents may combine information from databases, files, SaaS applications, APIs, and other sources while completing a task.

6. Apply Least-Privilege Data Access

Agents should receive only the data permissions required for their current tasks. Instead of giving an agent broad, persistent permissions, security tools can limit access by:

• Resource
• Operation
• Session
• Task

For example, an agent that summarizes support tickets may need read access to selected ticket fields but not billing records or account credentials. Narrow permissions reduce the amount of data exposed if the agent is manipulated or behaves unexpectedly.

7. Enforce Agent Identity and Authorization

Security controls can assign each agent or agent session a distinct identity and evaluate authorization before granting access to protected resources. This avoids relying on shared credentials that make it difficult to determine which agent performed an action.

Authorization can also include the identity and permissions of the user the agent represents. An agent should not gain access to information simply because its service account has broader privileges than the requesting user.

8. Restrict Access to Sensitive Data Sources

Organizations can define policies that prevent agents from accessing specified:

• Databases
• Files
• Applications
• Data classifications

Access may also depend on the agent's role, environment, task, or approval status. These controls create boundaries around high-risk sources such as customer records, credentials, financial information, and production data. Sensitive sources can be blocked entirely or exposed through interfaces that return only approved fields.

9. Detect Sensitive Data in Prompts and Responses

Security tools can inspect prompts, retrieved context, tool outputs, and model responses for sensitive information. Detection can cover:

• Credentials
• API keys
• Personally identifiable information
• Financial records
• Source code
• Organization-specific data classifications

When sensitive content is detected, policies can redact or mask values, block the request, restrict the response, or require additional authorization. Applying these checks throughout the agent workflow helps prevent sensitive information from moving between systems unnoticed.

10. Prevent Unauthorized Data Exfiltration

Agents may have legitimate access to sensitive data and external communication tools at the same time. An attacker can exploit this combination by using prompt injection or other techniques to make the agent send protected information to an unauthorized destination.

Security tools can inspect outbound tool calls, network requests, messages, uploads, and generated responses before data leaves a trusted boundary. Policies can block unapproved domains, destinations, or data types and require human approval for high-risk transfers.

Notable Agentic AI Security Tools for Runtime Behavior, Tool Use, and Data Access

How we selected these tools: We shortlisted agentic AI security tools based on their ability to monitor agent runtime behavior, validate and restrict tool calls, secure MCP connections, enforce agent identity and least-privilege access, and detect or block sensitive data exposure.

Agent Runtime Governance and Access Control Platforms

1. Cequence AI Gateway

Best for: Governing agent access to enterprise apps, APIs, and MCP tools

Strengths: Agent Personas, inline tool-call enforcement, DLP on MCP traffic

Things to consider: Initial setup and policy tuning can take time

Cequence AI Gateway sits between AI agents and enterprise applications, translating agent requests into native API calls while applying security and governance controls. The gateway authenticates each agent and then verifies every action it takes, enforcing policy inline in the request path, for the full session, on every tool call.

The gateway maintains trusted registries of MCP servers, APIs, LLMs, and skills that agents are allowed to reach. Teams can turn existing APIs into MCP-compatible tools by uploading OpenAPI specifications. It runs as a SaaS service or on-premises, and connects to Cequence API Security and Bot Management for enhanced API specs and protection against agent-driven abuse.

Key features include:

• Agent Personas: Teams describe an agent's job in plain English, and the gateway generates a persona that limits the agent to the tools, APIs, skills, and permissions that job requires. Least-privilege access policies are generated from these job descriptions.
• Inline tool-call enforcement: Proxies both MCP tool calls and direct API calls through one control point. Behavioral identity judges each action by who the agent is and what it is doing, with rogue agent containment, anomaly detection, and kill-switch controls.
• Authentication and authorization: Integrates with OAuth 2.1-compliant identity providers and includes token lifecycle management and RBAC. Session binding locks authenticated sessions to the originating IP address to block token theft and reuse.
• Sensitive data protection: Applies DLP scanning to agent requests and MCP server responses, with more than 100 built-in detection types for monitoring, redacting, or blocking sensitive data. Detection covers data moving across a sequence of tool calls and integrates with existing DLP infrastructure.
• Prompt Guard and runtime guardrails: Screens prompts for injection, jailbreak, and system-prompt-extraction patterns before they reach the model, with support for custom rules. Additional guardrails include automated tool risk scoring, rate limiting, and token and spend limits by team.
• AI discovery: Surfaces shadow MCP servers, agents, and LLM providers across the enterprise using existing SIEM logs.
• Monitoring and audit trails: Logs user, agent, and tool behavior, including which applications agents access and which API calls they make. Tool-level and agent-level audit trails capture agent identity, data accessed, user context, and request and response flows, exportable to SIEM.

Limitations (as reported by users on G2):

• Requires traffic to flow through it for governance: Organizations need to set up and maintain traffic flows through the AI Gateway for it to govern the agentic AI traffic.
• Prompt injection protection capabilities face arms race: As these types of attacks evolve, the Prompt Guard feature will have to evolve as well for protection.
• Learning curve for advanced configuration: Full use of all the features may take time as the platform covers a lot of ground in security and governance.

2. Zenity

Best for: Securing agents across SaaS, cloud, and endpoint environments

Strengths: Intent-based detection across full agent execution paths

Things to consider: Enforcement depth varies by platform; no public pricing

Zenity is an AI agent security and governance platform covering agents embedded in SaaS tools, homegrown agents in cloud environments, and personal and coding agents on end-user devices. The platform has three layers: Surface builds an inventory and evaluates exposure, Enforce acts when an agent makes a decision, and Protect detects, investigates, and responds to threats.

Supported platforms include Microsoft Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, Salesforce Agentforce, ServiceNow, Amazon Bedrock, Google Vertex AI, ChatGPT Enterprise, and Claude Enterprise. Threat detections are mapped to OWASP and MITRE ATLAS.

Key features include:

• AI observability: Builds a live inventory of agents across SaaS, custom, and endpoint deployments. It tracks agent ownership, what each agent can access, and the data it touches.
• AI security posture management: Evaluates agent configurations and permissions against policy before agents go live, so over-permissioned agents are flagged before runtime.
• AI exposure management: Validates which of an agent's attack paths are exploitable, scores each one, and generates a fix that can be applied through Runtime Boundaries.
• Intent-based detection and response: Examines the full execution path, including tool calls, memory access, data usage, and control flow. This identifies malicious or unintended outcomes even when the inputs look harmless.
• Runtime enforcement: The Enforce layer lets safe actions through and stops harmful actions before they complete. Capabilities include Boundaries, Agentic Identity, and MCP Security.
• Contextual incident response: Correlates configuration, permissions, and runtime behavior into intent-driven signals, and gives investigators context on agent execution paths.

Limitations (based on publicly available sources):

• Enforcement varies by platform: Public analyses note that the depth of runtime enforcement differs across the agent platforms Zenity supports.
• Framework coverage not fully listed: Public product pages do not name some open source agent frameworks, such as LangChain, CrewAI, and AutoGen.
• Deployment options: Public materials present Zenity as a hosted SaaS platform and do not document a self-hosted or air-gapped edition.
• Pricing not published: Standard pricing is not available on public pages.
• Agent-focused scope: The platform does not cover general data loss prevention for human activity unrelated to agents, such as ordinary email or browser uploads.

3. Noma Security

Best for: Discovery, access control, and runtime detection for AI agents

Strengths: Session-level behavioral context and IdP-keyed tool policies

Things to consider: Integration into complex AI environments; pricing on request

Noma Security is an AI security platform covering three environments: endpoint agents such as Claude Code and Cursor, homegrown AI built on AWS Bedrock, Microsoft Foundry, or frameworks like LangChain, and agents built on SaaS platforms such as Copilot Studio, Agentforce, and ServiceNow. It consists of four products: AI-SPM, Agent Access Control, AI-DR, and AI Red Teaming.

The four products share context. Discovery data informs access policies, and red teaming findings become enforced patterns in production. Noma tracks the full chain of agent actions across a session, so it can link an agent reading customer records in one step with emailing a summary to an external address in a later step.

Key features include:

• AI asset discovery and risk map: Finds agents, MCP servers, skills, and models across endpoint, SaaS, and homegrown environments. The agent risk map shows each agent's connections, permissions, and data access, and flags misconfigurations and toxic combinations of capabilities.
• Agent access control: Defines which MCP servers, skills, and tools each agent can use and enforces the policy when the agent acts. Policies can be keyed to IdP groups or applied organization-wide by tool sensitivity, with a live registry of approved items and everything else blocked.
• AI detection and response: Detects prompt injection, data exfiltration, scope violations, and agents that drift from their intent. Each action is evaluated with its surrounding session, the identity behind the agent, the data involved, and behavior over time.
• Policy-based response actions: Depending on policy, the platform alerts, blocks the action, masks data, or routes the action to a human for review.
• Agentic identity: Tracks who an agent is acting as, what it is allowed to do, and whether its actions match the user's intent.
• MCP and AI supply chain security: Discovers, assesses, and governs MCP servers, detects tool poisoning and supply chain attacks, and scans models, tools, and packages.
• AI red teaming: Runs multi-turn attack campaigns with prebuilt scan profiles and compliance presets. Findings feed AI-DR runtime policies.

Limitations (based on publicly available sources):

• Integration effort: Deployment requires integration into complex AI development and deployment environments.
• Dependence on detection updates: Threat detection effectiveness relies on continuous updates to keep pace with new AI attack techniques.
• Pricing on request: Pricing details are not published and are provided upon request or consultation.

4. Prisma AIRS Agent Security

Best for: Palo Alto Networks customers securing agents across the lifecycle

Strengths: Central control of tool calls, LLM traffic, and MCP connections

Things to consider: Some features feel early-stage; tied to Palo Alto ecosystem

Prisma AIRS Agent Security is part of the Palo Alto Networks Prisma AIRS AI security platform. It covers the agent lifecycle, from discovering agents and scanning their code before deployment to verifying agent identities and enforcing security policies on agent actions at runtime.

Palo Alto Networks is integrating Portkey's AI Gateway into Prisma AIRS to provide one control plane that monitors agent actions, verifies agent identity, and applies runtime policies. Coverage includes agents on SaaS platforms, cloud services, low-code tools, and custom environments.

Key features include:

• Agent discovery and visibility: Discovers AI agents across SaaS platforms, cloud services, low-code tools, and custom environments. It shows what agents are doing, what they can access, and how they make decisions, including shadow and third-party agents.
• Agentic supply chain scanning: Scans agent code, MCP servers, and skills for supply chain vulnerabilities before deployment and provides remediation guidance.
• Agent behavior testing: Tests how agents behave in real-world conditions using a library of attacks or a dynamic red teaming agent.
• Over-privilege detection: Identifies excessive access and revokes unnecessary privileges to reduce the reach of compromised or misconfigured agents.
• Agent identity verification: Inventories and validates agent identities, defines agent ownership and permissions, and enforces least-privileged access.
• Runtime protection: Protects agents from prompt injection and agent-specific risks such as tool misuse, and enforces policies to prevent sensitive data exposure.
• Centralized AI traffic management: Controls tool calls, LLM interactions, and MCP connections from one place, with granular policies on how agents interact with systems.

Limitations (as reported by users on Gartner Peer Insights):

• Early-stage features: Some reviewers find that certain features still feel limited or not fully developed.
• Learning curve: Users mention that it takes time to understand how to get full value from the platform.
• Alert and report tuning: Some alerts and reports need manual adjustment to fit a specific environment.
• Platform dependency: Reviewers note that the product works best within the Palo Alto Networks ecosystem, which can limit its use elsewhere.

Source: Palo Alto Networks

Runtime Guardrails and AI Threat Detection Tools

5. Lakera AI Agent Security (Check Point)

Best for: Real-time guardrails on agent inputs, outputs, and actions

Strengths: Prompt attack detection in 100+ languages with sub-50 ms latency

Things to consider: Multimodal inspection limited to text in some integrations

Lakera AI Agent Security, now part of Check Point, inspects what goes into AI agents, controls what comes out, and governs the actions agents take. It discovers agents and MCP-connected tools, assesses their risk, and enforces protection at runtime without changes to models or prompts.

The platform connects to cloud, low-code, and custom environments and rates each agent based on its configuration, tools, data access, MCP servers, and level of autonomy. Detection covers over 100 languages, and runs with sub-50 ms latency.

Key features include:

• Agent and MCP discovery: Finds agents and MCP-connected tools across the environment, including agents that teams did not explicitly build or register. It identifies which data, APIs, and systems each agent can access.
• Agent risk assessment: Scores each agent based on its configuration, tools, data access, MCP servers, and autonomy.
• Prompt attack protection: Blocks prompt injection, jailbreaks, and adversarial instructions before they reach the model.
• Indirect injection blocking: Blocks injected instructions arriving through MCP-connected tools before agents act on them.
• Tool use and action governance: Uses policy and runtime enforcement to control what agents can access, call, and do. It contains unsafe actions, tool abuse, and connected system risk at runtime.
• Data and access protection: Detects sensitive data in prompts and responses and flags unauthorized agent access.
• Policy violation detection: Flags harmful or non-compliant outputs and agent actions that go beyond defined policies.

Limitations (based on publicly available sources):

• Text-only inspection of multimodal content: In some gateway integrations, only text segments of multimodal requests are inspected, and image and embedding outputs cannot be inspected.
• Sensitivity to integration structure: Passing system instructions inside user messages is a common cause of false positives, so integrations need to separate system and user content.
• Response handling left to the application: The Guard API returns a flagged result, and the application decides whether to block, confirm with the user, or only log the event.

Source: Lakera

6. Prompt Security (SentinelOne)

Best for: Governing workforce AI use, agents, and MCP servers together

Strengths: Shadow MCP discovery, least-privilege agent scope, audit log

Things to consider: Full coverage may need extension, agent, and proxy setup

Prompt Security, part of the SentinelOne Singularity Platform, covers employee AI tools, developer code assistants, homegrown AI applications, and autonomous agents. It provides AI governance, data leakage prevention, and threat protection, with policies enforced at the point of interaction.

The Agentic AI Security module maps the agents and MCP servers in an environment and governs what they can do. Policies and AI risk visibility are managed from the same console that covers SentinelOne endpoint, cloud, identity, and data security.

Key features include:

• Agent and MCP discovery: Automatically discovers shadow MCP servers and unsanctioned agent deployments.
• Least-privilege agent access: Enforces access policies so agents operate only within their defined scope.
• Agent action audit log: Keeps a searchable log of every agent action, decision, and interaction with enterprise systems.
• Real-time AI firewall: Blocks adversarial prompts and scrubs sensitive data from outputs of AI applications at runtime.
• Pre-deployment testing: Tests AI applications for prompt injection, jailbreaks, and data poisoning before deployment, and converts red teaming findings into production guardrails on a shared policy fabric.
• Role-based usage policies: Sets granular controls over who can use AI, how, and with what data.

Limitations (as reported by users on Gartner Peer Insights):

• Deployment effort for full coverage: Some reviewers find that achieving full coverage in complex environments requires coordinating a browser extension, an agent, and proxy configuration.
• Reliance on browser extension: Reviewers note that dependence on the browser extension introduces coverage risk.
• Detection consistency: One critical review reports decreased reliability and detection gaps over time.
• Dashboard and settings: Users mention limited reporting dashboard customization and advanced settings that can feel overwhelming.

Source: Prompt Security

7. Lasso

Best for: Intent-based runtime protection with discovery and red teaming

Strengths: Inline enforcement at proxy, API, or gateway; 3,000+ attack tests

Things to consider: Requires CI/CD and platform integration; few user reviews

Lasso is an AI security platform that connects discovery, AI risk management, automated red teaming, and runtime protection in a continuous loop. It analyzes the intent behind an agent's actions instead of relying only on fixed patterns, and checks whether agentic applications behave within their intended scope.

Lasso discovers agents through platform integrations and finds homegrown applications through CI connections. Runtime policies are enforced inline at the proxy, API, or AI gateway layer, and threat detections are mapped to MITRE and OWASP.

Key features include:

• Discovery and AI-BOM: Inventories every agent and application and maps models, system prompts, tools, and guardrails. The inventory updates on every change and tracks red teaming scans and policies.
• AI security posture management: Analyzes what agents are exposed to, what actions they can perform, and what sensitive data they can reach. It identifies misconfigurations, policy gaps, and supply chain risk, with NIST and OWASP framework alignment.
• Automated red teaming: Runs adversarial tests from a library of more than 3,000 attacks, including multi-turn agentic attacks, context poisoning, and tool chain manipulation. Purple teaming updates policies based on findings.
• Runtime enforcement: Enforces policies inline at the proxy, API, or AI gateway layer, with remediation guidance and portfolio-wide visibility.
• AI detection and response: Detects and terminates AI threats, with context on each attack, including what happened, which agent was targeted, the impact, and how to resolve it.
• Intent analysis: Uses intent analysis for behavioral anomaly detection, with classification times under 50 ms.

Limitations (based on publicly available sources):

• Integration requirements: Deployment requires integration into existing CI/CD pipelines and platform infrastructure.
• Limited verified user reviews: Gartner Peer Insights lists only a small number of ratings, with a mixed average score.
• Vendor-reported benchmarks: Speed and throughput figures for the LEAP guardrail engine are based on Lasso's own benchmarks.
• Custom enterprise pricing: Enterprise plans use custom pricing and annual contracts.

Source: Lasso

8. HiddenLayer AI Runtime Security

Best for: Runtime detection and enforcement for agents and MCP traffic

Strengths: Tool-use inspection and session reconstruction

Things to consider: Needs SDK, proxy, or gateway instrumentation

HiddenLayer AI Runtime Security is one module of the HiddenLayer AI Security Platform, which also includes AI Discovery, AI Supply Chain Security, and AI Attack Simulation. It provides runtime visibility, threat detection, and inline enforcement for AI applications, coding agents, and agentic workflows.

HiddenLayer inspects MCP and agent framework traffic using LiteLLM proxy interception, SDK instrumentation, and gateway inspection. It supports frameworks including OpenAI, AWS Bedrock, and MCP-based systems, and sends runtime detections and enforcement events to SIEM and SOAR tools.

Key features include:

• Indirect prompt injection detection: Identifies and blocks injected instructions hidden in data, documents, MCP responses, or retrieved context before they affect agent execution.
• Tool use and action inspection: Monitors agent actions and enforces runtime policy across APIs, MCP tools, code execution, communication tools, and filesystem operations.
• Memory and context safety: Detects unsafe memory recall, cross-agent contamination, and exposed sensitive data before it becomes an instruction.
• Agentic runtime visibility: Observes and reconstructs agent interactions across tools, data, and workflows, and supports investigation of activity across sessions.
• Inline protection: Detects, blocks, or redacts unsafe actions and sensitive information according to policy and platform capabilities.
• Agent harness security: Extends runtime security to AI coding agents through a lightweight on-device integration.
• Security operations integration: Sends detections and enforcement events to existing SIEM, SOAR, and security operations workflows.

Limitations (based on publicly available sources):

• Instrumentation required: Protection depends on integrating through the HiddenLayer SDK, a proxy, or gateway inspection, which adds setup work in existing development and security workflows.
• Enforcement varies by platform: Inline blocking and redaction depend on the capabilities of the platform where the agent runs.
• AI-specific scope: The platform covers AI-specific threats, so organizations may still need separate tools for traditional security needs.

Source: HiddenLayer

Conclusion

Agentic AI security requires controls that follow agents through their full execution path, not just filters around model inputs and outputs. Effective protection combines runtime monitoring, least-privilege access, agent identity, tool and parameter controls, MCP security, and sensitive data inspection. These controls help organizations detect compromised or unintended behavior and stop unauthorized actions or data transfers before they reach connected systems.

How Bot Management Solutions Work, Top 14 Solutions and Pros/Cons

TL;DR: Bot management solutions detect and mitigate automated traffic across web, mobile, and APIs. Best for protection without app changes: Cequence; for large-scale edge detection: Cloudflare; for easy protection at the CDN: DataDome; for adaptive challenges: Arkose.

What Are Bot Management Solutions?

Bot management solutions are cybersecurity tools designed to distinguish between legitimate human users and automated bots. They mitigate malicious attacks, such as bots that perform credential stuffing or scraping, while permitting beneficial bots like search engine crawlers. Effective platforms improve website performance, secure API endpoints, and prevent revenue loss, actively neutralizing threats and avoiding overreliance on intrusive human challenges.

Bad bots are not just a nuisance. They are often used to wage damaging cyberattacks that can cause downtime, brand damage, skewed sales analytics, and increased infrastructure costs.

While bots have been around almost as long as the internet itself, they continue to get more sophisticated and better at emulating human behavior in an effort to evade detection, and effective bot management has become a necessity.

• Bot Management Solutions at a Glance
• Impact of Malicious Bots
• How Do Bot Management Solutions Work?
• Traditional Bot Mitigation Techniques
• Bot Management and AI
• Notable Bot Management Solutions
• Getting Started with Bot Management

Bot Management Solutions at a Glance

The table below summarizes the key differences between the solutions covered in this list. We explore each one in more detail in the sections that follow.

• Dedicated Bot Management Platforms — Solution: 1. Cequence Bot Management Best For: Web, AI agent, mobile, and API traffic without app changes Key Strengths: Network-based ML detection, automated real-time mitigation Things to Consider: Alert volume for large estates may require tuning; dashboards complex for non-technical stakeholders
• Dedicated Bot Management Platforms — Solution: 2. DataDome Best For: Real-time protection across web, apps, APIs, MCP servers Key Strengths: Edge detection under 2 ms, very low false positive rate Things to Consider: Premium pricing and overage charges on high-traffic sites
• Dedicated Bot Management Platforms — Solution: 3. HUMAN Bot Defender Best For: Defending against ad fraud; backed by threat intelligence Key Strengths: Multi-method detection, full-lifecycle investigation Things to Consider: Setup can be complex; UI has rough edges
• Dedicated Bot Management Platforms — Solution: 4. Netacea Best For: Server-side, agentless protection for sites, apps, APIs Key Strengths: Intent-based behavioral detection, low false positives Things to Consider: Limited self-service manual blocking; console gaps
• Dedicated Bot Management Platforms — Solution: 5. Kasada Best For: Invisible, CAPTCHA-free defense for web, mobile, APIs Key Strengths: Client-side obfuscation resistant to retooling Things to Consider: Careful pre-launch testing; few public reviews
• Bot Protection in WAF, CDN, and Edge Platforms — Solution: 6. Cloudflare Bot Management Best For: Bot mitigation built into Cloudflare’s edge and CDN Key Strengths: ML trained on a large share of internet traffic, edge speed Things to Consider: Advanced tuning and some features on higher tiers
• Bot Protection in WAF, CDN, and Edge Platforms — Solution: 7. Akamai Bot Manager Best For: Edge detection for large estates Key Strengths: Edge scoring, good and bad bot management, visibility Things to Consider: Premium pricing; tuning may need pro services
• Bot Protection in WAF, CDN, and Edge Platforms — Solution: 8. Imperva Advanced Bot Protection Best For: Protecting sites, apps, APIs against all OWASP automated threats Key Strengths: Multi-layered detection across 700+ dimensions Things to Consider: Initial configuration and policy tuning take effort
• Bot Protection in WAF, CDN, and Edge Platforms — Solution: 9. F5 Distributed Cloud Bot Defense Best For: Adaptive bot defense for web, mobile, and APIs Key Strengths: Behavioral analysis and telemetry resistant to retooling Things to Consider: Enterprise pricing; cloud and on-prem integration effort
• Bot Protection in WAF, CDN, and Edge Platforms — Solution: 10. Fastly Bot Management Best For: Edge bot control with nuanced responses Key Strengths: Server- and client-side detection, deception, challenges Things to Consider: WAF interface can feel complex; reporting adds cost
• Bot Protection in WAF, CDN, and Edge Platforms — Solution: 11. Barracuda Advanced Bot Protection Best For: Bot defense within Barracuda’s application protection Key Strengths: ML detection, crowd-sourced intelligence, fingerprinting Things to Consider: Dated configuration UI; slower update cadence
• Fraud and Identity-Focused Bot Defense — Solution: 12. Arkose Bot Manager Best For: Disrupting bot and human-driven attacks with challenges Key Strengths: 225+ risk signals, interactive challenges draining ROI Things to Consider: Challenge friction for users; opaque pricing
• Fraud and Identity-Focused Bot Defense — Solution: 13. Fingerprint Best For: Developer-focused device intelligence and bot detection Key Strengths: Accurate device identification via a single API response Things to Consider: A detection signal, not a full enforcement layer
• Fraud and Identity-Focused Bot Defense — Solution: 14. Radware Bot Manager Best For: Web, mobile, and APIs against bots and AI-driven threats Key Strengths: Intent-based behavioral detection, CAPTCHA-less mitigation Things to Consider: Reporting is basic; pricing sits at the higher end

Why is Bot Management Needed? Impacts of Malicious Bots

Bots are simply the vehicle for automated attacks, so organizations may not immediately know they have a bot problem. For example, if user accounts are being taken over by bad actors, it may not be immediately apparent that bots are being used to do so at scale. Without a bot management solution in place to detect attacks and identify associated bots, manual investigation is needed to determine if it’s a full-scale bot attack.

What Do Malicious Bots Target?

It is important to understand the potential targets for attackers and their bots. Web and mobile applications are the most obvious, but the proliferation of APIs and the fact that they often provide access to sensitive data make them a compelling target as well. APIs are typically not as visible to security teams since they have no graphical user interface, so they may not be as well protected as traditional web applications.

How Can Bad Bots Harm Your Business?

There are broad potential impacts of malicious bots, including direct business impacts such as fraud or sensitive data exposure, as well as indirect impacts such as regulatory implications.

Business impacts of malicious bots include:

• Loss of revenue
  Malicious bots are often designed to steal goods or money, and when successful can dramatically impact the bottom line
• Skewed marketing and sales analytics
  Bots browse websites and attempt to buy products just like real users, so if they’re not identified and separated from legitimate traffic, they can skew metrics for website traffic and even ecommerce sales.
• Regulatory impacts
  Regulations such as PCI DSS and HIPAA require systems that process Personal Identifiable Information (PII) to be compliant and protect consumers against fraud and privacy violations, and protecting those systems against bots falls under these and other regulations.
• Infrastructure overload and increased infrastructure costs
  High-volume bot traffic can overload infrastructure, slow web response times, cause site downtime, and increase costs for elastic infrastructure.
• Brand and reputation damage
  Malicious bots can take over user accounts, prevent legitimate customers from buying limited-edition items, and more, reflecting poorly on the company, frustrating customers, and causing brand damage.

The Risk of Business Logic Abuse

Malicious bots can be created to perform almost any attack a human can, but faster and at much higher volume. Many of these use cases are enabled by business logic abuse, which appear as valid user interactions. These types of abuse are exceedingly difficult to identify because the bot exploits intended app or API functionality. Common bot attack types include:

• Account takeover (ATO) –
  Using stolen credentials to gain unauthorized access to legitimate user accounts
• Sensitive data exposure –
  Gathering sensitive data unintentionally exposed by applications and APIs
• Credential stuffing –
  Using stolen, legitimate credentials to access services
• Flash sales, hype sales, and ticket scalping –
  Mass purchasing high-demand products quickly for resale, or “jumping the line” to hoard products and deny legitimate customers
• Content scraping/IP theft –
  Harvesting sensitive data for resale, ransom, or other nefarious purposes
• Gift card/loyalty program abuse –
  Brute-forcing card object (card number, owner name, PIN, etc.) combinations to find valid gift cards or loyalty program details
• Fake account creation –
  mass creation of accounts from fake or stolen user identity information
• SIM Swapping –
  A type of account takeover specific to cell phones that compromises user accounts with unauthorized SIM swaps

How Do Bot Management Solutions Work?

Bot management software identifies, classifies, and mitigates automated traffic by analyzing requests across web applications, mobile applications, and APIs. Modern solutions use a combination of network signals, device characteristics, behavioral analysis, and threat intelligence to determine whether a request originates from a human user, a legitimate automated service, or a malicious bot.

The bot management process typically includes these steps:

• Collecting telemetry from incoming requests
  This may include IP reputation, request headers, browser and device fingerprints, geolocation, request patterns, session behavior, and interaction signals. Advanced solutions correlate these attributes over time to identify suspicious activity that would be difficult to detect from a single request. This helps uncover distributed bot attacks that use large numbers of IP addresses and devices to evade traditional defenses.
• Traffic classification
  The bot management platform classifies traffic into categories such as human users, verified good bots, suspicious automation, or confirmed malicious bots. Good bots, such as search engine crawlers and monitoring services, are generally allowed to access resources according to defined policies. Malicious bots are flagged based on indicators such as abnormal request rates, credential abuse patterns, scraping behavior, or attempts to exploit business logic.
• Applying mitigation actions
  After detection and classification, the platform applies mitigation actions based on risk level. Low-risk traffic may be monitored or rate-limited, while higher-risk traffic may be challenged using techniques such as CAPTCHAs, proof-of-work challenges, device validation, or step-up authentication. Confirmed malicious bots can be blocked outright before they reach backend applications and APIs.

Limitations of Traditional Bot Management Techniques

Traditional bot management solutions have been somewhat effective but are not without their drawbacks. Malicious bot identification is more difficult than it has ever been, and sophisticated threat actors continually improve their methods to improve their attack success rate. In addition to the detection difficulty of attacks that abuse business logic, so-called “low and slow” attacks that are low volume and spread out over time are also difficult for traditional bot management solutions to detect and prevent.

IP reputation-based bot management

Solutions such as Web Application Firewalls (WAF) and CDNs with bot protection capabilities often leverage IP address reputation for bot defense, examining the history of the IP address and categorizing it as good or bad. However, attackers can easily spread attacks across large numbers of IP addresses with clean reputations, such as hijacked residential IPs, making this solution inadequate.

JavaScript-based/challenge approach

Another bot mitigation technique requires integrating JavaScript or SDKs into web pages, applications, and mobile applications. CAPTCHA systems are widely used but they have several drawbacks. They significantly impact the user experience and require development and QA effort to implement and test. Critically, JavaScript-based approaches do not directly support APIs, leaving this vital infrastructure unprotected.

Bot Management and AI

As AI advancements continue to transform the cybersecurity landscape, the need for strengthened cybersecurity measures in bot management becomes increasingly important. A recent development poised to shake up the bot world both from an attacker’s and a defender’s standpoint is the increased use of machine learning (ML) and artificial intelligence (AI).

Large language models (LLM) make it easier and faster to create purpose-built bots and are likely to pose challenges that are as yet unknown. There are already AI models that claim to defeat CAPTCHAs with 100% accuracy, likely kicking off a new cat-and-mouse game as the bot management solutions that rely on JavaScript challenge-based approaches struggle to stay ahead of attackers.

The best bot management solutions rely on ML models to improve bot detection, whether they’re part of loud, brute force-style attacks or quieter slow-and-low attacks that were previously extremely difficult to detect. ML can also be used to automatically classify threats, improve the accuracy of sensitive data detection, and even autonomously create bespoke policies to automatically mitigate new attacks.

If you’re interested in the intersection of AI and enterprise security, we’ve written a blog about GenAI.

Notable Bot Management Solutions

How we selected these solutions: We shortlisted bot management solutions based on their ability to detect and classify automated traffic, mitigate malicious bots across web, mobile, and APIs, and adapt as attackers retool.

Dedicated Bot Management Platforms

1. Cequence Bot Management

Best for: Protecting web, AI agent, mobile, and API traffic without app changes
Strengths: Accurate network-based ML-driven detection and automated real-time mitigation
Things to consider: Alert volume can require tuning and dashboards can feel complex

Cequence Bot Management protects web, mobile, and API applications from automated attacks and fraud. It analyzes behavioral intent across web, mobile, and API traffic at the network level rather than relying on signals from end-user devices, so it works without client-side JavaScript or SDK integration. Cequence Bot Management is part of the broader Cequence Platform, which also covers API security and an AI Gateway for protecting agentic AI workflows.

Cequence uses a machine learning engine that determines in real time whether application and API transactions are malicious or legitimate, and it builds a behavioral fingerprint that tracks malicious activity even when attackers change IP addresses or tactics. It detects account takeover, content scraping, flash and hype sale abuse, sensitive data exposure, gift card and loyalty program abuse, and business logic abuse.

Key features include:

• No application modification: Protects at the network level with no client-side JavaScript or SDK to integrate, covering web and mobile apps, APIs, and cloud and microservices architectures.
• Network-based behavioral detection: Analyzes behavioral intent across web, mobile, and API traffic to build a behavioral fingerprint, distinguishing good bots from bad and tracking them as attackers re-tool.
• Real-time mitigation options: Automatically creates threat mitigation rules and policies that run automatically or after human review, including blocking, rate limiting, header injection, and deception.
• Friction-free user verification: Routes suspicious traffic to native biometric authentication such as Face ID, Touch ID, or Windows Hello through Biometric Check, instead of CAPTCHAs or SMS codes.
• AI protection and detection: Uses AI and machine learning across detection and mitigation and prevents data leakage through AI APIs and unwanted AI scraping.
• Flexible deployment and fast baselining: Deploys as SaaS hybrid, or on-premises with hundreds of predefined rules and machine learning baselining within hours.
• Fraud prevention with forensics: Applies granular, business-specific policies to identify and mitigate fraud in real time, with transaction-level incident forensics.

Limitations (as reported by users on G2):

• Alert tuning: Some users note that reducing alert noise and false positives can require additional policy tuning.
• Reporting clarity for non-specialists: Some of the more granular analytics and event details can be harder for non-technical stakeholders to interpret.

Source: Cequence

2. DataDome

Best for: Real-time bot protection across web, apps and APIs
Strengths: Edge detection under 2 ms with a very low false positive rate
Things to consider: Premium pricing and overage charges on high-traffic sites

DataDome Bot Protect detects and mitigates automated traffic across websites, mobile apps, APIs, and MCP servers. It analyzes every request rather than a sample, evaluating hundreds of client-side and server-side signals continuously throughout the user journey.

Its AI detection engine processes a high volume of signals daily and uses many out-of-the-box and custom models, plus shared threat intelligence, to separate human users, legitimate AI agents, and malicious bots. The platform runs at the edge across more than 30 points of presence with response times under two milliseconds. It also includes Agent Trust capabilities to identify, classify, and govern AI agent traffic.

Key features include:

• Every-request analysis: Evaluates each request rather than sampled traffic, assessing hundreds of client-side and server-side signals across the user journey.
• AI detection engine: Uses 1,000+ out-of-the-box and customer-specific models plus collective threat intelligence to classify humans, legitimate agents, and malicious bots.
• Edge mitigation: Operates across 30+ global points of presence with response times under two milliseconds so mitigation does not add latency.
• Automated response: Triggers automated mitigation aligned to business logic while maintaining a stated false positive rate below 0.01%.
• Agent Trust management: Identifies, classifies, scores, and governs AI agent traffic, validating agent identity and intent in real time.
• Threat dashboard: Provides visibility by threat type over time, endpoint discovery through Watchtower, custom dashboards, saved views, and reports.
• Integrations and SOC: Offers 80+ prebuilt integrations and a 24/7 SOC team that supervises model performance.

Limitations (as reported by users on G2):

• Pricing: Reviewers frequently describe it as expensive, particularly for smaller businesses and high-traffic sites where overage charges add up.
• Dashboard interpretation: Some non-specialist users find certain dashboard metrics hard to interpret and want plainer-language explanations.
• SIEM and alerting gaps: Some users want out-of-the-box data export to SIEM tools such as Splunk and more flexible alerting as request thresholds approach.

Source: DataDome

3. HUMAN Bot Defender

Best for: Defending against ad fraud; backed by threat intelligence
Strengths: Multi-method detection with full-lifecycle fraud investigation
Things to consider: Initial setup can be complex and the UI has rough edges

HUMAN Bot Defender, part of HUMAN Sightline, protects websites, mobile applications, and APIs from automated attacks. It uses machine learning, behavioral analysis, and fingerprinting to separate genuine users from bots and human-driven fraud.

Rather than scoring individual requests in isolation, it correlates session activity across each authentication stage and the wider user journey. Layered models learn from each detection and mitigation event to react to new attacker tactics. It applies a range of mitigation responses and includes investigative tooling along with visibility into AI agent and LLM scraper traffic.

Key features include:

• Session correlation: Continuously analyzes and correlates session activity across authentication stages instead of evaluating single requests at isolated points.
• Multi-method detection: Combines machine learning, behavioral analysis, and intelligent fingerprinting to identify automated and human-driven fraud.
• Adaptive models: Layered AI models learn from each detection and mitigation event to react to specific threat adaptations.
• Range of mitigations: Applies hard blocks, soft challenges, silent controls, and investigation triggers based on the assessed risk.
• AI and agent visibility: Reports activity from known bots, LLM scrapers, and AI agents, with policies to block, allow, limit, or monetize automated traffic.
• Investigation tooling: Provides dashboards and AI-generated insights to uncover threat networks, identify threat profiles, and track attack patterns.
• Threat intelligence: Draws on the Satori Threat Intelligence and Research team for research that feeds detections.

Limitations (as reported by users on G2):

• Complex setup: Several users report that initial setup and integration can be complex and involve a learning curve.
• Interface friction: Some reviewers note confusing elements in the UI and occasional complex rule management.
• Mitigation tuning: A portion of reviews mention performance concerns, CAPTCHA friction, or instances of less effective blocking that require tuning.

Source: HUMAN

4. Netacea

Best for: Server-side, agentless bot protection across sites, apps, APIs
Strengths: Intent-based behavioral detection with a low false positive rate
Things to consider: Limited self-service manual blocking and console features

Netacea provides server-side bot and agent management for websites, apps, and APIs. It uses a single, self-managing edge integration that is agentless, so there is no client-side code for attackers to inspect.

Natacea’s Intent Analytics engine analyzes the behavior and goal of traffic in real time to identify humans, good bots, bad bots, and AI agents before requests reach the application. It analyzes all traffic across the attack surface and denies bots before execution. The platform also provides threat intelligence feeds and integrates with SOC tooling for visibility into live attacks.

Key features include:

• Agentless deployment: Uses a single server-side edge integration across websites, apps, and APIs with no client-side agent required.
• Intent Analytics engine: Applies machine learning to the behavior and intent of traffic to distinguish humans, good bots, bad bots, and AI agents.
• Pre-execution blocking: Identifies and denies malicious automation before requests are executed against the application.
• Threat intelligence feeds: Supplies data from real attacks to strengthen existing defenses and provide forewarning of planned attacks.
• SOC and tooling integration: Visualizes live attacks and integrates with SOC tools, with CDN integrations such as Cloudflare, Fastly, and Amazon CloudFront.
• Coverage of attack types: Addresses account takeover, carding, credential stuffing, fake account creation, loyalty fraud, scalping, CAPTCHA bypass, and scraping.

Limitations (as reported by users on G2):

• Manual control: Some users want the ability to manually block issues themselves rather than relying on the managed approach.
• Console features: A few reviewers feel the management console could offer more features.
• Reporting and log export: Historically users noted limited ability to stream data into external log services, though reporting has improved over time.

Source: Netacea

5. Kasada

Best for: Invisible, CAPTCHA-free defense for web, mobile, and APIs
Strengths: Client-side obfuscation that resists attacker retooling
Things to consider: Careful pre-launch testing needed; limited public reviews

Kasada Bot Defense protects websites, APIs, and mobile apps from automated attacks. It uses invisible client-side challenges and server-side detection rather than visible CAPTCHAs. Hundreds of sensors collect signals from the client to detect automation from the first request, and data is checked for tampering before decisions are made.

A highly obfuscated virtual machine forces attackers to run code in real browsers and devices, which makes the collected signals hard to fake and slows reverse engineering. Analytical models built on large volumes of bot interactions flag automated sessions in milliseconds, and new client-side defenses can be deployed quickly across all customers.

Key features include:

• Invisible signal collection: Hundreds of sensors gather hidden traces of automation in the client and detect bots from the first request.
• Client validation: Checks data received from the client for signs of automation and tampering before making decisions.
• Proof of execution: Runs dynamic code paths inside an obfuscated virtual machine to force execution in real browsers and devices and protect signal data.
• Fast anomaly detection: Analytical models trained on large volumes of bot interactions identify automated sessions in under two milliseconds.
• Threat intelligence: Studies attacker tools and communities and adds new client-side sensors across the customer base in minutes.
• Low-management operation: Removes the need for rule updates and manual tuning, using hidden challenges rather than CAPTCHAs for users.

Limitations (as reported by users on G2 and other public sources):

• Limited critical reviews: Independent reviews are scarce and overwhelmingly positive, so there is less critical comparison data than for incumbents.
• Careful pre-launch testing: Reviewers note that, given how the product works, you need to test thoroughly before deploying in blocking mode.
• Pricing transparency: Pricing is not listed publicly and is quoted per deployment, which can make up-front budgeting harder to estimate.

Source: Kasada

Bot Protection in WAF, CDN, and Edge Platforms

6. Cloudflare Bot Management

Best for: Bot mitigation built into Cloudflare’s edge and CDN stack
Strengths: ML trained on a large share of internet traffic, plus edge speed
Things to consider: Advanced tuning and some features sit on higher tiers

Cloudflare Bot Management uses machine learning and behavioral analysis across Cloudflare’s network to detect and stop malicious bot traffic before it reaches an application. Its models are trained on traffic from a large portion of the internet, and mitigation happens at the edge.

This solution is built into the Cloudflare stack rather than deployed as a separate product, so it shares infrastructure with the WAF, CDN, and other services. It generates a bot score for each request that teams can act on with rules, and it offers Turnstile as an alternative to CAPTCHA. It also tracks and controls AI crawler activity.

Key features include:

• Network-scale ML: Models trained on traffic across a large share of the internet generate a per-request bot score from 1 to 99.
• Edge mitigation: Runs at the edge across Cloudflare’s network so detection and response happen close to the user.
• Rules-based actions: Lets teams act on the bot score with WAF custom rules to block, challenge, or allow traffic, including per-endpoint handling.
• CAPTCHA alternative: Provides Turnstile and cryptographic verification methods such as Private Access Tokens in place of visible CAPTCHAs.
• Credential and API protection: Targets credential stuffing on login endpoints and automated scraping or abuse of APIs.
• AI crawler control: Identifies and controls AI crawlers and verifies legitimate bots against a maintained allowlist.
• Analytics and detections: Offers bot analytics and JavaScript-based detections, with mobile SDK support for app traffic.

Limitations (as reported by users on G2):

• Learning curve: Configuring advanced WAF rules, bot management, and rate limiting can become complex and feel unintuitive.
• Detection transparency: It is not always clear why a request was blocked or challenged, which can slow troubleshooting and tuning.
• Tiering and cost: Some advanced features, deeper analytics, and longer log retention sit behind higher tiers, and pricing can be hard to map.

Source: Cloudflare

7. Akamai Bot Manager

Best for: Edge bot detection for large enterprise estates
Strengths: Edge scoring with good and bad bot management and visibility
Things to consider: Premium pricing and tuning that may need pro services

Akamai Bot Manager detects and mitigates bot traffic at the edge while managing good bots. It assigns a bot score from 0 to 100 to each request, starting with the first request, using patented techniques and an AI framework, and the score can adjust as more requests arrive.

Administrators define response strategies across cautious, strict, and aggressive segments and tune both the score thresholds and the actions applied. It includes a library of known good bots so useful automation can pass, and it provides visualization and reporting on the impact of bots. Functionality is available through APIs and integrates with SIEM tools.

Key features include:

• Edge bot scoring: Assigns a score from 0 to 100 per request at the edge, starting with the first request and learning over time.
• Tiered response strategies: Lets teams configure cautious, strict, and aggressive responses and tune the score thresholds and actions.
• Good bot management: Maintains a library of known bots and lets teams create custom categories so useful bots are not blocked.
• Behavioral anomaly detection: Configured by injecting a script into monitored pages to detect anomalies in behavior.
• Visibility and reporting: Provides visualization and reporting on bot types and their impact on business and infrastructure.
• API and SIEM integration: Exposes functionality through APIs for DevSecOps pipelines and feeds bot score insights into SIEM tools.

Limitations (as reported by users on Gartner Peer Insights):

• Cost: Multiple reviewers describe the product as expensive, with emergency response costs and a licensing model that can be hard to understand.
• Interface and tuning: Some find the UI complicated to navigate, and initial configuration can be complex with occasional false positives and negatives.
• Professional services reliance: Realizing full value sometimes requires engaging professional services.

Source: Akamai

8. Imperva Advanced Bot Protection

Best for: Protecting sites, apps, and APIs from all OWASP automated threats
Strengths: Multi-layered detection across 700+ dimensions with granular control
Things to consider: Initial configuration and policy tuning take effort

Imperva Advanced Bot Protection, formerly Distil Networks, protects websites, mobile apps, and APIs from automated threats and covers the OWASP Automated Threats. It uses a multi-layered approach that combines client interrogation, behavioral analysis, machine learning, connection characteristics, and threat intelligence, evaluating over 700 dimensions to separate human, good bot, and bad bot traffic into a fingerprint.

It provides granular control and transparency rather than opaque risk scores, with real-time monitoring and detailed reporting. It can deploy within Imperva’s Cloud Application Security stack or through connectors into other platforms, and it offers analyst managed services for setup, tuning, and ongoing reviews.

Key features include:

• Multi-layered detection: Combines client interrogation, behavioral analysis, machine learning, connection characteristics, and threat intelligence across 700+ dimensions.
• OWASP automated threat coverage: Protects against the full OWASP Automated Threats list across web, mobile, and API surfaces.
• Granular controls and transparency: Provides full visibility and granular tuning rather than black-box risk scores, with explainable reporting.
• Real-time monitoring and reporting: Analyzes trends by application, path, or rule and supports customized dashboards and reports.
• Flexible deployment: Runs in Imperva’s Cloud Application Security stack or through connectors into platforms such as AWS, Cloudflare, F5, NGINX, and Fastly.
• Response options and testing: Offers multiple response options including CAPTCHA and real-time testing tools for policy creation and false positive analysis.
• Managed service: Provides access to bot analysts for setup, fine-tuning, alerting, and ongoing program reviews.

Limitations (as reported by users on G2):

• Initial configuration: Some advanced settings need careful adjustment at the start to avoid affecting legitimate traffic.
• Learning curve: Parts of the dashboard take time for new users to navigate, and policy work can require manual fine-tuning.
• Documentation depth: A few reviewers want more real-world examples and clearer guidance for handling complex bot patterns.

Source: Imperva

9. F5 Distributed Cloud Bot Defense

Best for: Adaptive bot defense for web, mobile, and APIs at scale
Strengths: Behavioral analysis and client telemetry resistant to retooling
Things to consider: Enterprise pricing and cloud and on-prem integration effort

F5 Distributed Cloud Bot Defense, formerly Shape Security, protects web applications, mobile apps, and APIs from automated attacks. It uses real-time behavioral analysis, client-side intelligence, and platform-wide telemetry to detect bots and AI agents at the application interaction layer.

It adapts as attackers retool, without manual tuning, and aims to avoid CAPTCHA-based friction. It separates humans, trusted agents, and malicious automation, and uses code obfuscation and telemetry encryption to resist reverse engineering. It can be enabled through the F5 Distributed Cloud Platform, integrated with BIG-IP, or deployed in custom on-premises, hybrid, and multi-cloud architectures.

Key features include:

• Behavioral and telemetry detection: Uses real-time behavioral analysis and client-side telemetry to unmask automation beyond static signatures.
• Agent-aware classification: Separates humans, trusted AI agents, and malicious automation based on behavior and intent.
• Continuous adaptation: Adjusts defenses automatically as attacker techniques and AI behaviors change, without manual tuning.
• Resilient signal collection: Applies code obfuscation and telemetry encryption to defeat evasion and reverse engineering.
• Deployment options: Enables through the F5 Distributed Cloud Platform, a BIG-IP module or iApp, or custom on-premises, hybrid, and multi-cloud setups.
• SIEM integration: Integrates with Syslog and leading SIEM systems for real-time threat analysis.

Limitations (as reported by users on Gartner Peer Insights):

• Pricing and bundling: Some reviewers find it expensive, especially for smaller organizations, and note bundles can include more than a simple use case needs.
• Hybrid integration: Integrating the cloud service with on-premises F5 products such as BIG-IP can be difficult to align.
• Interface and reporting: Some users describe the interface as dated and text-heavy and report early issues with reporting.

Source: F5

10. Fastly Bot Management

Best for: Edge bot control with nuanced responses and AI crawler control
Strengths: Server- and client-side detection with deception and challenges
Things to consider: WAF interface can feel complex and reporting adds cost

Fastly Bot Management runs at the edge to give visibility into bot traffic and control automated traffic with graduated responses. It combines server-side and client-side detection to surface bots reaching apps and APIs, including AI crawlers, headless browsers, and malicious bots.

Rather than relying only on block and allow actions, it offers dynamic challenges, deception, and AI traffic monetization controls. It uses signals to label traffic and a rule builder to create policies, and it can enforce in the delivery path before cache or in the Next-Gen WAF after cache. It does not rely on easily spoofed attributes such as IP address or user agent, instead correlating behavioral and client signals over time.

Key features include:

• Server and client-side detection: Combines both methods to expose bot traffic across apps and APIs, including AI crawlers and headless browsers.
• Graduated responses: Provides dynamic challenges, deception, and standard block and allow actions rather than only binary responses.
• Signals and rule builder: Labels traffic with customizable signals and a rule builder to create policies quickly.
• Flexible enforcement points: Enforces in the delivery path before cache or in the Next-Gen WAF after cache.
• Behavioral correlation: Correlates behavioral and client signals over time instead of relying on IP or user agent alone, with JA3 and JA4 client fingerprinting.
• AI crawler control and monetization: Controls and can monetize AI bot traffic down to the specific crawler, with ContentGuard protecting content at the edge.
• Verification options: Supports Private Access Token verification and Apple’s automatic verification to separate users from bots.

Limitations (as reported by users on G2):

• Interface complexity: Several reviewers describe the Next-Gen WAF interface as overwhelming and time-consuming to set up and manage rules.
• Support responsiveness: Some users report slow support response when refining configurations.
• Cost and documentation: Real-time analytical reporting is noted as costly, and some find documentation limited for optimization.

Source: Fastly

11. Barracuda Advanced Bot Protection

Best for: Bot defense within Barracuda’s WAF and application protection
Strengths: ML detection with crowd-sourced threat intelligence and fingerprinting
Things to consider: Dated configuration UI and slower update cadence

Barracuda Advanced Bot Protection is part of Barracuda’s Web Application Firewall and Application Protection platform and defends websites, mobile apps, and APIs from automated threats, including the OWASP Automated Threats.

The solution uses cloud-based machine learning with crowd-sourced data from Barracuda’s Active Threat Intelligence to identify human-like bots and other advanced attackers. It uses client fingerprinting to identify each client and offers responses such as tarpits, timed blocks, IP reputation, and fingerprint-based actions, and includes specific protections against account takeover, such as credential stuffing checks against a breached-credential database. An Active Threat Intelligence dashboard gives visibility into traffic patterns and individual bots.

Key features include:

• Machine learning with threat intelligence: Uses cloud-based machine learning and crowd-sourced Active Threat Intelligence to identify almost-human bots and advanced attackers.
• Client fingerprinting: Identifies each client through advanced fingerprinting to apply targeted actions.
• Graduated mitigation: Responds with tarpits, timed blocks, IP reputation, CAPTCHA challenges, and fingerprint-based actions to slow and block bots.
• Account takeover defense: Checks logins against a cloud database of breached credentials and uses behavior-based detection and MFA enforcement.
• Signature and reputation database: Includes an on-board database of known bots with reverse DNS lookups and honeytraps to identify simpler bots.
• Application DDoS protection: Defends against application-layer DDoS using heuristic fingerprinting, IP reputation, and client challenges.
• Threat intelligence dashboard: Provides traffic visibility and drill-down into individual bots, their visits, and data transferred.

Limitations (as reported by users on G2):

• Dated configuration UI: Some reviewers find the configuration interface unintuitive and little changed over many years.
• Update cadence: A reviewer notes bot detection updates are released less frequently than bot tactics evolve.
• Reporting and support: Reports can be confusing, and some rules are hard to implement without buying the support package.

Source: Barracuda

Fraud and Identity-Focused Bot Defense

12. Arkose Bot Manager

Best for: Disrupting bot and human-driven attacks with adaptive challenges
Strengths: 225+ risk signals plus interactive challenges that drain attacker ROI
Things to consider: Challenge friction for users and opaque pricing

Arkose Bot Manager detects and disrupts automated and human-driven attacks while aiming to keep legitimate users moving through the experience. It combines risk assessment using more than 225 signals and the Arkose Global Intelligence Network with adaptive, interactive challenges that escalate for suspicious traffic.

The approach is designed to make attacks economically unviable by raising the cost of getting through, rather than only filtering risk. It targets account takeover, fake account creation, SMS toll fraud, scraping, and API abuse. It runs on the Arkose Titan platform and can add agent-aware controls through Arkose Agent Trust Manager, and it provides dashboards that turn threat data into reporting.

Key features include:

• Signal-based detection: Uses 225+ risk signals and the Arkose Global Intelligence Network to identify evasive threats.
• Adaptive challenges: Deploys dynamic interactive challenges that evolve in real time and escalate for suspicious traffic.
• Attacker ROI disruption: Designed to make attacks economically unviable by increasing the effort required to pass.
• Good-user flow: Aims to let legitimate users through with minimal friction while challenging suspicious sessions.
• Attack coverage: Targets account takeover, fake account creation, SMS toll fraud, scraping, and API abuse.
• Reporting and dashboards: Turns threat data into dashboards and insights for security teams.
• Titan platform and agent controls: Runs on Arkose Titan and adds AI agent classification and enforcement through Agent Trust Manager.

Limitations (as reported by users on G2):

• User friction: Some users report that visual challenges can frustrate legitimate users, especially when several appear at login.
• False positives on mobile: A few reviewers note occasional false positives with legitimate users, particularly on mobile traffic.
• Setup and pricing: Initial setup and custom rule and API integration can be time-consuming, and pricing is described as opaque.

Source: Arkose

13. Fingerprint

Best for: Developer-focused device intelligence and bot detection via API
Strengths: Accurate device identification with a single API response
Things to consider: A detection signal, not a full mitigation layer

Fingerprint provides device intelligence and a Bot Detection product that identifies automated traffic through a developer-focused API. Its Bot Detection signal returns one of three values for a visitor: good bot, bad bot, or not detected. It analyzes hundreds of browser attributes and network signals to spot automation tools such as Selenium, Puppeteer, and Playwright, including bots that try to emulate human patterns.

The JavaScript agent is lightweight and integrates into existing risk and fraud engines, with server-side verification recommended for security. Cloud integrations let teams run detection at the edge, and Bot Detection works alongside Fingerprint’s visitor identification and Smart Signals.

Key features include:

• Three-state bot signal: Returns good bot, bad bot, or not detected for each visitor through a single API response.
• Browser and network analysis: Analyzes hundreds of browser attributes and network signals to detect automation and human emulation.
• Automation tool detection: Identifies tools such as Selenium, Puppeteer, and Playwright, and recognizes search bots so they can crawl.
• Developer integration: Provides a lightweight JavaScript agent and SDKs that integrate into existing risk and fraud engines.
• Server-side verification: Recommends verifying results server-side, with a Zero Trust mode that limits exposure of identifiers.
• Edge and cloud integrations: Runs detection at the edge through open-source cloud integrations across major providers.
• Smart Signals and identification: Combines with visitor identification and signals such as VPN, incognito, and proxy detection.

Limitations (as reported by users on G2):

• Scope: Fingerprint provides a detection signal and device intelligence rather than a full mitigation and enforcement layer, so teams build the response logic.
• Score transparency: Some users want more visibility into how confidence and suspect scores are derived for tuning.
• Pricing and signals: Reviewers flag the entry pricing as steep for early-stage or low-traffic projects, and note occasional proxy-detection inaccuracy.

Source: Fingerprint

14. Radware Bot Manager

Best for: Protecting web, mobile, and APIs from bots and AI-driven threats
Strengths: Intent-based behavioral detection with CAPTCHA-less mitigation
Things to consider: Reporting is basic and pricing sits at the higher end

Radware Bot Manager protects web applications, mobile apps, and APIs from automated threats. It uses a multi-layered approach across preemptive protection, behavioral detection, and advanced mitigation. Its proprietary intent-based deep behavioral analysis and AI algorithms identify malicious bots in real time and generate attack signatures to block them, with the aim of keeping false positives low.

It combines behavioral modeling, collective bot intelligence, and fingerprinting of browsers, devices, and machines. Mitigation options include a blockchain-based crypto challenge that avoids CAPTCHAs, plus custom responses and feeding fake data. It also provides AI crawler and AI agent visibility and native mobile app protection.

Key features include:

• AI behavioral detection: Uses proprietary intent-based deep behavioral analysis and AI algorithms to identify malicious bots in real time.
• Multi-layered defense: Combines preemptive protection, behavioral detection, and advanced mitigation across web, mobile, and APIs.
• Fingerprinting and intelligence: Blends behavioral modeling, collective bot intelligence, and fingerprinting of browsers, devices, and machines.
• CAPTCHA-less mitigation: Offers a blockchain-based crypto challenge plus options such as custom responses and feeding fake data.
• AI crawler and agent management: Provides intent-based classification and control of AI crawlers and visibility into AI agent traffic.
• Native mobile protection: Uses integrated device authentication for Android and iOS and secure identity to validate requests.
• Cross-module correlation: Correlates threats with other Radware security modules to preemptively block malicious sources.

Limitations (as reported by users on G2):

• Reporting flexibility: Some reviewers find the reporting basic and hard to customize and want more dashboard functionality.
• Pricing: The product is described as sitting at the higher end and less suited to small organizations.
• Tuning and updates: A few reviewers note occasional blocking of good bots and crawlers and some issues with updates.

Source: Radware

How to Choose Bot Management Solutions

Choosing the right bot management solution requires evaluating more than basic bot detection. Modern bot attacks target web applications, mobile apps, and APIs, often using sophisticated techniques that mimic legitimate user behavior. Organizations should look for a solution that can identify malicious automation accurately, minimize friction for real users, and adapt as attackers change tactics.

Key considerations include:

• Coverage across applications and APIs – The solution should protect web applications, mobile applications, and APIs, including cloud-native and microservices-based environments. This is especially important because many traditional bot defenses rely on browser-based JavaScript, which does not directly protect APIs.
• Multi-dimensional detection – Look for capabilities that combine behavioral analysis, device and client signals, IP reputation, user agent analysis, threat intelligence, and request patterns instead of relying on a single detection method.
• API security alignment – Since bots frequently abuse APIs to conduct credential stuffing, scraping, account takeover, fraud, and business logic attacks, bot management should work closely with API discovery, API inventory, and runtime API protection.
• Protection against business logic abuse – Effective solutions should detect activity that may appear legitimate at the request level but becomes suspicious when analyzed across sessions, users, endpoints, and workflows.
• Adaptive defense against evasive bots – Attackers frequently rotate IPs, change user agents, use residential proxies, and retool their bots. A strong bot management platform should continue tracking malicious automation even as tactics evolve.
• Low friction for legitimate users – The solution should avoid overusing CAPTCHAs or challenges that disrupt customer experience. It should offer risk-based mitigation options that only introduce friction when necessary.
• Flexible mitigation options – Organizations should be able to apply different responses based on risk, such as monitoring, logging, rate limiting, blocking, deception, step-up authentication, or other policy-based controls.
• Fast deployment and time to value – The solution should be easy to deploy without requiring major application changes, lengthy tuning periods, or heavy development work.
• Visibility and actionable intelligence – Security teams should be able to see which bots are active, what they are targeting, how attacks are evolving, and which mitigation actions are being applied.
• Integration with the broader security stack – Bot management should complement existing WAF, API security, fraud prevention, identity, SIEM, and incident response workflows rather than operate as an isolated control.

The Modern Bot Management Solution: How to Get Started with Cequence

Traditional bot management solutions have proven daunting to implement, especially if they require application modification through JavaScript or mobile SDK integration. This approach also means that only modified applications are afforded any coverage. Cequence is the modern solution. Compared to traditional approaches, Cequence can be deployed via SaaS without needing to modify your applications, dramatically simplifying onboarding and streamlining the number of departments and subject matter experts that are required. Cequence deployments enable customers to first see the detected malicious traffic that would be blocked before later transitioning to an active mode where blocking or other customer-chosen mitigation occurs.

Cequence offers a unique approach to bot management that is easy to deploy, provides rapid time to value, and is highly effective. If you’d like to learn more, contact us and let Cequence show you how we can address bots in your unique situation.

What Is Bot Protection?

Bot protection refers to the strategies, software, and services used to detect and block malicious automated traffic on websites, mobile apps, and APIs. It separates legitimate human users and useful bots (like search engine crawlers) from bad bots designed for data theft, fraud, or service disruption.

Effective bot protection relies on a layered defense approach:

• Traffic analysis: Analyzing request patterns, volumes, IP addresses, geolocation, headers, and session characteristics to identify suspicious automated traffic.
• Device and browser fingerprinting: Gathering data about the user’s hardware, browser, and operating system to detect inconsistencies.
• Behavioral analysis: Monitoring traffic in real-time to spot anomalies and micro-behaviors that humans execute but bots cannot replicate.
• Reputation-based detection: Utilizing global threat databases and verification to automatically pass authenticated, verified bots without friction.
• Allowlisting verified bots: Automatically identifying and permitting trusted bots, such as search engine crawlers and monitoring services, while continuing to block malicious automation.

This is part of a series of articles about bot management

In this article:

• Why Bot Protection Solutions Matter More Than Ever
• How Bot Protection Works
• Bot Protection Architecture: Network-Based vs. Client-Side vs. CDN-Based Approaches
• Key Bot Protection Features to Look For
• Bot Protection Strategies and Best Practices

Why Bot Protection Solutions Matter More Than Ever

As organizations expand their digital services, automated traffic has become a majority of overall internet activity. While many bots serve legitimate purposes, malicious bots are increasingly used to automate attacks at scale, making bot protection a key part of modern cybersecurity strategies.

• Automated attacks are more frequent and sophisticated: Attackers use bots to perform credential stuffing, account takeover attempts, inventory hoarding, and scraping operations. These attacks can be executed continuously and at a scale that manual defenses cannot handle.
• Traditional security controls are often insufficient: Firewalls and basic rate-limiting tools can stop some threats, but modern bots are built to mimic human behavior, rotate IP addresses, and bypass simple detection methods. Dedicated bot protection provides deeper analysis and more accurate identification.
• Protection against fraud and financial loss: Malicious bots are commonly used to exploit promotions, create fake accounts, conduct payment fraud, and abuse online services. Preventing automated abuse helps reduce operational costs and revenue losses.
• Improved user experience: Excessive bot traffic can slow websites and applications, increase latency, and consume infrastructure resources. Filtering malicious traffic helps maintain consistent performance for legitimate users.
• Support for API security: APIs are a common target for automated attacks because they expose business logic and data directly. Bot protection helps identify abnormal API activity and prevents unauthorized automated access.
• Reduced infrastructure and bandwidth costs: High volumes of unwanted automated traffic consume server capacity, network bandwidth, and cloud resources. Blocking malicious bots reduces unnecessary resource usage and associated costs.
• Protection of sensitive data and content: Bots are frequently used to scrape pricing information, proprietary content, customer data, and other valuable assets. Bot protection helps prevent unauthorized data collection and intellectual property theft.
• Regulatory and compliance considerations: Organizations that handle sensitive customer information must demonstrate reasonable security controls. Bot protection supports broader security and compliance efforts by reducing the risk of automated abuse and data exposure.
• Preservation of business operations: Automated attacks can disrupt critical online services, prevent legitimate transactions, and damage customer trust. Bot protection helps ensure service availability and operational continuity.

How Bot Protection Works

Let’s review the key components of modern bot protection solutions.

Traffic Analysis

Traffic analysis examines patterns and characteristics of incoming requests to identify anomalies indicative of bot activity. This includes monitoring request rates, source IP distribution, geographic origin, and HTTP header consistency. Unusual spikes, repetitive behaviors, or traffic from known data centers may signal automated attacks. Solutions use these insights to flag or block suspicious traffic before it reaches the application layer.

Traffic analysis also involves correlating data across multiple sessions and endpoints. By aggregating traffic statistics, security teams can spot coordinated botnets or distributed attacks that single-point monitoring might miss. Effective traffic analysis requires continuous monitoring and adaptive thresholds to respond to changing attack tactics without impacting legitimate users.

Device and Browser Fingerprinting

Device and browser fingerprinting collects data about the environment from which a request originates, such as operating system, browser version, installed plugins, screen resolution, and hardware details. This information creates a unique identifier, or fingerprint, for each device. Bots often use headless browsers, automation frameworks, or inconsistent fingerprints that differ from genuine user patterns.

Fingerprinting is effective against bots that rotate IP addresses or use proxy networks. By tracking device attributes instead of only network information, bot protection solutions can maintain detection accuracy even as attackers change their infrastructure. Combining fingerprinting with other detection layers further reduces false positives and helps distinguish between legitimate users, trusted bots, and malicious automation.

Behavioral Analysis

Behavioral analysis focuses on how users interact with a website or application to spot deviations from normal human behavior. It examines mouse movements, typing speed, scroll patterns, and page navigation sequences. Bots often fail to mimic the nuances of human interactions, such as erratic mouse paths or varied click timing.

By building behavioral baselines and applying machine learning, bot protection systems can distinguish between genuine users and scripted activity. Over time, these models improve their accuracy and adapt to new attack methods and user trends. Behavioral analysis is useful for detecting credential stuffing, scalping, and other attacks where bots attempt to simulate real user actions.

Reputation-Based Detection

Reputation-based detection uses threat intelligence databases to assess the risk associated with incoming requests. These databases track IP addresses, device fingerprints, user agents, and other identifiers linked to known botnets or malicious activity. If a request matches a known bad actor or suspicious pattern, the system can automatically block or challenge it.

This approach benefits from global threat sharing, where information about new bot campaigns is distributed across participating organizations. By using up-to-date reputation data, bot protection solutions can defend against emerging threats without waiting for new attack signatures or behavioral patterns to develop. Reputation-based detection complements other methods by adding an intelligence-driven defense layer.

Allowlisting Verified Bots

Allowlisting verified bots ensures that essential automated traffic, such as search engine crawlers, monitoring tools, and partner integrations, is not blocked by bot protection systems. This process involves identifying and maintaining a list of trusted bots based on their IP ranges, user agents, or verification tokens.

Managing allowlists requires ongoing validation to avoid abuse. Attackers may attempt to spoof good bot identities to bypass controls. Bot protection solutions implement verification checks and monitor for impersonation attempts. By balancing security with operational needs, allowlisting ensures that only authorized bots are permitted while blocking malicious automation.

Bot Protection Architecture: Network-Based vs. Client-Side vs. CDN-Based Approaches

Network-based bot protection analyzes traffic before it reaches the application, using signals such as IP reputation, request rates, geographic origin, and threat intelligence to identify malicious automation. It is commonly deployed through reverse proxies, web application firewalls, or security gateways and provides broad protection for websites and APIs without requiring application changes.

Client-side bot protection runs within the user’s browser or mobile application, collecting signals such as device characteristics, browser behavior, JavaScript execution, and user interactions. This approach provides deeper visibility into how requests are generated, making it effective at detecting sophisticated bots that use browser automation tools or attempt to mimic legitimate users.

CDN-based bot protection is integrated into content delivery networks, allowing malicious traffic to be detected and blocked at edge locations before reaching origin servers. By combining global threat intelligence, traffic analysis, and distributed filtering, CDN-based solutions reduce infrastructure load, improve application performance, and help stop automated attacks closer to their source.

The following table summarizes the three models and their pros and cons.

ArchitectureDescriptionProsConsNetwork-‍BasedAnalyzes traffic before it reaches the application using IP reputation, request patterns, geolocation, and threat intelligence.Easy deployment, protects websites and APIs, no application changes required.Limited visibility into client behavior, can be bypassed by distributed bot networks.Client-SideCollects signals from browsers or mobile apps, including device characteristics, JavaScript execution, and user interactions.Detects sophisticated bots, provides detailed behavioral insights.Requires client-side integration, may impact performance and raise privacy considerations.CDN-BasedDetects and blocks bots at CDN edge locations using global threat intelligence and distributed traffic analysis.Reduces origin load, improves performance, blocks attacks closer to the source.Typically depends on CDN adoption and may provide less application-specific context.

Key Bot Protection Features to Look For

1. Real-Time Bot Detection

Real-time bot detection continuously analyzes incoming requests as they occur to determine whether they originate from legitimate users, trusted bots, or malicious automation. Rather than relying on static signatures alone, modern platforms evaluate multiple signals simultaneously, including traffic patterns, device fingerprints, browser characteristics, behavioral data, and threat intelligence. This enables organizations to detect and mitigate attacks before they affect applications, APIs, or users.

Key capabilities:

• Continuous analysis of requests as they reach the application.
• Multi-signal detection using behavioral, network, and device data.
• Automatic identification of known and emerging bot attacks.
• Low-latency detection that minimizes impact on legitimate users.
• Adaptive models that evolve as attacker techniques change.

2. Bot Scoring or Risk Scoring

Bot scoring, also known as risk scoring, assigns a numerical value or risk level to each request based on its likelihood of being automated. This score is calculated using factors such as behavioral analysis, device fingerprinting, IP reputation, and historical activity. By quantifying risk, organizations can apply policies such as allowing, challenging, or blocking traffic based on business requirements.

Key capabilities:

• Assigns dynamic risk scores to every request.
• Combines behavioral, fingerprinting, reputation, and contextual signals.
• Supports configurable actions based on risk thresholds.
• Continuously updates scores as user behavior changes.
• Reduces unnecessary challenges for low-risk users.

3. Good Bot Verification

Not all bots are malicious. Search engine crawlers, uptime monitors, SEO tools, and approved partner integrations perform legitimate functions that organizations often depend on. Good bot verification distinguishes these trusted services from attackers attempting to impersonate them by validating identity through techniques such as IP verification, cryptographic validation, reverse DNS checks, and vendor-maintained allowlists.

Key capabilities:

• Verifies legitimate search engine and monitoring bots.
• Prevents spoofing of trusted bot identities.
• Automatically allows verified bots with minimal friction.
• Supports configurable allowlists for approved partners and services.
• Continuously validates trusted bot identities as infrastructure changes.

4. API Bot Protection

APIs expose business logic and sensitive data directly, making them frequent targets for automated attacks such as credential stuffing, scraping, account takeover, and business logic abuse. API bot protection monitors API requests for suspicious automation while allowing legitimate applications and integrations to operate normally. Protection typically combines behavioral analysis, authentication validation, rate limiting, and anomaly detection to identify malicious API traffic.

Key capabilities:

• Detects automated abuse targeting REST, GraphQL, and other APIs.
• Protects authentication, payment, and account management endpoints.
• Identifies abnormal API usage patterns and business logic abuse.
• Supports API-specific rate limiting and access policies.
• Integrates with API gateways and API security platforms.

5. Native Mitigation Controls

Native mitigation controls allow bot protection platforms to respond automatically when malicious automation is detected, reducing the need for manual intervention. Instead of simply identifying suspicious traffic, these controls enforce predefined policies in real time to stop attacks before they impact applications or users. Modern solutions combine AI-driven detection with flexible enforcement actions that can be applied immediately or after security team approval, allowing organizations to balance security, user experience, and operational requirements.

Key capabilities:

• Automatically generates mitigation rules based on detected attacks.
• Supports real-time enforcement or human-reviewed policy deployment.
• Blocks malicious requests before they reach applications.
• Applies rate limiting to slow or restrict suspicious traffic.
• Injects headers to support downstream security policies and workflows.
• Uses deception techniques to disrupt or mislead automated attacks.
• Provides customizable mitigation policies for different applications and business requirements.

6. Advanced Behavioral Analysis Based on AI/ML

Advanced behavioral analysis uses artificial intelligence and machine learning to identify bots based on their intent and behavior rather than relying only on signatures or client-side signals. By analyzing traffic across web applications, mobile apps, and APIs, AI models establish behavioral fingerprints that distinguish legitimate users, trusted bots, and malicious automation. As attackers change their tools or infrastructure, machine learning continuously adapts detection models to maintain accuracy and identify emerging attack techniques without requiring constant manual tuning.

Key capabilities:

• Uses AI and machine learning to analyze behavioral intent across web, mobile, and API traffic.
• Builds behavioral fingerprints to distinguish legitimate users from malicious bots.
• Tracks attacker behavior even when IP addresses, devices, or techniques change.
• Continuously improves detection accuracy as new attack patterns emerge.
• Detects sophisticated automation without relying solely on client-side JavaScript or SDKs.
• Supports automated threat detection and policy creation for faster response.
• Applies machine learning to accelerate behavioral baselining for new applications.

7. Credential Stuffing Protection

Credential stuffing protection stops automated login attempts that use stolen username and password combinations obtained from previous data breaches. Attackers use bots to test large volumes of credentials across multiple websites, exploiting the fact that many users reuse passwords. Bot protection solutions detect credential stuffing by analyzing login behavior, request velocity, device fingerprints, and reputation signals.

Key capabilities:

• Detects high-volume automated login attempts.
• Correlates device fingerprints, IP reputation, and behavioral signals.
• Identifies password spraying and credential reuse attacks.
• Supports adaptive authentication for suspicious logins.
• Integrates with identity providers and MFA solutions.

8. Rate Limiting

Rate limiting controls how many requests a user, device, or IP address can make within a specified period. It helps prevent bots from overwhelming applications with excessive requests and reduces the effectiveness of automated attacks such as scraping, brute-force login attempts, and denial-of-service activity.

Key capabilities:

• Limits requests by IP address, user, device, session, or API key.
• Applies different thresholds to different applications or endpoints.
• Supports burst detection and adaptive rate limiting.
• Prevents scraping, brute-force attacks, and API abuse.
• Automatically throttles or blocks excessive requests.

9. Custom Rules and Policies

Every organization has unique applications, user populations, and security requirements. Custom rules allow security teams to tailor bot protection to their specific environment instead of relying solely on predefined detection logic. Policies can be based on request attributes, user behavior, geographic location, application context, API endpoints, authentication status, or business-specific conditions.

Key capabilities:

• Creates custom detection and enforcement rules.
• Supports policy exceptions for trusted users or applications.
• Applies different policies across websites, APIs, and applications.
• Enables automated allow, challenge, throttle, or block actions.
• Integrates with existing security workflows and governance policies.

10. CAPTCHA Alternatives

Traditional CAPTCHAs can help stop bots, but they often create friction for legitimate users and may be bypassed by automation tools. Many bot protection platforms use alternative verification methods that provide stronger security with less user friction. Common CAPTCHA alternatives include invisible challenges, behavioral analysis, device attestation, browser integrity checks, and risk-based authentication. These methods evaluate requests in the background and only require additional verification when suspicious activity is detected.

Key capabilities:

• Uses invisible challenges that minimize user friction.
• Applies behavioral analysis instead of manual verification.
• Supports browser integrity and device attestation checks.
• Triggers additional verification only for high-risk requests.
• Integrates with adaptive authentication and identity systems.

11. Analytics and Reporting

Analytics and reporting provide visibility into bot activity, attack trends, and the effectiveness of security controls. Dashboards typically display metrics such as bot traffic volume, attack types, blocked requests, geographic distribution, and affected applications or APIs. Detailed reporting helps security teams investigate incidents, identify emerging threats, and refine protection strategies. Historical analysis can reveal long-term trends and measure the impact of mitigation efforts.

Key capabilities:

• Dashboards showing bot traffic, attack trends, and mitigation results.
• Historical reporting for long-term analysis and capacity planning.
• Detailed visibility into affected applications, APIs, and endpoints.
• Investigation tools for analyzing attack campaigns and indicators.
• Exportable reports for security, operations, and compliance teams.

12. Integration with WAF, CDN, SIEM, and Fraud Tools

Bot protection solutions are most effective when integrated with existing security and infrastructure platforms. Integration with web application firewalls (WAFs) enables coordinated enforcement of security policies, while content delivery networks (CDNs) can block malicious traffic closer to its source and reduce infrastructure load. Connections with security information and event management (SIEM) platforms provide centralized visibility and incident investigation capabilities. Integration with fraud detection tools allows organizations to correlate bot activity with account abuse, payment fraud, and other business risks.

Key capabilities:

• Integrates with WAFs for coordinated traffic enforcement.
• Shares telemetry with SIEM platforms for investigation and correlation.
• Works with CDNs to filter malicious traffic at edge locations.
• Connects to fraud detection platforms to identify business abuse.
• Supports APIs, webhooks, and automation workflows for orchestration.

Bot Protection Strategies and Best Practices

Build Bot Protection Around APIs, Not Only Websites

Many organizations focus bot protection on web applications while leaving APIs with fewer security controls. However, APIs often expose authentication, payment processing, search functions, and other business logic that attackers can abuse directly. Protecting only browser traffic leaves API endpoints vulnerable to automated attacks that bypass traditional web defenses.

Apply the same level of bot protection to REST, GraphQL, and other APIs as you do to websites. Monitor API-specific behavior, enforce authentication where appropriate, apply rate limits, and analyze request patterns to detect automation. Consistent protection across web and API traffic reduces gaps that attackers can exploit.

Use Behavioral Detection Instead of Relying Only on IP Reputation

IP reputation remains useful for identifying known malicious infrastructure, but it is no longer sufficient on its own. Attackers routinely rotate IP addresses, use residential proxy networks, and distribute requests across thousands of devices to avoid reputation-based blocking. As a result, malicious traffic may appear to originate from legitimate locations.

Behavioral detection analyzes how requests are generated rather than where they come from. Combining behavioral analysis with device fingerprinting, traffic analysis, and reputation data provides more reliable detection and reduces false positives. This layered approach is more effective against sophisticated bots that continuously change their infrastructure.

Protect Login, Registration, and Account Recovery Flows

Authentication-related workflows are among the most common targets for bot attacks. Credential stuffing, password spraying, fake account creation, and abuse of password reset functions can lead to account compromise, fraud, and increased operational costs. These endpoints should receive stricter monitoring than less sensitive parts of an application.

Implement adaptive authentication, rate limiting, bot detection, and risk-based challenges for login, registration, and account recovery processes. Monitoring these workflows separately allows organizations to detect abnormal activity early while minimizing friction for legitimate users.

Detect Business Logic Abuse, Not Just Technical Attacks

Not all bot attacks exploit software vulnerabilities. Many target legitimate application functionality to gain an unfair advantage, such as purchasing limited inventory before customers, abusing promotional offers, scraping pricing information, or submitting fraudulent transactions. These attacks often appear as valid application requests.

Bot protection should understand normal business workflows and identify behavior that violates expected usage patterns. Combining application context with behavioral analysis helps detect abuse that traditional network security controls may overlook, protecting both revenue and customer experience.

Apply Layered Defenses Across WAAP, API Security, and Bot Management

No single security control can stop every type of automated attack. Attackers continuously adapt their techniques, using different infrastructure, automation frameworks, and attack paths to bypass individual defenses. A layered architecture improves resilience by evaluating traffic from multiple perspectives.

Integrate bot protection with web application and API protection (WAAP), API security platforms, identity systems, and threat intelligence services. Sharing telemetry across these technologies improves detection accuracy, enables coordinated enforcement, and provides better visibility into attack campaigns across the environment.

Related content: See how bot management solutions fit into a layered defense strategy.

Continuously Discover Exposed APIs and Shadow Endpoints

Organizations frequently deploy new APIs without updating security inventories. Development, testing, and legacy endpoints may remain publicly accessible, creating shadow APIs that receive little monitoring but can still be targeted by automated attacks. Unknown assets represent blind spots in bot protection programs.

Regularly discover and inventory exposed APIs, validate that they are protected by the same security policies as production services, and remove or secure endpoints that are no longer required. Continuous discovery helps ensure new APIs are incorporated into bot protection strategies before attackers find them.

Stop Automated Attacks with Cequence Bot Management

Cequence Bot Management protects an organization’s web, mobile, API, and AI channels from the full range of bot attacks, business logic abuse, and fraud – preventing data loss, theft, and downtime. Rather than depending on client-side signals from end-user devices, Cequence uses holistic, network-based detection that analyzes behavioral intent across all traffic, delivering more accurate results than traditional client-side approaches and requiring no application modification to deploy.

Key capabilities of Cequence Bot Management:

• Network-based behavioral detection: Machine learning analyzes behavioral intent across web, mobile, and API traffic to build an accurate behavioral fingerprint that reliably separates good bots from bad and keeps tracking malicious activity even as attackers re-tool to evade detection.
• No client-side changes: Protection is delivered without client-side JavaScript or SDK integration, avoiding the customer friction created by CAPTCHAs and similar methods used by competing solutions.
• AI-driven mitigation policies: Advanced AI detects attacks and autonomously creates threat mitigation rules and policies that can be implemented automatically or after human review.
• Real-time mitigation options: Enforcement includes blocking, rate limiting, header injection, and deception to stop malicious automation as it happens.
• Unified multi-channel coverage: A single platform secures web, mobile, API, and AI channels against automated attacks, business logic abuse, and fraud.

Learn more about how Cequence Bot Management detects and mitigates automated attacks across your applications and APIs.

‍

TL;DR: Enterprise bot management solutions block malicious automation across web, mobile, and APIs without blocking real users. Best for comprehensive bot defense: Cequence, best for edge: Cloudflare; best for global reach: Akamai; best for fraud protection: DataDome.

What Are Enterprise Bot Management Solutions?

Enterprise bot management solutions protect websites and APIs from malicious automated traffic, like account takeover scripts and fake account creators, without blocking real users. These tools use artificial intelligence and behavioral tracking to assign risk scores to every visitor.

These solutions go beyond simple filtering by leveraging advanced techniques such as behavioral analysis, machine learning, and real-time monitoring. Their primary goal is to distinguish between legitimate human users, authorized bots (like search engine crawlers), and malicious or unwanted automated traffic that can threaten business operations or data integrity.

Unlike traditional security tools that focus on broader threats, enterprise bot management platforms target the unique challenges posed by bots. These challenges range from credential stuffing and data scraping to inventory hoarding and denial-of-service attacks. The platforms provide enterprises with the ability to enforce custom policies, gain actionable insights, and adapt to new threats as they evolve.

In this article:

• Why Are the Unique Requirements of Enterprises when Selecting Bot Management Solutions?
• Enterprise Bot Management Solutions at a Glance
• Key Features of Enterprise-Grade Bot Management Platforms
• Notable Enterprise Bot Management Solutions

Why Are the Unique Requirements of Enterprises when Selecting Bot Management Solutions?

Large enterprises operate complex digital environments that span public websites, customer portals, mobile applications, partner integrations, and APIs across multiple cloud providers and regions. They face a broader range of automated attacks, higher traffic volumes, and stricter compliance requirements than smaller organizations.

As a result, enterprise bot management platforms must deliver accurate detection at scale while integrating with existing security, networking, and identity infrastructure:

• Scalability across environments: Protect web applications, mobile apps, APIs, and hybrid or multi-cloud deployments without creating operational bottlenecks.
• Low false-positive rates: Stop malicious automation while minimizing friction for legitimate customers, partners, and employees.
• API and non-browser protection: Detect automated abuse targeting APIs, mobile applications, and machine-to-machine traffic, not just browser sessions.
• Flexible deployment options: Support inline, reverse proxy, CDN, network-based, and on-premises deployments to match enterprise architectures.
• Granular policy controls: Apply different actions by application, endpoint, geography, user type, or risk score instead of using one global policy.
• Integration with existing security tools: Connect with SIEM, SOAR, WAF, IAM, fraud prevention, and SOC workflows for centralized operations.
• Advanced threat intelligence: Continuously adapt to new bot frameworks, AI agents, credential stuffing campaigns, and large-scale scraping attacks.
• High-performance mitigation: Analyze and respond to requests in real time without introducing noticeable latency for end users.
• Comprehensive analytics and reporting: Provide detailed visibility into attack trends, bot categories, business impact, and policy effectiveness for both technical and executive teams.
• Governance and compliance support: Help satisfy regulatory, audit, and data privacy requirements through logging, reporting, and controlled handling of traffic.

Related content: Read our article about how bot management solutions work

Enterprise Bot Management Solutions at a Glance

The table below summarizes the key differences between the solutions covered in this article. We explore each of them in more detail in the sections that follow.

CategorySolutionBest ForKey StrengthsThings to ConsiderUnified Application, API & Edge SecurityCequence Bot ManagementComprehensive web, mobile, and API bot defense with no client-side codeNetwork-based detection, no JavaScript or SDK, real-time mitigationInitial tuning and policy setup can benefit from dedicated expertiseUnified Application, API & Edge SecurityCloudflare Bot ManagementTeams wanting bot defense built into an edge/CDN platformNetwork-scale ML, edge mitigation, Turnstile CAPTCHA alternativeFalse positives are a recurring issue for users behind corporate proxiesUnified Application, API & Edge SecurityAkamai Bot ManagerEnterprises on Akamai’s edge protecting apps, APIs, and mobileEdge Bot Score, large known-bot directory, stealthy responsesExpensive, with tuning and onboarding that often require Akamai’s own teamUnified Application, API & Edge SecurityImperva Advanced Bot ProtectionWeb, mobile, and API defense against OWASP automated threats700+ detection dimensions, flexible deployment, granular controlsAdvanced features drive up cost, and the dashboard lags behind competing toolsDedicated Bot & Fraud PreventionDataDome Bot ProtectReal-time bot and AI-agent defense across web, apps, and APIsSub-2ms edge detection, low false positives, 24/7 SOCExpensive, and integration regularly requires developer effortDedicated Bot & Fraud PreventionHUMAN SightlineBest-in-class bot and fraud defense across web, mobile, and APIsDecision engine, AI-traffic control, deep investigation toolsExternal deployment adds an extra ingress hop, and pricing climbs with traffic volumeDedicated Bot & Fraud PreventionF5 Distributed Cloud Bot DefenseEnterprises needing adaptive bot and AI-agent defense at scaleClient-side telemetry, agent-aware, no manual rule tuningA steep setup and learning curve, paired with premium pricingDedicated Bot & Fraud PreventionArkose Bot ManagerLogin, signup, and account flows facing bots and fraud farms225+ risk signals, adaptive challenges, global intelligenceOpaque pricing, and dashboards and reporting fall short of deeper analysis needs

Key Features of Enterprise-Grade Bot Management Platforms

Multi-Layered Client and Environment Fingerprinting

Enterprise platforms collect signals from browsers, devices, networks, operating systems, TLS handshakes, and runtime behavior to build a detailed fingerprint for every client. This makes it harder for attackers to evade detection by rotating IP addresses, changing user-agent strings, or moving traffic through residential proxy networks.

Modern fingerprinting also detects signs of automation frameworks, headless browsers, browser tampering, virtual machines, and emulated mobile devices. It can compare claimed device attributes with observed behavior to identify mismatches that indicate spoofing.

Because attackers can manipulate individual signals, enterprise platforms do not rely on one identifier. They combine many weak indicators into a stronger risk profile and update it as the session develops. This improves accuracy while reducing the chance that legitimate users are blocked because of one unusual attribute.

Related content: Read our article about bot detection in the AI age

Cross-Channel Protection for Web, Mobile, and APIs

Bot attacks increasingly target APIs and mobile applications because they often expose the same business functions as websites. Enterprise platforms monitor requests across all channels to identify coordinated attacks that move between browsers, mobile apps, and API endpoints.

This unified approach allows organizations to apply consistent security policies regardless of how users access an application. It also provides a single view of automated activity instead of forcing security teams to manage separate detection systems for each channel.

For mobile traffic, platforms may verify application integrity, device signals, request patterns, and the use of modified clients. For APIs, they analyze tokens, request sequences, payload structure, endpoint usage, and traffic velocity to detect abuse that does not depend on browser-based signals.

Cross-channel correlation is important because attackers often test credentials on an API and complete the attack through a website or mobile app. Linking activity across these paths helps reveal patterns that would look harmless when each channel is reviewed separately.

Granular, Risk-Based Response Orchestration

Instead of blocking every suspicious request, enterprise platforms assign a risk score and choose the most appropriate response. Low-risk traffic may be allowed, medium-risk sessions can be challenged, and high-risk requests can be blocked, rate limited, redirected, or sent for additional verification.

Risk-based responses reduce friction for legitimate users while making automated attacks more expensive and less effective. Policies can change dynamically based on user behavior, application sensitivity, transaction value, geography, authentication state, or current attack conditions.

Response orchestration can also use progressive controls. A client may first receive a lightweight JavaScript challenge, then a CAPTCHA, and finally a block if suspicious behavior continues. This approach avoids applying the strongest control too early.

Enterprise platforms may also trigger actions outside the request path. For example, they can alert a security operations center, force step-up authentication, revoke a session, create a fraud case, or feed indicators into a SIEM or SOAR platform.

Application-Specific Policy Management

Different applications face different bot threats. A public product catalog may primarily need protection against scraping, while a customer portal requires stronger defenses against account takeover, credential stuffing, and automated transaction abuse.

Enterprise platforms let security teams define separate policies for individual applications, endpoints, APIs, user groups, or business functions. This enables more precise protection without applying unnecessary restrictions across the entire environment.

Policies can account for the normal behavior of each application. High request rates may be expected on a public API but suspicious on a login endpoint. Similarly, anonymous browsing may be acceptable for a product page but not for a payment or account recovery workflow.

Application-specific controls also support staged rollout and testing. Security teams can monitor a policy in detection-only mode, review its effect, and then enable mitigation. This reduces the risk of disrupting critical services when new rules are introduced.

Global and Organization-Specific Learning Models

Enterprise bot management combines threat intelligence gathered across many customers with models trained on an organization’s own traffic. Global intelligence helps identify emerging attack tools, proxy networks, automation frameworks, and campaign patterns seen across industries.

Organization-specific models learn what normal behavior looks like for particular applications, users, endpoints, and transaction flows. They can detect small deviations that would not appear suspicious when compared only with global traffic patterns.

Using both approaches improves detection accuracy and helps the platform adapt as attackers change tactics. It also reduces dependence on manually maintained signatures and static rules, which can become outdated quickly.

The models should be continuously updated and monitored for drift. Enterprise teams also need controls to review detections, provide feedback, exclude trusted automation, and understand which signals contributed to a decision. These capabilities make automated detection easier to govern and tune.

Enterprise Integration and Deployment Flexibility

Bot management platforms are designed to integrate with existing security, networking, identity, and fraud prevention infrastructure. Common integrations include web application firewalls, SIEM platforms, SOAR workflows, identity providers, API gateways, content delivery networks, and case management systems.

These integrations allow bot events to become part of wider incident response processes. A high-risk login attempt, for example, can trigger step-up authentication, create an alert, enrich a fraud investigation, and update access controls without requiring manual action.

Deployment options typically include reverse proxy, CDN, inline gateway, cloud-native, network-based, and on-premises models. Some platforms also support agentless deployment, application connectors, SDKs, or API-based integrations for mobile and non-browser traffic.

This flexibility is important for enterprises with legacy systems, regulated workloads, regional data requirements, or multiple cloud providers. The platform should provide consistent policies and reporting across deployment models so teams do not have to operate separate security programs for each environment.

High-Scale Protection With Minimal User Friction

Enterprise environments may process millions of requests while maintaining strict performance and availability requirements. Bot management platforms must analyze traffic and make mitigation decisions in real time without introducing noticeable latency.

The goal is to stop malicious automation without interrupting legitimate business activity. Accurate detection reduces unnecessary CAPTCHA challenges, login failures, blocked transactions, and customer support issues while maintaining protection during large-scale attacks.

High-scale platforms use distributed processing, edge enforcement, caching, and automated policy updates to handle traffic spikes. They should continue to operate during product launches, ticket sales, seasonal demand, and coordinated bot campaigns without becoming a bottleneck.

Resilience is also important. Enterprise solutions should support failover, regional redundancy, capacity planning, and clear service-level commitments. They must maintain stable enforcement even when traffic patterns change suddenly or parts of the underlying infrastructure become unavailable.

Notable Enterprise Bot Management Solutions

How we selected these solutions: We shortlisted enterprise bot management platforms based on detection accuracy across web, mobile, and API traffic, mitigation flexibility, good-bot and AI-agent classification, account takeover and scraping defense, and real-time analytics and reporting.

Unified Application, API & Edge Security Platforms

These platforms deliver bot management as part of a broader application, API, or edge security stack, letting enterprises consolidate detection, mitigation, and policy under one console.

1. Cequence Bot Management

Best for: Comprehensive web, mobile, and API bot defense with no client-side code.

Strengths: Network-based detection, no JavaScript or SDK, and real-time mitigation.

Things to consider: Initial tuning and policy setup benefit from dedicated expertise.

Cequence Bot Management protects web, mobile, and API applications from automated attacks at the network level, without requiring client-side JavaScript or SDK integration. This approach removes the regression testing and third-party code changes that other tools introduce, and extends consistent protection across cloud and microservices architectures.

Rather than relying on signals from end-user devices, its machine learning analyzes behavioral intent across web, mobile, and API traffic to build a behavioral fingerprint that separates good bots from bad ones and continues to track malicious activity as attackers re-tool. The solution addresses account takeover, content scraping, flash and sneaker-drop abuse, sensitive data exposure, gift card and loyalty program abuse, and business logic abuse, and it is part of the wider Cequence platform.

General features:

• Network-based bot detection: Inspects web, mobile, and API traffic at the network layer with no client-side JavaScript or SDK, so all applications are covered consistently.
• Behavioral intent analysis: Machine learning models user, entity, and traffic behavior to build a fingerprint that distinguishes good bots, bad bots, and humans even as attackers change tactics.
• Real-time mitigation: AI creates threat mitigation rules and policies that run automatically or after human review, with options including blocking, rate limiting, header injection, and deception.
• Friction-free user verification: Biometric Check routes suspicious traffic to native device authentication such as Face ID, Touch ID, or Windows Hello instead of puzzles or SMS codes.
• AI and agent protection: Discovers unauthorized internal AI use, prevents sensitive data leakage through AI APIs, and blocks unwanted AI bot content scraping.
• Flexible, fast deployment: Deploys on-premises, in the cloud, or hybrid, with passive or inline sensors, hundreds of predefined rules, and machine learning baselining within hours.

Enterprise features:

• Industry-tailored compliance: Provides dedicated PCI DSS compliance support and readiness guidance for the EU AI Act.
• Vertical-specific protection: Offers configurations tuned for financial services, healthcare, public sector, retail, and telecom.
• Agentic AI governance: Extends into the wider Cequence platform to secure and control agentic AI workflows across the enterprise.
• Massive operational scale: Protects more than 10 billion daily API interactions and 4 billion user accounts for its largest customers.
• Flexible regulated deployment: Supports on-premises, cloud, or hybrid deployment to fit data residency and regulatory requirements.
• Fraud forensics at scale: Provides detailed incident forensics and industry-specific fraud policies for large security teams.

Limitations (as reported by users on G2):

• Onboarding time: Tuning detection and policies for large or complex API environments benefits from dedicated expertise, particularly during initial onboarding.
• Dashboard performance: Large data queries can take a moment to return in the dashboard, an area the team continues to optimize.
• Report customization: Tailoring dashboards and reports for different stakeholders is straightforward with a bit of upfront planning.

Source: Cequence

2. Cloudflare Bot Management

Best for: Teams wanting bot defense built into an edge/CDN platform.

Strengths: Network-scale ML, edge mitigation, and a Turnstile CAPTCHA alternative.

Things to consider: False positives are a recurring issue for users behind corporate proxies.

Cloudflare Bot Management uses machine learning and behavioral analysis across Cloudflare’s global network to detect and stop malicious bot traffic before it reaches an application. Because its models are trained on traffic from a large share of the Internet, Cloudflare identifies novel attacks early and pushes protection across its network. Detection and mitigation run at the edge, inside the Cloudflare stack, so responses happen close to the user.

The solution covers credential and API protection, e-commerce use cases such as inventory hoarding, and turns bot detection into real-time signals for user experience and marketing spend. Cloudflare Turnstile provides a privacy-preserving alternative to traditional CAPTCHA.

General features:

• Network-scale machine learning: Models trained on a large portion of Internet traffic score every request, so novel attacks are seen first and protection is deployed across the network.
• Edge-based mitigation: Detection and mitigation run within the Cloudflare stack at the edge, close to users.
• Turnstile CAPTCHA alternative: A privacy-preserving challenge replaces traditional CAPTCHA.
• Credential and API protection: Protects login endpoints from credential stuffing and APIs from scraping, resource abuse, and automated probing.
• E-commerce bot defense: Identifies and blocks inventory hoarding bots.
• Real-time traffic optimization: Uses bot detection as a real-time signal for user experience and marketing spend.

Enterprise features:

• Custom SLAs: Enterprise contracts include a 100% uptime guarantee backed by service credits.
• Dedicated support model: Provides 24/7 phone support and a technical account manager as a direct point of contact.
• Dedicated IP ranges: Offers IP addresses not shared with other Cloudflare customers for compliance and traffic allowlisting.
• SSO and priority routing: Adds single sign-on and prioritized network routing on enterprise contracts.
• Full product suite access: Bundles the broader Cloudflare stack, including Zero Trust, API Shield, and Advanced Rate Limiting, into enterprise agreements.

Limitations (as reported by users on Gartner Peer Insights):

• False positives behind proxies: Legitimate visitors routed through corporate proxies such as McAfee or Zscaler are regularly flagged as bad bots, and one reviewer reported months of unresolved escalation.
• Analytics depth: Reviewers consistently want deeper analysis and visibility than the platform currently provides.
• Deployment effort: Rolling the solution out in stages demands significant time and resources, especially for teams without prior experience.

Source: Cloudflare

3. Akamai Bot Manager

Best for: Enterprises on Akamai’s edge protecting apps, APIs, and mobile.

Strengths: Edge Bot Score, a large known-bot directory, and stealthy responses.

Things to consider: Expensive, with tuning and onboarding that often require Akamai’s own team.

Akamai Bot Manager detects bot traffic and mitigates malicious bots at the edge while managing good bots, protecting apps and assets regardless of how customers interact. A script injected into monitored pages feeds behavioral anomaly detection, and patented technology with an AI framework assigns a Bot Score to each request and learns over time.

The Bot Score runs from 0 (human) to 100 (bot) and maps to configurable response segments, so teams can watch, challenge, or mitigate traffic based on risk. Visualization and reporting tools show the impact of different bot types on the business, and the same detections extend across the attack surface, including mobile apps.

General features:

• Edge Bot Scoring: Assigns each request a score from 0 (human) to 100 (bot) starting at the first request, refining it as more requests arrive.
• AI behavioral detection: AI models analyze user behavior and browser fingerprinting, using a script injected into monitored pages to capture behavioral anomalies.
• Known-bot directory: A continuously updated library of categorized bots, with the option to add custom bot categories.
• Stealthy responses: Actions go beyond block-and-allow, including challenge, slow, and serve alternate content, to avoid tipping off bots.
• Cross-surface protection: The same detections extend to mobile apps and the full attack surface.
• Reporting and SIEM integration: Real-time reporting of trends, with functionality available via APIs and Bot Score data that feeds into SIEM tools.

Enterprise features:

• SIEM integration: Feeds Bot Score data into SIEM tools such as Splunk, QRadar, and ArcSight through a dedicated connector.
• Custom bot categorization: Lets teams create their own bot categories on top of Akamai’s continuously updated known-bot directory.
• DevSecOps integration: Exposes Bot Manager functionality via APIs for integration into existing development pipelines.
• Privacy and legal review: Collected data points are reviewed regularly by Akamai’s legal team for GDPR and CCPA compliance.
• Configurable response tiers: Supports cautious, strict, and aggressive response segments mapped to the Bot Score for tailored enterprise policy.

Limitations (as reported by users on G2):

• Learning curve: New users consistently report that console navigation takes weeks to learn.
• Premium pricing and fees: The price point is high, and customers are charged separate onboarding fees just to activate new products.
• Manual mitigation at scale: High bot-traffic surges often require Akamai’s own team to step in, rather than the platform handling it automatically.
• Tuning and hidden thresholds: Without careful tuning, false positives rise quickly, and some thresholds such as session validation stay hidden from customers entirely.

Source: Akamai

4. Imperva Advanced Bot Protection

Best for: Web, mobile, and API defense against OWASP automated threats.

Strengths: 700+ detection dimensions, flexible deployment, and granular controls.

Things to consider: Advanced features drive up cost, and the dashboard lags behind competing tools.

Imperva Advanced Bot Protection safeguards websites, mobile apps, and APIs from bot attacks, including all OWASP 21 Automated Threats. Its multi-layered detection combines direct client interrogation, behavior analysis, machine learning, connection characteristics, and threat intelligence feeds, evaluating more than 700 dimensions to separate human, good bot, and bad bot traffic and create a fingerprint that resists evasion.

Teams get granular controls and reporting, with real-time monitoring and analysis by path or rule. Deployment options include single-stack Cloud WAF integration or connectors for AWS, Cloudflare, F5, NGINX, and Fastly, as well as on-premises. Response options range from monitor and challenge to block and rate-limit.

General features:

• Multi-layered detection: Combines client interrogation, behavioral analysis, machine learning, connection characteristics, and threat intelligence across more than 700 dimensions.
• OWASP automated threat coverage: Protects against all OWASP 21 Automated Threats across web, mobile apps, and APIs.
• Flexible deployment: Single-stack Cloud WAF integration, connectors for AWS, Cloudflare, F5, NGINX, and Fastly, or on-premises.
• Granular response options: Monitor, challenge, block, or rate-limit by path, domain, or application.
• Good and bad bot classification: Separates humans, good bots such as search crawlers, and malicious bots.
• Reporting and real-time testing: Analyzes trends by path or rule and tests configurations in a production environment.

Enterprise features:

• Regulatory compliance tooling: Provides logging, auditing, and access controls to support GDPR, PCI DSS, and PII protection requirements.
• Multi-tenant platform protection: Secures SaaS and multi-cloud platforms from automated misuse across tenants.
• SIEM and security stack integration: Connects with SIEMs and other security management platforms for centralized monitoring.
• Flexible enterprise deployment: Runs across public/private cloud, hybrid, and on-premises environments.
• Unified security suite: Integrates with the broader Imperva WAF, API Security, DDoS Protection, and CDN products.

Limitations (as reported by users on G2):

• Dashboard experience: Users consistently describe the dashboard as less refined than those of competing tools.
• Add-on cost: Advanced capabilities are delivered as paid add-ons, raising the overall cost beyond the base platform.
• Testing constraints: Users are limited to validating the tool with Imperva’s own testing bot and cannot test against their own.
• Reverse proxy setup: Deployment requires routing through a reverse proxy, adding real setup work before the platform is live.

Source: Imperva

Dedicated Bot & Fraud Prevention Platforms

These platforms focus specifically on bot detection, mitigation, and fraud prevention, often layering onto an existing WAF, CDN, or authentication stack for best-of-breed protection.

5. DataDome Bot Protect

Best for: Real-time bot and AI-agent defense across web, apps, and APIs.

Strengths: Sub-2ms edge detection, a low false-positive rate, and a 24/7 SOC.

Things to consider: Expensive, and integration regularly requires developer effort.

DataDome Bot Protect delivers real-time bot protection for websites, mobile apps, APIs, and MCP servers. It analyzes every request using hundreds of client-side and server-side signals and processes over 5 trillion signals per day, with AI models that separate human users, legitimate AI agents, and malicious bots. Detection runs at the edge across more than 35 points of presence, with response times under 2 milliseconds and a false-positive rate under 0.01%.

Beyond standard detection, DataDome includes Agent Trust to identify, classify, score, and govern agentic AI traffic. Mitigation runs automatically in line with business logic, and the platform integrates across CDNs and servers while applying two-layer PII encryption for GDPR and CCPA.

General features:

• Real-time signal analysis: Evaluates every request using hundreds of client-side and server-side signals, processing over 5 trillion signals daily.
• Edge detection at low latency: Runs across 35+ points of presence with response times under 2 milliseconds.
• AI model detection: Uses 1000+ out-of-the-box and customer-specific models plus collective threat intelligence to classify humans, trusted AI agents, and malicious bots.
• Agent Trust management: Identifies, classifies, scores, and governs agentic AI traffic in real time.
• Automated mitigation: High-risk traffic triggers automated responses aligned with business logic while keeping a false-positive rate under 0.01%.
• Broad integrations and privacy: Offers 80+ integrations across CDNs and servers, with two-layer PII encryption for GDPR and CCPA.

Enterprise features:

• 24/7 SOC and threat research: Backed by the Galileo Threat Research team and round-the-clock SOC monitoring.
• Availability SLA: Most plans include a 99.9% availability guarantee across its 35+ points of presence.
• Enterprise data protection: Applies two-layer PII encryption to support GDPR and CCPA compliance.
• Broad integration footprint: Offers 80+ integrations across CDNs, servers, and infrastructure providers.
• Structured onboarding: Runs onboarding across parallel deployment, management, and training workstreams for large teams.

Limitations (as reported by users on G2):

• Cost: Pricing sits on the higher end and puts the platform out of reach for many smaller teams.
• Integration effort: Setup regularly requires developer involvement, especially for PWAs, service workers, and mobile SDKs.
• False positives during spikes: Strict detection challenges legitimate users during traffic surges unless it is carefully tuned in advance.
• Data retention and limits: Short log retention and per-workspace endpoint limits meaningfully constrain long-term analysis.

Source: DataDome

6. HUMAN Sightline

Best for: Best-in-class bot and fraud defense across web, mobile, and APIs.

Strengths: A strong decision engine, AI-traffic control, and deep investigation tools.

Things to consider: External deployment adds an extra ingress hop, and pricing climbs with traffic volume.

HUMAN Sightline detects and mitigates malicious bot attacks, including account takeover, scraping, fake accounts, carding, and scalping, while giving teams visibility and control over known bots, crawlers, and AI. Its decision engine identifies sophisticated bots and responds with scenario-optimized actions that range from hard blocks to softer mitigations.

Teams can monitor and control known bots and AI traffic, choosing to allow, deny, monetize, suppress ads, or serve alternate content. Granular investigation tools surface attack paths, changing behaviors, and attacker intent, and the Satori Threat Intelligence and Research team analyzes and disrupts emerging fraud schemes. Protection spans websites, mobile applications, and APIs.

General features:

• Decision engine detection: Detects sophisticated bots and responds with scenario-optimized actions, including hard blocks and soft mitigations.
• Known bot and AI-traffic control: Monitors known bots, crawlers, and AI, with options to allow, deny, monetize, suppress ads, or serve alternate content.
• Investigation tooling: Pinpoints attack paths and changing behaviors, with detail on attacker actions and intent for prioritizing threats.
• Multi-surface coverage: Protects websites, mobile applications, and APIs.
• Threat intelligence: The Satori Threat Intelligence and Research team analyzes and disrupts cyberthreats and fraud schemes.

Enterprise features:

• Dedicated threat research: The Satori Threat Intelligence and Research team investigates and disrupts large-scale fraud schemes.
• Regulatory compliance support: Includes a dedicated PCI DSS compliance solution.
• Industry-specific protection: Offers tailored configurations for financial services, healthcare, public sector, retail, and other regulated sectors.
• SOC-level investigation tooling: Provides Threat Tracker for pinpointing attack paths and attacker intent during incident response.
• AI agent governance: Adds AgenticTrust to monitor and enforce policy on AI agent traffic across the customer journey.

Limitations (as reported by users on G2):

• Dashboard and reporting: The console is difficult to navigate, and reporting and analytics fall short of user-friendly.
• Limited historical data: A short data-retention window and slow searches make long-range investigations meaningfully harder.
• Cost: Traffic-based pricing climbs quickly for large or scaling teams, making costs hard to predict.
• Configuration and friction: Initial tuning is complex, config-as-code support is limited, and users report recurring repeat challenges.

Source: HUMAN

7. F5 Distributed Cloud Bot Defense

Best for: Enterprises needing adaptive bot and AI-agent defense at scale.

Strengths: Client-side telemetry, agent-aware classification, and no manual rule tuning.

Things to consider: A steep setup and learning curve, paired with premium pricing.

F5 Distributed Cloud Bot Defense uses real-time behavioral analysis, client-side intelligence, and platform-wide telemetry to detect and control bots and AI agents at the application interaction layer. It distinguishes humans, trusted AI agents, and harmful automation based on behavior and intent rather than static signatures, and it continuously adapts as attacker techniques change without manual tuning.

The solution protects web apps, mobile apps, and APIs, and applies real-time enforcement such as allow, block, rate-limit, or step-up controls where abuse occurs. It runs natively on the F5 Application Delivery and Security Platform across hybrid, multi-cloud, and on-premises environments, with centralized visibility and SIEM integration.

General features:

• Agent-aware classification: Separates humans, trusted AI agents, and malicious automation based on behavior and intent rather than static signatures.
• Behavioral analysis: Detects human-like bots that move beyond signature-based detection.
• Client-side telemetry: High-fidelity signal collection resists evasion, with obfuscation guarding the collected data.
• Continuous adaptation: Defenses adjust automatically as attacker techniques change, without manual rule tuning.
• API and mobile protection: Secures non-browser and mobile traffic alongside web apps.
• Real-time enforcement and SIEM integration: Applies allow, block, rate-limit, or step-up actions and feeds signal data into Syslog and SIEM systems.

Enterprise features:

• Platform-native integration: Connects natively with the F5 Application Delivery and Security Platform for centralized policy across hybrid, multi-cloud, and on-premises environments.
• Flexible support models: Offers a fully managed option with a dedicated SOC, an augmented self-managed model with shared SOC, or a fully self-architected deployment.
• Data residency controls: Lets customers choose where data is stored (US, Canada, or EU), with 24/7 global SOC support.
• SIEM and Syslog integration: Feeds signal data into Syslog and leading SIEM systems for unified security operations.
• Dedicated deployment support: Technical Account Managers and Solution Architects assist with rollout for Bot Defense customers.

Limitations (as reported by users on G2):

• Setup complexity: First-time setup takes real time and frequently requires F5’s own assistance, with a steep learning curve.
• Premium pricing: Costs run consistently higher than competing tools.
• Interface: Users describe the management interface as dated and overly text-heavy.
• Latency and transparency: Cloud routing adds latency, and the detection models operate as a black box, making efficacy hard to gauge.

Source: F5

8. Arkose Bot Manager

Best for: Login, signup, and account flows facing bots and fraud farms.

Strengths: 225+ risk signals, adaptive challenges, and global intelligence.

Things to consider: Opaque pricing, and dashboards and reporting fall short of deeper analysis needs.

Arkose Bot Manager detects and disrupts advanced bot and human-driven attacks, preventing account takeover, SMS toll fraud, and fake account creation. It combines device intelligence, network and IP signals, and behavioral analysis with more than 225 risk signals and the Arkose Global Intelligence Network to score each session, then routes high-risk traffic through a challenge stack that resists AI-powered solvers.

Its dynamic challenges evolve in real time to counter new attack vectors while letting legitimate users pass without added friction. Arkose Bot Manager runs on the Arkose Titan platform, and the Agent Trust Manager option classifies AI agents by intent and enforces Allow, Monitor, or Block on the same session infrastructure.

General features:

• Multi-signal risk scoring: Combines device intelligence, network and IP signals, and behavioral analysis with 225+ risk signals to score each session.
• Adaptive challenge stack: Routes high-risk traffic through dynamic challenges that evolve in real time and resist AI-powered solvers.
• Global intelligence network: Draws on the Arkose Global Intelligence Network for cross-industry attack signals.
• Low-friction user flow: Separates legitimate users from bots so genuine users pass without added friction.
• Agent Trust Manager option: Classifies AI agents by intent and enforces Allow, Monitor, or Block on the same Titan session infrastructure.
• Reporting and dashboards: Surfaces attack patterns and risk data for stakeholders.

Enterprise features:

• Embedded SOC: A 24/7/365 security operations center proactively tunes protection to each business’s specific KPIs.
• Dedicated threat research unit: The Arkose Cyber Threat Intelligence Research (ACTIR) team conducts proactive threat hunting.
• Financial warranties: Backs the platform with warranties of up to $1 million against credential stuffing, SMS toll fraud, and card testing attacks.
• Full data transparency: Shares 175+ telltale rules and decision logic in real time so customers can extend protection downstream.
• AI agent enforcement: Agent Trust Manager classifies and enforces policy on AI agent sessions across the same infrastructure.

Limitations (as reported by users on G2):

• Dashboards and reporting: Analytics lack the self-service drill-down into individual sessions that teams need.
• Opaque pricing: Pricing and customization are difficult to scale, and smaller companies struggle to establish clear ROI.
• Setup and tuning: Initial tuning for complex traffic patterns takes real time, and challenge sensitivity requires ongoing adjustment.
• User friction: Users report repeated challenges at login, and front-end integration adds another implementation step.

Source: Arkose

Conclusion

Enterprise bot management has evolved from basic bot blocking into a critical security capability that protects web applications, mobile apps, and APIs from increasingly sophisticated automated threats. The right platform should accurately distinguish legitimate users, trusted bots, AI agents, and malicious automation while minimizing user friction and integrating with existing security infrastructure. Organizations should prioritize solutions that provide behavioral detection, flexible deployment, risk-based mitigation, and comprehensive visibility across digital channels, ensuring they can adapt as attacker techniques and AI-driven automation continue to evolve.

‍

TL;DR: Bot management vendors detect and block malicious automation while letting real users and good bots through. Best for API-first defense: Cequence; best for edge speed: DataDome

What Are Bot Management Vendors?

Choosing the right bot management vendor requires balancing detection efficacy against user friction and infrastructure costs. Focus on how well vendors handle advanced threats (credential stuffing, scraping), their impact on latency, and their ability to differentiate malicious bots from AI and search engine crawlers.

Bot management tools aim to distinguish between legitimate human users, beneficial bots (such as search engine crawlers), and malicious bots that can harm websites or applications. Vendors use a combination of behavioral analysis, machine learning, and fingerprinting techniques to identify and filter out unwanted bot activity in real-time.

Key evaluation criteria

Use these six dimensions to compare vendors like for like:

• Detection accuracy and bot coverage: How reliably the solution separates humans, good bots, and malicious automation, and which attack types it stops.
• Impact on user experience and friction: How much the solution disrupts real users through CAPTCHAs, challenges, or added latency.
• Protection across web, mobile, and APIs: Whether coverage spans browsers, mobile apps, and API and business-logic endpoints.
• Deployment, integration, and scalability: The deployment models, existing-stack integrations, and scale the platform supports.
• Good bot and AI agent management: How well it recognizes search crawlers, partners, and AI agents, and lets you allow, limit, or monetize them.
• Visibility, analytics, and managed operations: The quality of dashboards, reporting, and managed or SOC support.

Solutions compared in this guide

• Dedicated bot and fraud defense platforms
  • Cequence Bot Management
  • DataDome Bot Protect
  • HUMAN Bot Defender
  • Arkose Bot Manager
• WAF and CDN-integrated bot management
  • Cloudflare Bot Management
  • Akamai Bot Manager
  • Imperva Advanced Bot Protection
  • F5 Distributed Cloud Bot Defense

In this article:

• Why Choosing the Right Bot Management Vendor Matters
• How to Choose a Bot Management Vendor
• Common Bot Management Solutions and How They Meet the Criteria
• Notable Bot Management Solutions

Why Choosing the Right Bot Management Vendor Matters

Reducing Account Takeover and Credential Stuffing

Credential stuffing and account takeover attacks are persistent threats for businesses with user login systems. Malicious bots systematically test stolen or leaked usernames and passwords across multiple sites, exploiting users who reuse credentials. Bot management vendors identify and block these automated login attempts in real time, reducing the risk of unauthorized access using:

• Advanced anomaly detection
• Behavioral analysis
• Device fingerprinting

A reliable bot management solution also integrates with multi-factor authentication and risk-based authentication systems, adding further layers of defense. By preventing credential stuffing at scale, these vendors help organizations protect user accounts, reduce fraud losses, and avoid regulatory penalties that result from compromised data.

Stopping Fake Account Creation and Transaction Abuse

Malicious bots are frequently used to create fake accounts, which are then exploited for spam, fraud, or to manipulate online services. Bot management vendors deploy sophisticated detection methods, including CAPTCHA alternatives, behavioral biometrics, and real-time threat intelligence to identify and block automated account creation attempts. This reduces fake registrations and prevents downstream abuse such as:

• Promo code fraud
• Spam messaging
• Inventory hoarding

Transaction abuse, such as card testing, gift card fraud, or scalping, often involves high-speed, automated attacks that can evade traditional security controls. Bot management solutions analyze transaction patterns and user behaviors to spot and stop these activities before they impact business operations. By mitigating fake account creation and transaction abuse, vendors help organizations protect revenue, maintain platform integrity, and deliver a fair user experience.

Managing Approved Search, Partner, Monitoring, and AI Bots

Not all bots are harmful. Many serve critical business functions, such as search engine indexing, partner integrations, and uptime monitoring. Bot management vendors provide granular controls to distinguish between approved and unwanted bots, ensuring that essential automated traffic is not inadvertently blocked. This involves:

• Maintaining updated allowlists
• Verifying bot identities
• Monitoring bot behavior for compliance with agreed usage policies

Vendors also help organizations accommodate the growing presence of AI-driven bots that interact with platforms for legitimate purposes, such as data aggregation or API usage. By managing these relationships, bot management vendors enable businesses to maximize the value of beneficial bots while maintaining security and performance. This careful balance is key to supporting digital growth without exposing assets to unnecessary risk.

Stopping Business Logic Abuse

Business logic abuse occurs when attackers use bots to exploit intended application workflows in ways that cause financial or operational harm. These attacks often appear as valid user activity, making them difficult for traditional web application firewalls or rate limiting controls to detect. Examples include:

• Repeatedly redeeming promotional offers
• Bypassing purchase limits
• Abusing loyalty programs
• Reserving inventory without completing purchases
• Manipulating pricing rules

Bot management vendors address this challenge by combining behavioral analysis, session monitoring, device intelligence, and machine learning to identify patterns that indicate automated abuse. Rather than relying only on signatures or request rates, they evaluate how users interact with application workflows and enforce policies that block suspicious activity while allowing legitimate customers to complete transactions. This helps organizations protect revenue, preserve the integrity of business processes, and reduce operational costs caused by automated abuse.

Minimizing Friction for Legitimate Users

Bot defenses must stop automated abuse without creating unnecessary obstacles for genuine customers. Traditional challenges such as CAPTCHAs, SMS one-time passwords, and email verification codes can interrupt the user journey, increase abandonment, and create accessibility issues. When detection systems produce false positives, organizations may also weaken their security policies to avoid blocking legitimate users, allowing more malicious traffic to pass through.

The right bot management vendor uses behavioral risk scoring and adaptive challenges to intervene only when a session appears suspicious. Instead of automatically blocking the user, the solution can request fast, device-native verification, such as:

• Touch ID
• Face ID
• Windows Hello

Hardware-bound verification can confirm that a person is present in less than a second without redirects, puzzles, or codes, while keeping biometric data on the user’s device. Pass-and-fail results can also help teams measure false-positive rates and refine detection thresholds over time, improving both security and conversion.

How to Choose a Bot Management Vendor

The criteria below map to the questions buyers actually weigh when comparing bot management vendors. Work through each one against the solutions on your shortlist.

1. Detection Accuracy and Bot Coverage

The core job of any bot management vendor is telling humans, good bots, and malicious automation apart, and doing it accurately as attackers retool. Detection quality depends on the mix of techniques used, including behavioral analysis, machine learning, device or network fingerprinting, and threat intelligence, and on how well the system holds up against sophisticated bots that rotate fingerprints and mimic human behavior. Just as important is the false positive rate, since over-blocking real users is as damaging as missing bots. Coverage matters too: the solution should handle credential stuffing, scraping, account takeover, carding, and scalping rather than only simple, known bots.

Evaluation criteria:

• Does it combine behavioral analysis, machine learning, and fingerprinting rather than static signatures alone?
• Can it catch sophisticated bots that rotate fingerprints and imitate human behavior?
• What false positive rate does it document or guarantee?
• Does it cover credential stuffing, scraping, account takeover, carding, and inventory abuse?
• How current and broad is its threat intelligence?

Related content: Read our guide to bot detection in the AI age, including detection methods and best practices.

2. Impact on User Experience and Friction

Security that frustrates real customers costs revenue, so friction is a first-class evaluation criterion. Traditional defenses lean on CAPTCHAs and hard challenges that interrupt legitimate users, while modern approaches favor passive detection, risk scoring, and challenges applied only to suspicious traffic. Latency matters as well, since inline inspection can slow page loads if it is not done efficiently. The goal is strong blocking with minimal visible impact on genuine users.

Evaluation criteria:

• Does it rely on passive or behavioral detection rather than blanket CAPTCHAs?
• Are challenges applied only to suspicious or high-risk traffic?
• What latency does inspection add, and where does it run?
• Are CAPTCHA-free or low-friction verification options available?

3. Protection Across Web, Mobile, and APIs

Bots no longer target only websites; they hit mobile apps and, increasingly, APIs and business-logic endpoints. A vendor that only covers browser traffic leaves gaps at exactly the points where automated fraud concentrates. Look for consistent protection across web, mobile SDKs, and API traffic, plus coverage for non-browser and machine-to-machine requests.

Evaluation criteria:

• Does it protect web, mobile apps, and APIs under one policy?
• Is there mobile SDK or app-level coverage?
• Does it inspect API and non-browser traffic, not just page loads?
• Can it defend business-logic flows like login, checkout, and account recovery?

Related content: Read our article about API security to understand how automated abuse targets API endpoints.

4. Deployment, Integration, and Scalability

How a solution deploys shapes time-to-value and operational fit. Options range from edge and CDN delivery to server-side sensors, reverse proxy, JavaScript snippets, and on-premises appliances, and the right choice depends on your architecture. Integration with your existing WAF, CDN, SIEM, and fraud stack determines how well the tool fits your workflows, and the platform must scale to peak traffic and attack spikes without degrading performance.

Evaluation criteria:

• Does it support the deployment models you need across cloud, on-premises, hybrid, and edge?
• Does it integrate with your existing WAF, CDN, SIEM, and fraud tools?
• How much application change or client-side code does it require?
• Can it scale to peak events and large attack volumes?

5. Good Bot and AI Agent Management

Not all automation is hostile. Search crawlers, partner integrations, monitoring bots, and a growing wave of AI agents and LLM scrapers all need to be recognized and handled deliberately rather than blanket-blocked. Strong vendors maintain verified-bot directories, let you allow, limit, or monetize legitimate automation, and increasingly classify AI agents by identity and intent so you can enable agentic use cases while blocking abuse.

Evaluation criteria:

• Can it distinguish verified good bots such as search, partner, and monitoring bots from bad ones?
• Does it classify and govern AI agents and LLM scrapers by intent?
• Can you allow, limit, or monetize legitimate automated traffic?
• Are bot allowlists and directories kept current?

6. Visibility, Analytics, and Managed Operations

Bot management is ongoing, so dashboards, reporting, and support matter as much as detection. Teams need clear visibility into bot versus human traffic, attack trends, and false positive rates, plus the ability to investigate incidents. Many vendors also offer managed or SOC services to tune models and respond to attacks, which is valuable for teams without in-house bot expertise.

Evaluation criteria:

• Does it provide dashboards showing bot versus human traffic and attack trends?
• Can you investigate incidents and export data to a SIEM?
• Are managed or 24/7 SOC services available?
• How much tuning and expertise does day-to-day operation require?

Common Bot Management Solutions and How They Meet the Criteria

The table below summarizes how each solution measures up against the criteria above. Each is explored in detail in the sections that follow.

CategorySolutionHow It Meets the CriteriaDedicated bot and fraud defense platformsCequence Bot ManagementNetwork-based ML detection across web, mobile, and API traffic with agentless deployment and autonomous, real-time mitigation; strong API and AI-agent coverage.Dedicated bot and fraud defense platformsDataDome Bot ProtectEdge-delivered AI detection across 35+ points of presence with sub-2ms latency; covers web, mobile, APIs, and MCP servers, with Agent Trust and a 24/7 SOC.Dedicated bot and fraud defense platformsHUMAN Bot DefenderBehavior-based, session-wide decisioning across web, mobile, and APIs with layered ML, deep investigation tooling, and policies to control crawlers, LLM scrapers, and AI agents.Dedicated bot and fraud defense platformsArkose Bot ManagerAdaptive detection using 225+ risk signals and dynamic challenges focused on account security and fraud, with 24/7 SOC and AI agent governance via Arkose Titan, a separate product.WAF and CDN-integrated bot managementCloudflare Bot ManagementInternet-scale ML detection built into the edge stack with Turnstile for low-friction challenges; broad coverage, though full behavioral features are gated to Enterprise.WAF and CDN-integrated bot managementAkamai Bot ManagerEdge Bot Score detection with stealthy, tunable responses and a maintained good-bot directory; strong at global scale, offered as an add-on that rewards operational expertise.WAF and CDN-integrated bot managementImperva Advanced Bot ProtectionMulti-layered detection covering web, mobile, and APIs against OWASP automated threats, with granular tuning and flexible cloud, connector, and on-premises deployment.WAF and CDN-integrated bot managementF5 Distributed Cloud Bot DefenseAgent-aware behavioral and client-side detection across web, mobile, and APIs, delivered natively on the F5 platform across hybrid and multi-cloud, with SIEM integration.

Notable Bot Management Solutions

How we selected these solutions: We shortlisted bot management vendors based on their ability to detect and mitigate automated attacks such as credential stuffing, scraping, account takeover, and inventory abuse across web, mobile, and API traffic while managing good bots and AI agents.

Dedicated Bot and Fraud Defense Platforms

1. Cequence Bot Management

Best for: Large enterprises protecting web, mobile, and API traffic at the network level

Strengths: Agentless, network-based detection with AI-driven, real-time mitigation

Things to consider: Solution works best inline with live traffic

Cequence Bot Management protects web, mobile, and API applications from the full range of bot attacks, including account takeover, content scraping, flash and sneaker-drop abuse, sensitive data exposure, gift card and loyalty fraud, and business logic abuse. Rather than relying on client-side signals, it operates at the network level and analyzes behavioral intent across web, mobile, and API traffic.

This network-based approach removes the need for client-side JavaScript or SDK integration, which simplifies rollout and keeps coverage consistent across cloud and microservices architectures. Cequence Bot Management is part of the wider Cequence Platform, which protects more than 10 billion daily API interactions and 4 billion user accounts.

Key features include:

• Network-based detection: Analyzes behavioral intent across web, mobile, and API traffic to build a behavioral fingerprint, without client-side JavaScript or SDK integration, and continues tracking malicious activity as attackers re-tool.
• Real-time mitigation: AI detects attacks and autonomously creates mitigation rules and policies that run automatically or after human review, with options including blocking, rate limiting, header injection, and deception.
• Friction-free verification: Biometric Check routes suspicious traffic to native authentication such as Face ID, Touch ID, or Windows Hello to confirm a real person in under a second, avoiding puzzles and codes.
• Built with and for AI: Protects GenAI and agentic AI use in the enterprise, discovers unauthorized internal AI use, prevents data leakage through AI APIs, and defends against AI content scraping.
• Rapid time to value: Deploys on-premises, in the cloud, or hybrid with passive or inline software sensors, over 150 predefined rules, and machine learning that baselines applications within hours.
• Fraud prevention: Applies customizable, granular policies with detailed incident forensics and transaction analysis for insight into fraudulent activity.

CriterionSolution FitKey ConsiderationsDetection accuracy and bot coverageNetwork-based ML analyzes behavioral intent across web, mobile, and API traffic to track attackers as they re-tool; covers ATO, scraping, scalping, and business logic abuse.Detection baselines over a short learning period before mitigating, and alert tuning helps reduce noise.Impact on user experience and frictionRequires no CAPTCHAs by default; Biometric Check confirms real users in under a second.A CAPTCHA-style fallback is newer than some competitors’ long-standing challenge libraries.Protection across web, mobile, and APIsProtects web, mobile, API, and microservices traffic at the network level under one approach.Value is highest in environments where API traffic is significant.Deployment, integration, and scalabilityDeploys on-premises, cloud, or hybrid with passive or inline sensors, no JS or SDK, 150+ predefined rules, and ML baselining in hours; exports to SIEM and fraud tools.Live traffic provides the greatest value.Good bot and AI agent managementDistinguishes good from bad bots and protects GenAI and agentic AI use, including unauthorized internal AI and AI content scraping.Agentic controls are part of the broader platform rather than a standalone module.Visibility, analytics, and managed operationsDashboards, incident forensics, and transaction analysis, plus managed threat services from the CQ Prime team.Reporting dashboards could offer more executive-summary customization.

Source: Cequence

2. DataDome Bot Protect

Best for: Real-time, low-latency bot and AI agent defense at the edge

Strengths: Documented under 0.01% false positive rate and fast setup

Things to consider: Pairs with a WAF or WAAP for non-bot threat coverage

DataDome Bot Protect delivers real-time bot detection across websites, mobile apps, APIs, and MCP servers. It analyzes every request rather than a sample, evaluating hundreds of client-side and server-side signals to assess risk continuously throughout the user journey.

The detection engine processes over 5 trillion signals per day using more than 1,000 out-of-the-box and customer-specific models plus collective threat intelligence, and it operates at the edge across 35+ points of presence in under 2 milliseconds. DataDome cites an industry-leading false positive rate of under 0.01%.

Key features include:

• Continuous request analysis: Inspects every request, from page visits to logins and cart actions, evaluating hundreds of signals to assess intent throughout the session.
• AI detection engine: Uses over 1,000 models and 5 trillion daily signals to distinguish human users, trusted AI agents, and malicious bots.
• Edge mitigation: Runs across 35+ global points of presence with sub-2ms response times, keeping a false positive rate under 0.01% and showing CAPTCHAs to less than 0.01% of requests.
• Agent Trust management: Identifies, classifies, scores, and governs agentic AI traffic, validating AI agent identity and intent so verified agents can transact.
• Integrations and deployment: Offers more than 50 out-of-the-box integrations across edge CDNs such as Fastly, Cloudflare, Akamai, and CloudFront, and server-side platforms including NGINX, F5, HAProxy, and Envoy, with setup measured in hours.
• Visibility and SOC: Provides a threat dashboard with Watchtower endpoint discovery, custom dashboards and reports, and a dedicated 24/7 SOC team, plus two-layer PII encryption.

CriterionSolution FitKey ConsiderationsDetection accuracy and bot coverageAnalyzes every request with 1,000+ models and 5 trillion daily signals, distinguishing humans, AI agents, and bots at a documented under 0.01% false positive rate.Manual, human-driven scraping can be harder to stop than automated bots.Impact on user experience and frictionEdge inspection in under 2ms with CAPTCHAs shown to under 0.01% of requests.The dashboard can occasionally lag under heavy load.Protection across web, mobile, and APIsCovers websites, mobile apps, APIs, and MCP servers.Focused on bots and fraud; pair with a WAF or WAAP for broader web threats.Deployment, integration, and scalability50+ integrations across edge CDNs and server-side platforms, with setup in hours and 35+ points of presence.Some initial configuration steps and edge-case setups can take extra time.Good bot and AI agent managementAgent Trust classifies, scores, and governs AI agents, allows verified crawlers, and monetizes AI traffic.Agent Trust is a distinct capability layered onto Bot Protect.Visibility, analytics, and managed operationsWatchtower discovery, custom dashboards and reports, and a 24/7 SOC.Pricing flexibility can be a consideration for some buyers.

Source: DataDome

3. HUMAN Bot Defender

Best for: Behavior-based defense across web, mobile, and APIs

Strengths: Session-wide decisioning and deep fraud investigation tools

Things to consider: Initial configuration and dashboard tuning take time

HUMAN Bot Defender, delivered through HUMAN Sightline Cyberfraud Defense, governs traffic across web, mobile, and APIs to stop automated, AI-driven, and human-led fraud. It uses machine learning, behavioral analysis, and intelligent fingerprinting, and it continuously correlates session activity across each authentication stage rather than judging individual requests in isolation.

The platform deploys with existing infrastructure through a JavaScript snippet or SDK and operates out of band, so it preserves page load performance while keeping false positives low. It is backed by the Satori Threat Intelligence and Research team.

Key features include:

• High-fidelity decisioning: Correlates session activity across each authentication stage, with layered AI models that adapt automatically to new threat behavior.
• Multi-method detection: Combines fingerprinting, behavior-based analysis, and predictive methods to detect hyper-distributed attacks.
• Customizable mitigation: Applies hard blocks, soft challenges, silent controls, and investigation triggers, and integrates with WAF, CDN, IAM, and fraud operations tooling; HUMAN Challenge replaces CAPTCHA for suspected bots.
• Crawler, scraper, and agent control: Provides visibility into known bots, LLM scrapers, and AI agents, with policies to block, allow, limit, or monetize automated activity.
• Reporting and investigation: Delivers AI-generated insights, pattern analysis, automated reports, and secondary detection to uncover fraud networks, with dashboards tailored to fraud, security, and business stakeholders.
• Flexible deployment: Integrates with existing infrastructure using more than 40 pre-built integrations across CDNs, load balancers, and web and application servers, with no in-line appliance required.

CriterionSolution FitKey ConsiderationsDetection accuracy and bot coverageMulti-method ML, behavioral analysis, and fingerprinting with session-wide correlation and adaptive learning.The Analyzer investigation tool is not real-time and can be slow.Impact on user experience and frictionHUMAN Challenge replaces CAPTCHA and the asynchronous sensor preserves page load performance, with low false positives.Some challenge and tuning decisions still require configuration.Protection across web, mobile, and APIsGoverns traffic across web, mobile, and APIs.Full value depends on correct sensor and enforcer placement.Deployment, integration, and scalabilityDeploys with existing infrastructure via JS snippet or SDK, out of band, with 40+ CDN, load balancer, and server integrations.Customer autonomy for rule creation is limited, for example VPN blocking and multi-parameter logic.Good bot and AI agent managementControls known bots, LLM scrapers, and AI agents with policies to block, allow, limit, or monetize.Handled through policy configuration rather than a directory-first model.Visibility, analytics, and managed operationsAI-generated insights, secondary detection, and stakeholder dashboards, backed by the Satori research team.Historical log retention can be limited for older investigations.

Source: HUMAN

4. Arkose Bot Manager

Best for: Account security and fraud prevention at login and signup

Strengths: Adaptive challenges and 225+ risk signals with 24/7 SOC

Things to consider: Interactive challenges and pricing suit larger budgets

Arkose Bot Manager detects and disrupts advanced bot and human-driven attacks across the user journey, with a focus on account takeover, fake account creation, SMS toll fraud, credential stuffing, and scraping. It draws on more than 225 risk signals and the Arkose Global Intelligence Network to identify evasive threats and applies dynamic challenges that evolve in real time.

The product runs on Arkose Titan, the shared session infrastructure behind Arkose’s portfolio, which lets teams add AI agent governance through Arkose Agent Trust Manager in one click without a new integration. It is supported by a 24/7 global SOC and real-time threat intelligence.

Key features include:

• Risk-signal detection: Uses 225+ risk signals and the Arkose Global Intelligence Network to spot evasive bot and human-driven attacks.
• Adaptive challenges: Deploys dynamic challenges that evolve in real time to counter emerging attack vectors while letting good users pass without friction.
• Account and API protection: Defends account flows against takeover, brute force, and credential stuffing, with Arkose Edge adding server-side API protection.
• AI agent governance: Arkose Agent Trust Manager classifies AI agents by intent and enforces Allow, Monitor, or Block at every endpoint, sharing the Arkose Titan session infrastructure.
• Actionable intelligence: Turns threat data into dashboards and analytics, with real-time classification and triage of traffic.
• Managed support: Provides 24/7 global SOC support, real-time threat intelligence, and financial warranties against automated attacks.

CriterionSolution FitKey ConsiderationsDetection accuracy and bot coverage225+ risk signals plus the Global Intelligence Network detect evasive bot and human-driven attacks.Latency in synchronous events has been cited as an area to improve.Impact on user experience and frictionDifferentiates good users without friction and applies dynamic challenges only when risk is present.Interactive challenges add friction versus fully invisible approaches.Protection across web, mobile, and APIsProtects account flows and APIs across the user journey, with Arkose Edge for server-side API protection.Emphasis is on account security and fraud rather than general web traffic.Deployment, integration, and scalabilityRuns on Arkose Titan session infrastructure with flexible integration; AI agent governance added in one click.Setup can be complex and benefits from guided onboarding.Good bot and AI agent managementAgent Trust Manager classifies AI agents by intent and enforces Allow, Monitor, or Block.Agent governance is a separate module on the platform.Visibility, analytics, and managed operationsReal-time analytics and dashboards with 24/7 SOC support and financial warranties.Detailed monitor results can be hard to interpret without vendor support, and pricing suits larger budgets.

Source: Arkose

WAF and CDN-integrated bot management

5. Cloudflare Bot Management

Best for: Web-heavy traffic already on Cloudflare’s edge network

Strengths: Internet-scale ML detection built into the edge stack

Things to consider: Full behavioral features require the Enterprise tier

Cloudflare Bot Management uses machine learning and behavioral analysis across Cloudflare’s global network to detect and stop malicious bot traffic before it reaches an application. Its models are trained on the traffic of a large portion of the Internet, which it uses to generate a bot score for each request and to deploy protection against novel attacks quickly.

Because it is built into the Cloudflare stack alongside WAF, CDN, and rate limiting, mitigation happens at the edge with minimal added latency. It also includes Turnstile, a free CAPTCHA alternative.

Key features include:

• Network-scale ML detection: Trains models on a large share of Internet traffic to produce a bot score per request and deploy protection against novel attacks instantly.
• Turnstile challenge: Offers a free, privacy-preserving CAPTCHA alternative in place of traditional challenges.
• Edge mitigation: Runs on the same infrastructure powering a fifth of the Internet, so bot detection happens at the edge without adding latency for humans.
• Credential and API protection: Protects login endpoints from credential stuffing and secures APIs from scraping, resource abuse, and automated probing.
• eCommerce and UX use cases: Blocks inventory-hoarding bots and turns bot detection into a real-time UX and marketing-spend optimizer.
• Integrated stack: Combines with WAF, rate limiting, CDN, and DDoS protection under one platform, with automatic allowlists for verified bots.

CriterionSolution FitKey ConsiderationsDetection accuracy and bot coverageML models trained on a large share of Internet traffic produce a bot score per request and catch novel attacks.Advanced behavioral analysis is limited to the Enterprise tier.Impact on user experience and frictionTurnstile offers a free CAPTCHA alternative, and edge mitigation adds minimal latency.Occasional false positives require manual whitelisting.Protection across web, mobile, and APIsProtects login endpoints, APIs, and eCommerce flows, with mobile and API coverage.Some mitigation relies on customer-written rules.Deployment, integration, and scalabilityBuilt into Cloudflare’s stack with WAF, CDN, and rate limiting, running across a global network.The reverse-proxy model requires pointing DNS to Cloudflare.Good bot and AI agent managementVerified-bot handling and automatic allowlists with good-versus-bad bot control.AI-agent-specific governance is less detailed than some dedicated vendors.Visibility, analytics, and managed operationsAnalytics, bot scores, and logs.SIEM log export and stronger support are gated to higher tiers, and response times vary by plan.

Source: Cloudflare

6. Akamai Bot Manager

Best for: Global enterprises with high-traffic, edge-delivered apps

Strengths: Edge Bot Score detection with stealthy response actions

Things to consider: Add-on licensing, and tuning needs operational expertise

Akamai Bot Manager detects bot traffic and mitigates malicious bots at the edge while managing good bots, with visibility into more than 40 billion bots a day. It assigns a Bot Score from 0 (human) to 100 (bot) starting with the first request, and lets teams define response strategies across cautious, strict, and aggressive segments.

Detection combines AI models for user behavior analysis, browser fingerprinting, and a continuously updated known-bot directory, and the same detections extend to mobile apps. Bot Manager also integrates its insights into SIEM tools.

Key features include:

• Edge Bot Score detection: Assigns a 0–100 score from the first request using patented technologies and an AI framework, with tunable cautious, strict, and aggressive response segments.
• Advanced behavioral detection: Uses AI models for user behavior analysis and browser fingerprinting, drawing on intelligence from billions of bot requests and logins daily.
• Stealthy responses: Goes beyond block-and-allow with crypto and interstitial challenges that slow attacks without tipping off bots.
• Good bot management: Maintains a continuously updated known-bot directory and lets customers create custom categories for their own or partner bots.
• Mobile and API coverage: Extends the same detections to mobile apps and exposes functionality via APIs for DevSecOps workflows.
• Reporting and SIEM integration: Provides real-time reporting of trends and detailed bot traffic analysis, and integrates Bot Score insights into SIEM tools.

CriterionSolution FitKey ConsiderationsDetection accuracy and bot coverageEdge Bot Score from the first request using AI behavior models and fingerprinting, with visibility across 40B+ bots per day.Anomaly detection can be less effective against human-mimicking bots, and some scrapers from unknown origins or VPNs slip through.Impact on user experience and frictionStealthy responses avoid tipping off bots, and crypto and interstitial challenges limit user disruption.No built-in CAPTCHA, and tuning affects friction.Protection across web, mobile, and APIsThe same detections extend to mobile apps, and functionality is available via APIs.SDK and mobile integration has been flagged for improvement.Deployment, integration, and scalabilityDelivered at the Akamai edge with quick activation for existing customers and SIEM integration.Bot management is an add-on, and licensing can be hard to interpret.Good bot and AI agent managementMaintains a known-bot directory with good-bot policies and custom bot categories.AI-agent governance is less prominent than in newer platforms.Visibility, analytics, and managed operationsReal-time reporting and trend analysis with a response tuning simulator.Costly for smaller firms, tuning needs operational expertise, and support has drawn mixed feedback.

Source: Akamai

7. Imperva Advanced Bot Protection

Best for: Unified web, mobile, and API protection under one platform

Strengths: Multi-layered detection across 700+ dimensions with low false positives

Things to consider: Setup and full features can add cost and complexity

Imperva Advanced Bot Protection secures websites, mobile apps, and APIs from sophisticated bot attacks, including all OWASP automated threats. It uses a multi-layered approach that combines direct client interrogation, behavior analysis, machine learning, connection characteristics, and threat intelligence feeds, evaluating more than 700 dimensions to create a fingerprint that resists evasion.

Imperva emphasizes granular controls, explainable reporting, and full visibility rather than opaque risk scores, and it supports flexible deployment across cloud, connector, and on-premises models. Post-deployment feedback loops help minimize false positives and negatives.

Key features include:

• Multi-layered detection: Combines client interrogation, behavior analysis, ML, connection characteristics, and threat intelligence across 700+ dimensions to separate human, good, and bad bot traffic.
• Focus on efficacy: Uses rigorous testing against historical data and hundreds of browsers, plus feedback loops and metadata replay, to reduce false positives and negatives.
• Granular controls and reporting: Offers real-time monitoring, in-depth reporting, and customizable responses such as monitor, challenge, block, and rate-limit, tunable by path or application.
• Explainable, adaptive protection: Provides full visibility and granular tuning beyond risk scores, with real-time testing in production for confident policy creation.
• Broad surface coverage: Protects websites, mobile apps, and APIs against all OWASP automated threats.
• Flexible deployment: Supports single-stack Cloud WAF, connectors for AWS, Cloudflare, F5, NGINX, and Fastly, and on-premises WAF integration.

CriterionSolution FitKey ConsiderationsDetection accuracy and bot coverageMulti-layered detection across 700+ dimensions against OWASP automated threats, backed by feedback loops for accuracy.Can produce false positives or negatives that need tuning.Impact on user experience and frictionAims to block bad bots without CAPTCHAs, with low false positives on challenge responses.Effective tuning requires familiarity with the platform.Protection across web, mobile, and APIsProtects websites, mobile apps, and APIs under one platform.Full coverage is strongest within the broader Imperva stack.Deployment, integration, and scalabilityFlexible deployment via Cloud WAF single-stack, connectors for AWS, Cloudflare, F5, NGINX, and Fastly, or on-premises WAF.Initial setup and configuration can be complex and time-consuming.Good bot and AI agent managementDistinguishes human, good, and bad bot traffic with granular per-path policies.AI-agent-specific controls are less detailed than dedicated agent-trust tools.Visibility, analytics, and managed operationsExplainable reporting, customizable dashboards, real-time testing, and expert bot analysts.Advanced features can be add-ons that raise cost.

Source: Imperva

8. F5 Distributed Cloud Bot Defense

Best for: Agent-aware defense across hybrid and multi-cloud apps

Strengths: Behavioral and client-side telemetry with F5 platform fit

Things to consider: Interface and custom policies can lean on support

F5 Distributed Cloud Bot Defense protects web apps, mobile apps, and APIs by distinguishing humans, trusted AI agents, and harmful automation. It uses real-time behavioral analysis, client-side intelligence, and platform-wide telemetry to detect human-like bots at the application interaction layer, and it continuously adapts to attacker evolution without manual tuning.

Delivered on the F5 Application Delivery and Security Platform, it integrates natively across hybrid, multi-cloud, and on-premises environments with centralized visibility and control, and it feeds data into SIEM systems for threat analysis.

Key features include:

• Agent-aware classification: Separates humans, trusted agents, and malicious automation by behavior and intent rather than static signatures or identity claims.
• Behavioral and client-side detection: Uses real-time behavioral analysis and high-fidelity client-side telemetry to detect human-like bots and defeat evasion.
• Real-time enforcement: Applies allow, block, rate-limit, or step-up controls exactly where abuse occurs, with stricter controls only for low-trust interactions.
• Business logic protection: Defends login, checkout, account recovery, and APIs, detecting workflow abuse even when traffic looks human.
• Platform-native delivery: Runs on the F5 Application Delivery and Security Platform and BIG-IP, with unified policies and telemetry across hybrid, multi-cloud, and on-premises environments.
• Integrations: Deploys close to public cloud workloads via VMs or containers and integrates with Syslog and leading SIEM systems.

CriterionSolution FitKey ConsiderationsDetection accuracy and bot coverageReal-time behavioral analysis and client-side telemetry detect human-like bots beyond signatures, with agent-aware classification.Less precise tuning has been linked to false positives in some deployments.Impact on user experience and frictionApplies controls only to low-trust interactions, avoiding blanket CAPTCHAs.Configuration changes can require support or scheduled windows.Protection across web, mobile, and APIsProtects web apps, mobile apps, and APIs, including business-logic flows.Depth of coverage is strongest within the F5 platform.Deployment, integration, and scalabilityNative to the F5 Application Delivery and Security Platform and BIG-IP, deployable across hybrid, multi-cloud, and on-premises with SIEM integration.Custom policy creation can depend on F5 support.Good bot and AI agent managementIdentifies and controls AI agents by behavior and intent, enabling trusted agentic commerce.Good-bot allowlisting is less directory-driven than some CDN vendors.Visibility, analytics, and managed operationsCentralized visibility and telemetry across the F5 platform, with SIEM data sharing.The interface has been described as dated and text-heavy.

Source: F5

Conclusion

Choosing a bot management vendor is ultimately about finding the right balance between security, user experience, operational effort, and long-term flexibility. The strongest solutions consistently detect sophisticated automated attacks across web, mobile, and API environments while minimizing false positives and unnecessary friction for legitimate users. By evaluating vendors against consistent criteria such as detection accuracy, deployment model, good bot governance, analytics, and scalability, organizations can select a platform that protects critical business workflows today and adapts as attacker techniques and AI-driven automation continue to evolve.

‍

TL;DR: AI gateway solutions with real-time threat detection inspect AI, agent, and API traffic to block attacks as they happen. Best for agentic AI governance: Cequence; best for end-to-end AI security: Prisma AIRS; best for edge enforcement: Cloudflare.

What Are AI Gateway Solutions?

An AI Gateway with real-time threat detection acts as a smart traffic cop for all interactions between your apps and AI models. It intercepts prompts and model responses to instantly block malicious attacks, enforce security rules, and track data usage.

AI gateway solutions manage, secure, and monitor all interactions with AI models, providing a unified entry point for requests and responses. By abstracting the underlying complexity of multiple AI models, APIs, and tools, AI gateways help organizations maintain consistent access policies, control usage, and enforce security across all AI-powered systems.

In this article:

• What Is AI Gateway Threat Detection?
• AI Gateway Threat Detection Solutions at a Glance
• AI Threats an AI Gateway Should Detect
• Key AI Gateway Real-time Threat Detection Capabilities
• Notable AI Gateway Threat Detection Solutions

What Is AI Gateway Threat Detection?

AI gateway threat detection refers to the processes and tools within an AI gateway that identify and mitigate security risks associated with AI model interactions. These threats can range from prompt injection attacks to unauthorized data access and model abuse. Threat detection systems continuously monitor incoming and outgoing traffic, analyzing prompts, responses, and API calls for signs of malicious intent or policy violations.

Effective AI gateway threat detection leverages a combination of:

• Rule-based heuristics
• Machine learning
• Anomaly detection

This enables real-time identification of suspicious activities and rapid response to emerging attack vectors. By acting as a security checkpoint, the AI gateway helps prevent attacks from reaching underlying models and sensitive backend systems, reducing the risk of data leaks, unauthorized actions, and operational disruptions.

Related content: Read our guide on how LLM gateways work

AI Gateway Threat Detection Solutions at a Glance

The table below summarizes the key differences between the solutions covered in this guide. We explore each one in more detail in the sections that follow.

CategorySolutionBest ForKey StrengthsThings to ConsiderPurpose-built AI security and runtime threat detectionCequence AI GatewayGoverning agentic AI access to enterprise apps and APIsAgent personas, inline DLP, behavioral containment, audit trailsDashboard and policy workflows are maturing; AI Gateway is a newer module expanding quicklyPurpose-built AI security and runtime threat detectionPalo Alto Networks Prisma AIRSEnd-to-end AI security across the AI lifecycleRuntime protection, model scanning, red teaming, AI-SPMExpensive with complex licensing; full value requires deep investment in the Palo Alto ecosystemPurpose-built AI security and runtime threat detectionCisco AI DefenseSecuring AI at build time and runtime at the network layerNetwork guardrails, red teaming, supply chain scanningDifficult to configure; strongest value limited to organizations with an existing Cisco network footprintPurpose-built AI security and runtime threat detectionWitnessAIGoverning employee and agent AI use at the network levelIntent-based detection, agent tool governance, discoveryUnproven at scale; effectively limited to enterprise-scale deploymentsPurpose-built AI security and runtime threat detectionHiddenLayer AISec PlatformSecuring AI models and agentsModel scanning, runtime detection and response, red teamingDelivers limited value unless adopted as a full end-to-end platformAI gateways and inline guardrail layersCloudflare AI Security for AppsDetecting and blocking LLM threats at the network edgeEndpoint discovery, prompt and PII detection, WAF rulesCore detection is locked behind the Enterprise plan and remains an unfinished betaAI gateways and inline guardrail layersKong AI GatewayGoverning LLM, MCP, and agent-to-agent trafficPrompt guards, PII sanitization, token quotas, A2A controlSteep learning curve, and the guardrails that matter most sit behind the Enterprise tierAI gateways and inline guardrail layersF5 AI GuardrailsRuntime guardrails for prompt injection and data leakageLarge threat library, agent guardrails, flexible deploymentPrompt injection detection works in English only, leaving other languages unprotected

AI Threats an AI Gateway Should Detect

1. Prompt Injection

Prompt injection is a technique where attackers manipulate input prompts to influence or subvert the behavior of AI models. By carefully crafting prompts, attackers can bypass restrictions, extract confidential data, or cause the model to perform unintended actions. This threat is particularly dangerous in systems where prompts are dynamically constructed from user input, as it opens avenues for indirect exploitation.

How AI gateways help:

To counter prompt injection, AI gateways need mechanisms to validate and sanitize inputs before they reach the model. This includes pattern recognition to detect suspicious language or structures, as well as context-aware filtering to block potentially harmful content. Continuous monitoring and updating of detection rules are essential, as attackers frequently evolve their techniques to bypass static defenses.

2. Sensitive Data Exposure

Sensitive data exposure occurs when AI models inadvertently reveal confidential or personally identifiable information (PII) in their responses. This can happen due to poorly designed prompts, model training on sensitive datasets, or unintentional leaks during interactions. The risk is amplified when models have access to internal databases or organizational knowledge bases.

How AI gateways help:

AI gateways mitigate this threat by implementing data loss prevention (DLP) filters and response inspection policies. These tools scan both prompts and outputs for sensitive patterns, such as credit card numbers, personal identifiers, or proprietary information. By blocking or redacting unsafe responses in real-time, the gateway acts as a safeguard against accidental or malicious data leaks.

3. Malicious or Unauthorized Tool Calls

AI systems are increasingly integrated with external tools and APIs to perform actions beyond basic text generation. Attackers may exploit these integrations by crafting prompts that trigger unauthorized or malicious tool calls, potentially leading to data modification, system compromise, or unintended transactions. The complexity of these interactions makes them challenging to secure using traditional methods.

How AI gateways help:

To address this risk, AI gateways enforce strict access controls and validation for tool-initiated actions. They monitor all outbound calls, verifying that each request aligns with user permissions and organizational policies. By maintaining an auditable log of tool interactions, gateways also support incident response and forensic analysis in the event of suspicious activity.

4. Model and API Abuse

Model and API abuse involves exploiting the underlying AI infrastructure to perform resource-intensive operations, bypass usage quotas, or harvest model outputs at scale. Common abuse scenarios include automated scraping, denial-of-service attacks, and attempts to reverse-engineer proprietary models through repeated querying. Such abuse can degrade service quality, increase costs, and expose intellectual property.

How AI gateways help:

AI gateways defend against abuse by implementing rate limiting, authentication, and anomaly detection. These controls restrict the frequency and volume of requests, flag suspicious patterns, and block abusive clients in real time. Continuous monitoring ensures that legitimate usage is not disrupted while preventing attackers from exploiting system resources or extracting sensitive model behavior.

Related content: Read our article about API security

5. Data Poisoning and Retrieval Attacks

Data poisoning occurs when attackers inject malicious data into the training or operational datasets of AI models, aiming to corrupt their behavior or induce specific failures. Retrieval attacks, on the other hand, involve crafting queries that force the model to reveal memorized training data, including confidential or proprietary information. Both threats undermine model integrity and trust.

How AI gateways help:

AI gateways aid in detecting and blocking anomalous data submissions or retrieval attempts. They employ heuristics, content filtering, and statistical analysis to flag suspicious inputs or outputs. By isolating and alerting on potential poisoning or leakage events, gateways help maintain model reliability and prevent exploitation through data manipulation.

6. Agent Identity and Authorization Abuse

In multi-agent systems, attackers may attempt to spoof agent identities or escalate privileges to access restricted resources. Abuse of agent identity and authorization can lead to unauthorized actions, data breaches, or manipulation of business workflows. This risk is exacerbated in environments where agents interact with numerous services and data sources.

How AI gateways help:

AI gateways enforce identity verification and granular authorization checks for every agent interaction. They track agent sessions, validate credentials, and ensure that actions are performed only by authorized entities. Comprehensive logging and auditing capabilities further support the detection and investigation of identity-based attacks, strengthening the overall security posture.

Key AI Gateway Real-time Threat Detection Capabilities

AI gateways need to evaluate agent, model, tool, and API activity as it occurs rather than relying only on post-event logs. Effective real-time detection combines behavioral analysis, identity context, sensitive data inspection, and inline policy enforcement to identify both malicious attacks and legitimate agents that begin acting outside their intended roles:

• Continuous agent behavior monitoring: Tracks agent actions across complete sessions, including prompts, tool calls, API requests, accessed applications, and returned data. This helps detect sudden changes in behavior that may indicate manipulation, compromise, or an agent becoming stuck in an uncontrolled loop.
• Persona and policy deviation detection: Compares each action against the agent’s assigned role, approved tools, permissions, and expected workflows. The gateway can flag attempts to access unauthorized systems, perform actions outside the agent’s job description, or exceed established operational boundaries.
• Abnormal tool-call detection: Identifies unusual tool usage patterns, such as excessive retries, rapid call sequences, fabricated parameters, repeated access failures, unexpected write attempts, or millions of automated requests generated by a malfunctioning agent. Behavioral detection is important because valid credentials alone do not prove that an action is legitimate.
• Prompt and tool manipulation detection: Inspects requests and agent behavior for signs of prompt injection, indirect prompt injection, malicious tool instructions, parameter tampering, and attempts to override system policies. Detection should cover both direct user prompts and untrusted content retrieved from external applications or data sources.
• API attack and business logic abuse detection: Analyzes how agents interact with APIs to identify credential stuffing, data scraping, enumeration, account takeover attempts, transaction abuse, and misuse of legitimate application workflows. This allows organizations to detect threats that may not match traditional vulnerability signatures.
• Automated bot and AI-driven traffic analysis: Uses behavioral signals to distinguish legitimate users and approved agents from malicious bots, unauthorized AI crawlers, and AI-enhanced automation. Detection should remain effective even when traffic uses generic user agents, rotating infrastructure, valid accounts, or other techniques designed to evade static controls.
• Sensitive data exposure detection: Scans agent requests, tool parameters, API responses, and model outputs for personally identifiable information, credentials, financial records, proprietary data, and other sensitive content. The gateway can alert, redact, or block transactions before protected data leaves an authorized environment.
• Identity-aware risk analysis: Correlates activity with the authenticated user, agent identity, service account, OAuth token, assigned persona, and requested resource. This context helps distinguish normal operations from credential misuse, excessive privilege, token abuse, or unauthorized agent access.
• Rate and volume anomaly detection: Detects unexpected increases in requests, token use, tool invocations, failed actions, or data retrieval. Per-agent, per-persona, and per-tool baselines can expose denial-of-wallet attacks, runaway workflows, resource exhaustion, and attempts to overwhelm downstream applications.

Notable AI Gateway Threat Detection Solutions

How we selected these solutions: We shortlisted AI gateway and AI security platforms based on their ability to detect and respond to AI threats in real time, including prompt injection, sensitive data exposure, tool and API abuse, model attacks, and rogue agent behavior.

Purpose-Built AI Security and Runtime Threat Detection Platforms

1. Cequence AI Gateway

Best for: Governing agentic AI access to enterprise apps and APIs

Strengths: Agent personas, inline DLP, behavioral containment, audit trails

Things to consider: Dashboard and policy workflows still maturing; AI Gateway is a newer module expanding quickly

Cequence AI Gateway sits between AI agents and enterprise applications and governs what each agent is allowed to do. It authenticates an agent and then verifies every subsequent action, enforcing policy inline in the request path for the full session and on every tool call. Actions are judged on both identity and behavior, so an agent that holds valid credentials is still stopped when it acts outside its assigned role.

The gateway converts existing internal, external, and SaaS APIs into Model Context Protocol (MCP) compatible tools and exposes them through trusted registries of vetted MCP servers, APIs, and skills. Detection begins at the first action rather than after a warm-up period, which is aimed at containing agents that begin behaving abnormally.

Key features include:

• Agent Personas: A plain-English job description generates a tailored persona that limits an agent to only the tools, APIs, skills, and permissions it needs, applying least-privilege boundaries automatically.
• Agentic zero trust enforcement: The gateway authenticates agents against OAuth 2.1 identity providers, manages token lifecycles, and binds sessions to their originating IP address to prevent token theft and reuse.
• Sensitive data protection: DLP scanning inspects agent requests and MCP server responses across more than 100 detection types, and can monitor, redact, or block sensitive data across a sequence of tool calls, with integration into existing DLP infrastructure.
• Automated tool risk scoring and rate limiting: Built-in guardrails score tool risk and rate-limit activity to constrain agent behavior at runtime.
• AI discovery: The platform surfaces sanctioned and shadow AI, identifying agents, MCP servers, and LLM providers across the enterprise from existing SIEM logs.
• Monitoring and audit trails: Real-time visibility into AI-to-tool traffic records user, agent, and tool behavior and which applications and API calls each agent uses, with findings exportable to SIEM and SOC workflows.

Limitations (as reported by users on Gartner Peer Insights):

• Console responsiveness: A subset of users have asked for a faster dashboard and more intuitive policy management, feedback the team is actively building into the roadmap.
• Modular packaging: Capabilities are organized into modules, so procurement teams get the most value by mapping out desired functionality up front.
• Newer AI Gateway offering: The AI Gateway is one of the platform’s newest modules, with new capabilities shipping frequently.

2. Palo Alto Networks Prisma AIRS

Best for: End-to-end AI security across the full AI lifecycle

Strengths: Runtime protection, model scanning, red teaming, AI-SPM

Things to consider: Expensive with complex licensing; full value requires deep investment in the Palo Alto ecosystem

Prisma AIRS is a centralized platform that secures AI agents, applications, models, and data from development through deployment. It groups its work into three functions: discovering shadow AI across the environment, assessing new risks through continuous testing, and protecting AI interactions against runtime threats. The platform includes an AI Gateway control plane that discovers, governs, and secures enterprise AI activity from a single point.

At runtime, Prisma AIRS monitors AI behavior and enforces controls to prevent manipulation, data exposure, and unsafe actions during live interactions. It also verifies agent identity and applies real-time security to stop unauthorized agent actions as deployments scale.

Key features include:

• AI Runtime Security: Monitors live AI interactions and applies safeguards against prompt injection, sensitive data leakage, unsafe output, and model denial-of-service attacks.
• Agent Security: Verifies every agent identity and enforces real-time controls to block unauthorized actions across the agent ecosystem.
• AI Model Security: Scans third-party models for tampering, malicious scripts, and deserialization attacks before adoption.
• AI Red Teaming: Simulates real-world attacks, including multi-turn and multi-agent attacks, to identify weaknesses in AI applications and agents before runtime.
• AI Posture Management: Provides visibility and control over AI training and inference data, the integrity of agents and apps, and access to deployed models.
• Shadow AI discovery: Builds a full inventory of AI agents, apps, and models and maps how they connect across the environment.

Limitations (as reported by users on Gartner Peer Insights):

• Cost and licensing: Reviewers consistently describe it as expensive, with licensing complexity that puts it out of reach for many smaller organizations.
• Ecosystem dependence: Organizations outside the broader Palo Alto Networks ecosystem see meaningfully diminished value, tying the platform’s strongest capabilities to a larger vendor commitment.
• Feature maturity: Rapid product iteration leaves some capabilities still maturing, and buyers report having to independently verify that components assembled from multiple acquisitions actually work together as one platform.
• Throughput and residency: Public analysis notes the runtime network intercept is constrained by a per-vCPU transaction ceiling and routes traffic to the US region regardless of where an organization operates, a real limitation for high-volume or data-residency-sensitive deployments.

Source: Palo Alto Networks

3. Cisco AI Defense

Best for: Securing AI at build time and runtime at the network layer

Strengths: Network guardrails, red teaming, supply chain scanning

Things to consider: Difficult to configure; strongest value limited to organizations with an existing Cisco network footprint

Cisco AI Defense secures AI whether an organization is using third-party AI applications or building its own. It works across three functions: discovering AI assets and users across distributed cloud environments, detecting vulnerabilities through algorithmic testing, and protecting production applications with runtime guardrails. Enforcement happens at the network level without agents or libraries, which separates AI development from security operations.

The platform extends to agentic systems and MCP, scanning MCP servers for malicious assets and inspecting agent actions and tool calls in real time. It detects agent-specific threats such as memory poisoning, tool misuse, privilege escalation, and intent hijacking, and aligns detections to standards including NIST, MITRE ATLAS, and the OWASP LLM Top 10.

Key features include:

• AI Runtime Protection: Guardrails embedded in the network block adversarial attacks and harmful responses in real time, including prompt injection, denial of service, and data leakage.
• AI Model and Application Validation: Algorithmic red teaming identifies safety and security vulnerabilities across models in seconds rather than through weeks of manual testing.
• AI Cloud Visibility: Automatically inventories AI models, applications, data sources, MCP servers, and agent processes across distributed environments.
• AI Supply Chain Risk Management: Scans model files, repositories, and MCP servers for malicious code, poisoned data, and unsafe tools before they enter production.
• AI Access: Monitors and manages access to third-party AI applications and enforces policies that limit sensitive data exposure.
• Threat intelligence integration: Detections draw on Cisco’s AI research lab and Talos threat intelligence, with instant platform updates for emerging attacks.

Limitations (as reported by users on Gartner Peer Insights):

• Documentation clarity: Reviewers frequently describe the documentation as hard to follow, slowing teams down as they learn to use features correctly.
• Feature complexity: Certain capabilities are powerful on paper but difficult to configure and operate correctly in practice.
• Licensing structure: Reviewers of Cisco products describe the licensing as complex, with additional licenses required to unlock functionality that buyers often expect to be included.

Source: Cisco

4. WitnessAI

Best for: Governing employee and agent AI use at the network level

Strengths: Intent-based detection, agent tool governance, discovery

Things to consider: Unproven at scale; effectively limited to enterprise-scale deployments

WitnessAI operates at the network layer between users and AI models, intercepting and analyzing AI interactions without endpoint agents or browser extensions. It organizes its work into Observe, Protect, Control, and Attack functions that cover discovery, runtime defense, governance, and red teaming across both human employees and AI agents. Because it sits on the network path, it covers native applications such as Windows Copilot and Office 365 that endpoint-only tools can miss.

Its detection engine classifies the intent behind each prompt rather than matching keywords, which is aimed at catching multi-turn attacks and advanced prompt injection. The platform extends monitoring to agent interactions through MCP, tracking which servers agents connect to and which tools they invoke.

Key features include:

• Runtime AI defense: Bidirectional protection blocks threats such as prompt injection before they reach models and agents, and filters harmful outputs before they reach users or trigger actions.
• Intent-based classification: Machine learning models analyze conversations and context to detect suspicious behavior that evolves across sessions.
• Agent tool-access governance: An organization-wide approved-tool list of MCP servers and tools is enforced at the network for every agent, and each blocked tool call generates an audit record with user, agent, tool, and rule.
• AI discovery and cataloging: The platform scans the network against a catalog of thousands of AI applications to reveal which tools employees use, which agents are running, and associated AI spend.
• Guardrails and data protection: Integrated controls tokenize sensitive information, defend models against manipulation, and enforce rules of engagement for autonomous agents.
• Intelligent routing: AI requests are routed by risk, cost, and purpose, sending sensitive queries to secure internal models.

Limitations (based on publicly available sources):

• Limited review base: The platform is relatively unproven, with a thin base of verified reviews and users reporting rough edges a more established product would likely have resolved.
• Integration effort: Public sources cite integration timelines that regularly run longer than expected, adding real deployment risk.
• Catalog dependence: Network-level discovery is limited to a tracked catalog of supported AI applications, so anything outside that catalog demands extra configuration work, and unpublished pricing makes it harder to evaluate against alternatives.

Source: WitnessAI

5. HiddenLayer AISec Platform

Best for: Securing AI models and agents across the lifecycle

Strengths: Model scanning, runtime detection and response, red teaming

Things to consider: Delivers limited value unless adopted as a full end-to-end platform

HiddenLayer’s AISec Platform secures AI models, pipelines, and agentic systems across their lifecycle. It combines four areas of work: discovery of AI assets, supply chain security through model validation, runtime detection and response, and continuous attack simulation. The platform is model-agnostic and agentless, operating on model artifacts and inference behavior without requiring access to model weights, training data, or prompts.

It builds a living inventory of AI across an environment, including shadow AI, and scans models for malware, backdoors, and vulnerable dependencies before they reach production. In production, it detects and responds to AI attacks such as prompt manipulation, model extraction, unauthorized tool usage, and data leakage.

Key features include:

• AI Runtime Security: Detects and responds to attacks against models and agents in production without accessing sensitive data or proprietary models.
• Model scanning: Analyzes models across many formats for malicious code, backdoors, tampering, and unknown components before deployment.
• AI attack simulation: Continuously runs adversarial simulations to surface weaknesses in AI systems before attackers reach them.
• Agentic and MCP security: Protects autonomous agents and MCP-based systems from prompt injection, unsafe tool use, and harmful autonomous actions.
• Model genealogy and AIBOM: Tracks how a model was trained, fine-tuned, and modified over time and generates an AI Bill of Materials for supply chain audits.
• Posture and integrations: Provides organization-wide governance and posture management with connectors for cloud, CI/CD, SIEM/SOAR, API gateways, and MLOps tools.

Limitations (based on publicly available sources):

• Platform-level value: Independent analysis notes the value proposition depends on adopting the combined platform; purchased piecemeal, individual capabilities are difficult to distinguish from point solutions already on the market.
• Scale dependency: Meaningful return only materializes once models are running in production at real scale, leaving little payoff for experimental or single-application footprints.
• Model-centric focus: Because the platform works on model artifacts and inference behavior rather than acting as an inline network gateway, it cannot stand alone and must be paired with other controls to close the gap.

Source: HiddenLayer

6. Cloudflare AI Security for Apps

Best for: Detecting and blocking LLM threats at the network edge

Strengths: Endpoint discovery, prompt and PII detection, WAF rules

Things to consider: Core detection is locked behind the Enterprise plan and remains an unfinished beta

Cloudflare AI Security for Apps, part of the Firewall for AI product, sits in front of LLM-powered applications as part of Cloudflare’s reverse proxy and analyzes traffic at the network edge. It is model-agnostic and works whether an application uses a third-party model such as OpenAI or Gemini, a self-hosted model, or a custom build, applying consistent protections across all of them. It supports the standard request formats used by several providers and applies a default-secure posture when a pattern is unknown.

The service detects and mitigates threats including prompt injection, sensitive information disclosure, and unbounded consumption. It also discovers LLM-powered endpoints across an organization’s web properties, a capability available on all Cloudflare plans.

Key features include:

• Automatic LLM endpoint discovery: Identifies LLM-powered endpoints across web properties regardless of where they are hosted or which model is used, surfacing shadow AI.
• Prompt injection detection: Scores incoming prompts for injection attempts on a spectrum, writing the result to a field that can drive WAF and rate-limiting rules.
• Customizable threat detection: Custom topics let teams define categories, inspect prompts, and output a relevance score used to log, block, or handle requests.
• WAF rule builder mitigation: Detection fields plug into the familiar WAF rule builder so teams can block or challenge unauthorized actions and leaked sensitive data.
• Broad model support: Out-of-the-box support for OpenAI, Anthropic, Google Gemini, Mistral, Cohere, xAI, and DeepSeek formats.
• Unified posture visibility: Discovered endpoints are reviewable in one place, with a Wiz partnership adding a wider security posture view.

Limitations (based on publicly available sources):

• Plan gating: The prompt injection detection field requires a Cloudflare Enterprise plan with Firewall for AI enabled, putting the core protection behind the highest, priciest tier.
• Beta maturity: Core capabilities remain in beta rather than generally available, with model response handling and additional safety categories still only on the roadmap.
• Coverage constraints: Detection currently handles only JSON content-type requests and only works when the WAF is enabled with traffic proxied through Cloudflare, leaving other formats and architectures unprotected.

Source: Cloudflare

7. Kong AI Gateway

Best for: Governing LLM, MCP, and agent-to-agent traffic centrally

Strengths: Prompt guards, PII sanitization, token quotas, A2A control

Things to consider: Steep learning curve, and the guardrails that matter most sit behind the Enterprise tier

Kong AI Gateway governs generative and agentic AI traffic through a single gateway that covers LLM, MCP, and agent-to-agent (A2A) connectivity. Because all model traffic flows through it, the gateway acts as a single control point that sees prompts, responses, the identity behind each call, and the guardrail verdicts applied to each request. It provides a unified API interface so teams can work with multiple AI providers and switch between them.

For MCP, the gateway can generate MCP servers on top of Kong-managed APIs and govern how agents discover and consume them, enforcing authentication for server access. For multi-agent systems, it observes A2A traffic and captures telemetry on every call.

Key features include:

• LLM policy enforcement: Applies PII sanitization to stop data leakage, along with semantic prompt guards and access control to protect resources and enforce compliance.
• MCP governance: Generates MCP servers and tools, enforces authentication for server access, and optimizes context and token spend.
• Agent-to-agent governance: Observes A2A traffic, captures telemetry including payloads, latency, token usage, and errors, and enforces centralized authentication and authorization with per-call audit records.
• AI quota management: Sets user, model, and time-bound quotas on consumption and token spend, with showback and chargeback across the enterprise.
• AI observability: Provides Layer 7 observability on AI traffic, tracking consumption, tool usage, and token spend with logging and tracing.
• Multi-LLM support: A unified API interface routes across multiple providers and supports failover between them.

Limitations (as reported by users on G2):

• Learning curve: Users consistently report a steep learning curve for advanced features and custom plugins, a real obstacle for teams new to API gateways.
• Enterprise-gated security: Core AI security capabilities, including prompt guard, PII sanitization, and content safety, are withheld from every tier below Enterprise or Konnect.
• Documentation and setup: Reviewers cite real documentation gaps for complex configurations, compounded by setup complexity and enterprise pricing that puts the platform out of reach for smaller teams.

Source: Kong

8. F5 AI Guardrails

Best for: Runtime guardrails for prompt injection and data leakage

Strengths: Large threat library, agent guardrails, flexible deployment

Things to consider: Prompt injection detection works in English only, leaving other languages unprotected

F5 AI Guardrails provides runtime security for AI models, applications, and agents, inspecting prompts and responses to detect and act on threats. It is model-agnostic and enforces consistent policy across public and proprietary models, with deployment across public cloud, private cloud, and on-premises or fully air-gapped environments. Its protection draws on an AI threat library that adds attack patterns monthly, maintained by F5 Labs threat research.

The product defends against prompt injection, data exfiltration, and jailbreak attacks, and enforces controls on model and agent privileges. It logs every enforcement action with the reasoning behind it, and can export metrics and enforcement data to a third-party SIEM.

Key features include:

• Prompt injection defense: Protects against prompt injection, data exfiltration, and jailbreak attacks, backed by a threat library of more than 10,000 attack patterns updated monthly.
• Secure agentic AI: Prevents excessive agency and privilege escalation and audits and blocks unauthorized tool calls and agent actions.
• Semantic data security: Detects and prevents leakage of standard and custom sensitive data categories during AI interactions.
• Custom policy creation: Lets teams build bespoke, policy-driven controls through a natural language interface, with day-one templates for PII, EU AI Act, PCI, and PHI.
• Agent visibility and logging: Records system prompts, instructions, model reasoning, and tool calls for single- and multi-agent systems with audit-ready traceability.
• Flexible deployment: Applies the same guardrails across AWS, Azure, and Google Cloud, private cloud, and air-gapped environments for any similarly formatted AI model or agent.

Limitations (based on publicly available sources):

• Language coverage: F5’s prompt injection processor supports English-language prompts only; injection attempts crafted in any other language pass through undetected unless a customer separately configures upstream language filtering.
• Platform context: AI Guardrails covers only one piece of the AI lifecycle; full coverage requires adopting additional F5 components beyond what’s included here.
• Operational setup: Deployment requires Kubernetes and Helm charts, adding real configuration overhead for teams provisioning the processors.

Source: F5

Conclusion

AI gateway solutions have become a foundational security control for organizations deploying AI applications, agents, and large language models in production. By inspecting prompts, responses, tool calls, and API interactions in real time, they help prevent prompt injection, data leakage, unauthorized actions, model abuse, and other emerging AI threats before they reach critical systems. As AI ecosystems continue to expand across employees, applications, and autonomous agents, organizations should prioritize gateways that combine identity-aware policy enforcement, behavioral analysis, inline protection, and comprehensive monitoring to provide consistent governance and security across the entire AI environment.

‍

TL;DR: AI gateways sit between your applications, agents, and the models or systems they call, adding routing, security, cost control, and observability. Best for security-first agentic AI governance: Cequence AI Gateway. Best for API-native governance: Kong. Best all-round LLMOps: Portkey. Best open-source router: LiteLLM.

What Are AI Gateway Vendors?

AI gateway vendors provide software solutions that act as intermediaries between enterprise applications and AI model providers, such as OpenAI, Anthropic, or Google. These platforms offer a unified API that enables organizations to interact with multiple AI models through a single integration point.

To choose the right AI gateway vendor, evaluate your infrastructure stack, performance needs, compliance rules, and caching features. Start by assessing your current tools and team capabilities to dictate whether you need a quick managed service, an open-source solution, or deep Kubernetes and edge infrastructure.

Key evaluation criteria:

Use these five dimensions to compare any AI gateway against your own requirements:

• Model, provider, and protocol coverage: what models, providers, tools, and protocols (such as MCP and A2A) the gateway can connect to, and how easily you can add or switch them.
• Security, access control, and governance: authentication, authorization, data protection, guardrails, audit trails, and compliance.
• Cost management and observability: usage and cost tracking, budgets and quotas, logging, tracing, and analytics.
• Deployment and scalability: SaaS, self-hosted, VPC, on-prem, or air-gapped options, plus latency, throughput, and availability.
• Integration and extensibility: migration effort, fit with your existing stack, and how far you can customize behavior.

Solutions compared in this guide:

• API security and management platforms with AI gateway capabilities
  • Cequence AI Gateway
  • Kong AI Gateway
  • Zuplo
  • Solo.io Gloo AI Gateway
  • F5 AI Gateway
• AI-native gateway and LLMOps platforms
  • Portkey
  • TrueFoundry AI Gateway
  • Helicone AI Gateway
  • Lunar.dev
• Developer-first and open-source LLM routers
  • LiteLLM
  • OpenRouter
  • Vercel AI Gateway
  • Cloudflare AI Gateway
  • Maxim AI (Bifrost)

In this article:

• When Should You Use an AI Gateway Vendor?
• How to Choose an AI Gateway Vendor
• Common AI Gateway Solutions and How They Meet the Criteria
• Notable AI Gateway Solutions

When Should You Use an AI Gateway Vendor?

You Use Multiple AI Model Providers

Organizations often experiment with or deploy models from different providers to meet varying requirements for cost, accuracy, or compliance. Directly integrating with each provider creates overhead in managing distinct APIs, credentials, and model behaviors. An AI gateway vendor abstracts these differences, offering a single API surface while handling provider-specific nuances behind the scenes. This allows development teams to switch providers or models without major code changes or disruptions to production systems.

Using multiple AI model providers also raises challenges in monitoring, cost tracking, and policy enforcement. An AI gateway consolidates usage data and provides unified analytics, enabling organizations to track costs, allocate spending, and enforce quotas across all providers. This centralization helps avoid vendor lock-in, supports A/B testing of models, and ensures business continuity if a provider experiences downtime or changes its offerings.

Teams Are Building AI Applications Independently

In large organizations, different teams may develop AI applications independently, each adopting their own approach to integrating with model providers. This can lead to inconsistent security practices, duplicated effort, and fragmented governance. An AI gateway vendor imposes a common integration layer, ensuring that all teams benefit from standardized authentication, logging, and monitoring. It also allows IT and security teams to set global policies and audit all AI usage from a central dashboard.

Standardization through an AI gateway reduces operational risk and accelerates onboarding for new projects. Teams can focus on application logic rather than infrastructure, while platform teams retain control over which models are accessible, how data is handled, and what compliance measures are in place. This structure is essential for scaling AI adoption across business units without sacrificing security or oversight.

AI Agents Can Access Enterprise Systems

AI agents with access to enterprise systems (such as databases, CRMs, or internal APIs) introduce new risks around data leakage, privilege escalation, and unauthorized actions. An AI gateway vendor provides granular access controls and audit trails that are tailored for AI-driven interactions. By mediating requests between AI agents and sensitive resources, the gateway can enforce policies, mask confidential data, and log all actions for compliance review.

Enterprises can configure the gateway to restrict which data fields or system functions are exposed to AI agents, preventing accidental or malicious misuse. This is especially important when integrating generative AI models, which may unpredictably use or output sensitive information. AI gateways enable organizations to confidently extend AI capabilities while maintaining strong safeguards over critical systems and data.

Sensitive Data Is Included in AI Requests

Many AI use cases require processing sensitive or regulated data, such as personal information, financial records, or intellectual property. Sending such data directly to external model providers can violate compliance requirements or increase exposure risk. AI gateway vendors offer built-in data protection mechanisms, such as redaction, encryption, or tokenization, that operate before data leaves the organization. These controls help ensure that only necessary information is shared with the AI model and that sensitive elements remain protected.

Gateways also provide detailed logging and policy enforcement, enabling organizations to demonstrate compliance with data privacy regulations like GDPR or HIPAA. They can restrict which data types are allowed in requests, automatically flag or block violations, and generate reports for audits. This centralized approach is critical for industries with strict data governance needs or where AI adoption depends on robust security assurances.

Related content: Read our guide to sensitive information disclosure and how to defend against it.

Existing API Gateways Lack AI-Specific Controls

Traditional API gateways are designed for generic web services, not the unique requirements of AI workloads. They often lack features needed for managing model selection, prompt inspection, or usage metering at the level required by AI governance frameworks. AI gateway vendors address these gaps with capabilities such as prompt filtering, response validation, model version management, and real-time usage analytics tailored to AI APIs.

By complementing or integrating with existing API gateways, AI-specific gateways provide the necessary granularity for controlling and monitoring AI interactions. This includes features like blocking unsafe prompts, enforcing model-specific access, or setting usage limits based on business rules. Adopting an AI gateway ensures that organizations can safely scale AI usage without compromising on oversight, compliance, or operational efficiency.

Related content: Read our guide to API security.

How to Choose an AI Gateway Vendor

1. Model, Provider, and Protocol Coverage

An AI gateway sits between your applications and agents and the models or systems they call, so the first thing to establish is what it can actually connect to. Some gateways focus on routing requests across many LLM providers through one unified API. Others focus on connecting agents to enterprise APIs, tools, and data using protocols such as the Model Context Protocol (MCP) and agent-to-agent (A2A) communication. The breadth of models, providers, and protocols a gateway supports determines how much integration work you avoid and how easily you can switch or combine systems later.

Evaluation criteria:

• Does it expose a single, OpenAI-compatible (or similar) API across multiple model providers?
• How many models and providers does it support, and can you add new ones through configuration rather than code?
• Does it support MCP, A2A, or tool and agent connectivity, not just raw LLM calls?
• Can it route to self-hosted or open-source models alongside hosted providers?

2. Security, Access Control, and Governance

Because a gateway becomes the single point through which AI traffic and credentials flow, its security and governance controls carry a lot of weight. This dimension covers how the gateway authenticates and authorizes users, agents, and applications, how it protects sensitive data in prompts and responses, and how it enforces organizational policy. For teams exposing internal systems to autonomous agents, controls such as least-privilege access, guardrails, and audit trails move from nice-to-have to mandatory.

Evaluation criteria:

• Does it integrate with your identity provider (OAuth/OIDC, SSO, SCIM) and support role-based access control?
• Can it detect, redact, or block sensitive data such as PII and enforce guardrails against prompt injection or unsafe output?
• Does it provide complete audit logs that attribute actions to a specific user, agent, or tool call?
• Does it hold relevant compliance certifications (SOC 2, HIPAA, GDPR) or map to frameworks such as the EU AI Act?

Related content: Read our guide to AI governance, including risks, frameworks, and components.

3. Cost Management and Observability

LLM spend is unpredictable because pricing is token-based and usage can spike without warning. A capable gateway gives you visibility into what is being consumed and spent, plus the controls to cap it. This dimension covers usage and cost tracking, budgets and quotas, and the depth of logging, tracing, and analytics available for debugging and reporting.

Evaluation criteria:

• Does it track token usage and cost per user, team, model, or application in real time?
• Can you set budgets, quotas, or token and dollar rate limits with hard stops, not just alerts?
• Does it offer request-level logging and tracing, including for multi-step agent workflows?
• Can telemetry be exported to your existing observability or SIEM stack?

4. Deployment and Scalability

Where and how a gateway runs affects both your compliance posture and its performance in production. Deployment options range from fully managed SaaS to self-hosted, private cloud, and fully air-gapped installations, and each carries trade-offs around control, data residency, and operational burden. Scalability and added latency matter too, because a gateway sits directly in the request path.

Evaluation criteria:

• Does it support the deployment models you need (SaaS, self-hosted, VPC, on-prem, air-gapped)?
• What latency overhead does it add, and can it sustain your expected throughput?
• Does it offer high availability and failover so it is not a single point of failure?
• Can sensitive data stay within your infrastructure or region when required?

5. Integration and Extensibility

A gateway is only useful if it fits the stack your teams already run and can adapt as requirements change. This dimension covers how easily existing applications migrate to it, whether it complements your current API management and identity tooling, and how far you can customize its behavior. Ease of onboarding and the availability of programmable policies often decide how quickly a gateway delivers value.

Evaluation criteria:

• Can existing OpenAI or Anthropic integrations migrate with a base URL swap rather than a rewrite?
• Does it complement your existing API gateway, identity provider, and agent frameworks?
• Can you write custom routing, policies, or guardrails when off-the-shelf options fall short?
• How quickly can a new application or team be onboarded and governed?

Common AI Gateway Solutions and How They Meet the Criteria

The table below summarizes how each solution measures up against the five criteria. Each is explored in detail in the sections that follow.

CategorySolutionHow It Meets the CriteriaAPI security and managementCequence AI GatewayConnects agents to 140+ apps and any API or MCP server with OAuth 2.1, Agent Personas, AI discovery, prompt injection protection, DLP, and full audit logging. Security and governance lead; not an API management platform.API security and managementKong AI GatewayGoverns LLM, MCP, and A2A traffic on the Kong runtime with unified multi-LLM access, PII sanitization, quotas, and L7 observability. Config and pricing complexity at scale.API security and managementZuploOne programmable gateway for REST, LLM, and MCP traffic with hierarchical dollar budgets, prompt-injection and secret-masking policies, and edge deployment. TypeScript-based, cloud-hosted.API security and managementSolo.io Gloo AI GatewayRust, Envoy-based gateway covering LLM, MCP/A2A, and self-hosted inference with guardrails and OTel tracing. Kubernetes-oriented and recently rebranded to agentgateway.API security and managementF5 AI GatewayRuntime AI security and guardrails: prompt-injection defense, data-leak prevention, compliance controls, and audit logging across public and private models. Security-forward rather than a routing or cost layer.AI-native and LLMOpsPortkeyUnified API to 1,600+ models with routing, caching, 50+ guardrails, RBAC, budgets, and SOC 2/HIPAA/GDPR. Log-based pricing and tiered enterprise governance.AI-native and LLMOpsTrueFoundry AI GatewayUnified access to 1,600+ models with low-latency routing, RBAC, quotas, guardrails, MCP, and VPC/air-gapped deployment. Feature-rich and infrastructure-heavy for small teams.AI-native and LLMOpsHelicone AI GatewayOpen-source Rust router for 100+ models with smart routing, caching, rate limits, and tight observability. Governance and MCP support are limited.AI-native and LLMOpsLunar.devAgent-native MCP gateway and control plane with vetted tool catalogs, identity-aligned audit, and self-hosted deployment. MCP and agent governance first, not LLM inference routing.Developer-first and open-sourceLiteLLMOpen-source proxy for 100+ LLMs with spend tracking, budgets, fallbacks, and virtual keys. Self-managed infrastructure; enterprise controls behind the paid tier.Developer-first and open-sourceOpenRouterOne endpoint to 400+ models across 70+ providers with fallbacks and consolidated billing. No self-hosting and limited routing and observability depth.Developer-first and open-sourceVercel AI GatewayOne key to hundreds of models across every modality, no markup, with fallbacks, ZDR routing, and spend tracking. Tied to Vercel; limited conditional routing and tracing.Developer-first and open-sourceCloudflare AI GatewayEdge control plane for any model with dynamic routing, caching, rate limits, and observability. Basic versus purpose-built gateways; no native MCP.Developer-first and open-sourceMaxim AI (Bifrost)Open-source Go gateway with very low overhead, governance, MCP, guardrails, and fallbacks. Fewer native providers and lighter analytics than broad routers.

Notable AI Gateway Solutions

How we selected these solutions: We shortlisted AI gateway platforms based on their ability to route and govern traffic between applications, agents, and models, connect to multiple providers and tools, enforce security and access controls, and provide cost visibility and observability in production.

API Security and Management Platforms with AI Gateway Capabilities

1. Cequence AI Gateway

Best for: Security teams safely connecting AI agents to enterprise apps and data.

Strengths: Agent-level governance, MCP enablement, OAuth 2.1, DLP, and audit logging.

Things to consider: Built for end-to-end agentic AI governance, not an API management platform.

The Cequence AI Gateway is a governance layer that connects and protects enterprise applications and data as they are exposed to AI agents. It transforms existing internal, external, and SaaS APIs into MCP-compatible tools without coding, so agents can discover and use them at runtime. Rather than only authorizing a call, it governs the agent itself, applying policy inline on every tool call for the full session.

At its center is an agentic zero trust approach. The gateway authenticates an agent, then verifies every subsequent action against a defined boundary. Its Agent Personas feature lets a team describe an agent’s job in plain English and automatically scopes the tools, APIs, skills, and permissions that agent is allowed to use. The gateway integrates with the Cequence platform’s API Security and Bot Management for broader protection against agent-driven abuse.

Key features include:

• MCP enablement without code: Uploading OpenAPI specifications turns traditional APIs into agent-ready MCP tools, with native support for connecting agents to more than 140 enterprise applications such as Salesforce, Jira, Slack, and Confluence.
• Agent Personas and least-privilege access: Plain-English job descriptions generate dynamically scoped access policies, binding each agent to only the tools and data it needs and judging actions on both identity and behavior.
• Identity and access governance: Integration with OAuth 2.1-compliant identity providers, token lifecycle management, RBAC, and session binding that locks authenticated sessions to their originating IP to prevent token reuse.
• Sensitive data protection: DLP scanning of agent requests and MCP responses across more than 100 detection types, with the ability to monitor, redact, or block sensitive data and integrate with existing DLP infrastructure.
• Monitoring, discovery, and audit: Real-time visibility and full audit logging of user, agent, and tool behavior, plus AI discovery that surfaces sanctioned and shadow agents, MCP servers, and LLM providers from existing SIEM logs.
• Enterprise deployment and trusted registries: SaaS and on-premises deployment with horizontal scaling, discrete pre-production and production modes, and trusted registries of vetted MCP servers, APIs, and skills with automated tool risk scoring.
• AI discovery: Discovers Agents, MCP servers, and LLM providers across the enterprise from SIEM logs. Surfaces shadow MCP/AI usage and brings it under governance.
• Prompt injection protection: Prompt Guard screens prompts for injection, jailbreak, and system-prompt-extraction patterns before they reach the model, like semantic threat detection for LLM traffic.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageNative MCP support connects agents to 140+ apps and any internal, external, or SaaS API; flexible manual integration with most LLMs and agentic tools.Focused on agent-to-application and MCP connectivity rather than API management.Security, access control, and governanceAgentic zero trust, Agent Personas for least-privilege access, OAuth 2.1, RBAC, runtime guardrails, DLP across 100+ data types, and EU AI Act support.Depth of controls means teams benefit from mapping agent job descriptions and policies up front.Cost management and observabilityFull audit logging and real-time visibility into agent, user, and tool activity, exportable to SIEM; usage-based pricing by MCP servers and interactions.Centers on security and activity monitoring; token-level LLM cost management and analytics are new features.Deployment and scalabilitySaaS and on-premises options with horizontal scaling, continuous monitoring, and discrete pre-prod and prod modes for enterprise workloads.On-premises option is available alongside the primary SaaS delivery model.Integration and extensibilityNo-code conversion of APIs to MCP tools in minutes, IdP integration, and complementary fit with existing Cequence API Security and Bot Management.

2. Kong AI Gateway

Best for: Teams already running Kong for API management adding AI traffic.

Strengths: LLM, MCP, and A2A governance on one proven runtime with 1,000+ plugins.

Things to consider: Configuration and enterprise pricing grow complex at scale.

The Kong AI Gateway extends the Kong Gateway runtime to govern generative and agentic AI traffic through a single platform. It handles three patterns of AI traffic: LLM connectivity, MCP tool access, and agent-to-agent (A2A) communication. Because it is built on the same core as Kong’s API gateway, its existing plugin ecosystem for authentication, traffic control, and transformations applies to AI traffic as well.

For LLM traffic, Kong offers a unified interface across multiple providers so teams can switch models without rewriting code. It layers on semantic caching, routing, load balancing, PII sanitization, and prompt guards. For agents, it can automatically generate MCP tools and servers on top of Kong-managed APIs and enforce authentication for MCP access, and it captures telemetry on A2A calls.

Key features include:

• Unified multi-LLM access: A single API interface works across multiple AI providers, allowing teams to switch between providers to unlock use cases or maintain availability during provider downtime.
• LLM policy enforcement: PII sanitization to reduce data leakage, semantic prompt guards, access control, and semantic caching, routing, and load balancing to make LLM traffic more efficient.
• MCP and A2A governance: Automatic generation of MCP tools and servers on Kong-managed APIs, authentication for MCP server access, context optimization, and centralized authentication and auditing for A2A traffic.
• AI quota and cost management: User, model, and time-bound quotas on LLM consumption and token spend, enforced at the gateway, with showback and chargeback across LLM, agent, and MCP usage.
• L7 observability: Tracking of AI consumption, tool usage, and token spend, with logging and tracing to debug AI exposure and predictive consumption models for cost tuning.
• Flexible runtimes: Deployment as open-source, enterprise self-hosted, or cloud-managed through Kong Konnect.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageUnified API across multiple LLM providers plus native LLM, MCP, and A2A governance on one runtime.AI capabilities are extensions on an API gateway; reviewers note AI-specific features and analytics are less mature than the core gateway.Security, access control, and governanceStandard enterprise primitives (OAuth, JWT, mTLS, RBAC), PII sanitization, prompt guards, and access control via the plugin ecosystem.Deeper LLM-native governance such as prompt-level auditing may require additional configuration and plugins.Cost management and observabilityToken and time-bound quotas, showback and chargeback, and L7 observability on AI consumption and token spend.Governance is API-centric; token-level cost intelligence is newer than in purpose-built AI gateways.Deployment and scalabilityOpen-source, enterprise self-hosted, and Konnect cloud options built on a high-performance runtime.Setup and plugin interactions add operational complexity, especially for teams new to Kong.Integration and extensibility1,000+ plugins and a single platform spanning APIs, events, and AI traffic.Enterprise pricing is complex and can be high; documentation gaps and a learning curve are commonly cited.

Source: Kong

3. Zuplo

Best for: Teams wanting one programmable gateway for REST, LLM, and MCP traffic.

Strengths: Hierarchical dollar budgets, TypeScript policies, and edge deployment.

Things to consider: Programmability assumes TypeScript; primarily cloud-hosted.

Zuplo is a programmable API gateway with a full AI gateway feature set built in, so LLM calls, agents, and MCP servers run behind the same gateway as your REST APIs. It routes requests to OpenAI, Anthropic, Gemini, and Mistral through one endpoint, with providers swapped in configuration rather than code. Because it runs on the same policy engine as Zuplo’s API gateway, teams manage AI and traditional traffic from one control plane.

A distinguishing element is its hierarchical budget model. Rather than a single global cap, Zuplo lets organizations nest teams, sub-teams, and apps, each with daily and monthly dollar budgets that cascade from the top down and halt requests when hit. It also runs at the edge across a large points-of-presence network and exposes TypeScript programmability for custom policies.

Key features include:

• Multi-provider routing: A single endpoint routes to OpenAI, Anthropic, Gemini, and Mistral, with per-route, per-tenant, or per-key model selection and drop-in compatibility with the OpenAI SDK base URL.
• Hierarchical dollar budgets: Nested organization, team, sub-team, and app budgets in USD, where sub-team limits cannot exceed the parent ceiling and requests stop with hard 429s before overspend.
• AI security policies: A prompt-injection policy blocks malicious instructions before they reach the model, and a secret-masking policy redacts API keys, emails, and other sensitive values from responses.
• Semantic caching: Responses are cached by vector similarity rather than exact match to cut latency and spend on repeated or similar prompts.
• MCP support: An MCP Server Handler exposes API endpoints as MCP tools, and an MCP Gateway federates remote MCP servers behind a single OAuth 2.1 endpoint with per-tool governance and audit logging.
• Observability and edge deployment: Every request and tool call is logged with caller identity, tokens, and cost, streamed to Galileo, Comet Opik, or an OTel collector, running on a 300-plus point-of-presence edge network.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageOne endpoint for REST, LLM, and MCP traffic across OpenAI, Anthropic, Gemini, and Mistral, with MCP server and gateway support.Named LLM provider list is narrower than the broadest routers, though providers are added in config.Security, access control, and governancePrompt-injection and secret-masking policies, per-key model scoping, MCP tool allowlists, and audit logs streamed to a SIEM.Documentation notes prompt injection is mitigated rather than eliminated, and blocking direct provider calls is partly a network and IAM problem.Cost management and observabilityHierarchical dollar budgets with hard stops, per-team attribution, and request-level logging and tracing.Per-log and usage-based pricing should be modeled at high request volumes.Deployment and scalabilityGlobal edge deployment across 300-plus points of presence on the same platform as REST APIs.Primarily cloud-hosted; a dedicated deployment is available but self-hosting is not the default.Integration and extensibilityOpenAI SDK base URL swap, TypeScript programmability for custom policies, and a shared GitOps pipeline.Full extensibility assumes teams are comfortable writing TypeScript.

Source: Zuplo

4. Solo.io Gloo AI Gateway

Best for: Cloud-native and Kubernetes teams needing AI-native traffic control.

Strengths: Rust and Envoy performance across LLM, MCP/A2A, and inference routing.

Things to consider: Kubernetes-oriented; recently rebranded to agentgateway.

Solo.io’s AI gateway, delivered as agentgateway and building on its Gloo Gateway lineage, is an AI-native gateway written in Rust and hosted as a Linux Foundation project. It is designed around three use cases in one gateway: an LLM gateway for unified provider access, an MCP and A2A gateway for tool and agent federation, and an inference gateway for routing to self-hosted models. It is built on Envoy and the Kubernetes Gateway API, so it fits cloud-native environments.

As an LLM gateway, it exposes an OpenAI-compatible endpoint for OpenAI, Anthropic, Azure, Gemini, and self-hosted models, with inline guardrails, centralized key storage, and token-based rate limits. As an MCP and A2A gateway, it turns OpenAPI specs into MCP tools, federates agents over the A2A protocol, and sandboxes shadow MCP access. Its inference gateway routes and prioritizes traffic to self-hosted models with context-aware routing.

Key features include:

• Unified LLM access: One OpenAI-compatible API works across providers and self-hosted models, so teams can switch models without changing code, with real-time logging and end-to-end tracing via OpenTelemetry.
• MCP and A2A gateway: OpenAPI specs become MCP tools without code changes, agents federate over Google’s A2A protocol, and every elicited URL and tool call is validated, sandboxed, and audited from one control point.
• Inline guardrails and key management: Custom semantic rules block prompt attacks and data leaks on every prompt and response, and provider keys are centralized with enterprise IAM integration and fine-grained access control.
• Inference gateway: Requests route to specialized fine-tuned models, priority scheduling protects critical workloads, and real-time inference metrics and llm-d integration improve GPU utilization and time to first token.
• Spending controls: Token-based rate limiting per user, team, or key, budget enforcement, per-model cost attribution, and model failover for price and availability.
• Rust performance and open governance: Sub-millisecond overhead at high query rates, an Apache 2.0 open-source core, and backing from Microsoft, T-Mobile, Dell, CoreWeave, and Akamai.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageLLM, MCP, A2A, and self-hosted inference routing in one gateway with an OpenAI-compatible endpoint.Breadth is strong, but capabilities are exposed through a Kubernetes and Envoy-centric model.Security, access control, and governanceNative MCP OAuth 2.1, tool-level RBAC, inline guardrails, centralized keys, and cryptographic audit trails.Configuring identity and guardrails assumes familiarity with cloud-native networking patterns.Cost management and observabilityToken-based rate limiting, per-model cost attribution, consumption dashboards, and OTel tracing across agent-to-tool chains.Cost tooling is capable but oriented to platform teams operating the gateway themselves.Deployment and scalabilityRust-based performance with sub-millisecond overhead at high query rates, deployed on Kubernetes and Envoy.Best suited to teams that run Kubernetes; not a managed SaaS-first product.Integration and extensibilityOpen-source and vendor-neutral with OpenAPI-to-MCP conversion and broad ecosystem backing.The product recently consolidated under the agentgateway brand, so materials and naming are still settling.

Source: Solo.io

5. F5 AI Gateway

Best for: Enterprises securing AI models and agents within an F5 estate.

Strengths: Prompt-injection defense, data-leak prevention, and compliance guardrails.

Things to consider: Security-forward rather than a routing or cost-control layer.

F5’s AI offering focuses on securing AI models and agents at runtime as part of its broader application delivery and security portfolio. It protects AI systems against adversarial attacks, data leakage, and harmful outputs, with deployment flexibility across public cloud, private cloud, on-prem, and air-gapped environments. It applies consistent, model-agnostic policy across public and proprietary models and integrates with F5’s NGINX and BIG-IP platforms.

Its protections are informed by a large threat library and F5 Labs research, and it targets the OWASP Top 10 for LLM risks. Custom policies can be created through a natural language interface, and out-of-the-box controls map to PII, EU AI Act, PCI, and PHI requirements. Audit-ready logging traces every enforcement action and can be exported to a SIEM.

Key features include:

• Prompt injection and jailbreak defense: Protection against prompt injection, data exfiltration, and jailbreak attacks, informed by a threat library that adds attack patterns on an ongoing basis.
• Data-leak prevention: Semantic data security detects and prevents leakage of standard and custom sensitive data categories during AI interactions, with model-agnostic policy enforcement.
• Compliance controls: Out-of-the-box guardrails aligned to PII, EU AI Act, PCI, and PHI, plus automated auditing templates for regulations such as GDPR and HIPAA.
• Agent security: Controls that prevent excessive agency and privilege escalation by enforcing guardrails on agent actions and tool use, applied to OpenAI, Anthropic, or similarly formatted agents.
• Observability and audit: Audit-ready logging that explains and traces every enforcement action, agent visibility into prompts and tool calls, and a performance dashboard exportable to a SIEM.
• Deployment flexibility: Model-agnostic enforcement across public cloud, private cloud, on-prem, and fully air-gapped environments, with native integration into F5 NGINX and BIG-IP.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageModel-agnostic policy enforcement across public and private models and OpenAI or Anthropic-formatted agents.Centers on securing model and agent traffic rather than acting as a unified multi-provider routing layer.Security, access control, and governancePrompt-injection and jailbreak defense, data-leak prevention, agent guardrails, and compliance controls with audit-ready logging.This is the product’s core strength; broader governance features assume the wider F5 portfolio.Cost management and observabilityPerformance dashboards, usage trends, and enforcement logging exportable to a SIEM.Observability is security-focused; token-level cost management is not its purpose.Deployment and scalabilityPublic cloud, private cloud, on-prem, and fully air-gapped deployment with full functionality.Value is greatest when integrated with existing F5 NGINX or BIG-IP infrastructure.Integration and extensibilityNatural-language custom policy creation and integration with F5 delivery and security services and technology alliances.A commercial security product; extending beyond guardrails leans on the wider F5 ecosystem.

AI-Native Gateway and LLMOps Platforms

6. Portkey

Best for: Teams needing an LLMOps control plane across many providers.

Strengths: 1,600+ models, routing, 50+ guardrails, governance, and observability.

Things to consider: Log-based pricing and tiered enterprise governance features.

Portkey is an enterprise AI gateway and production control plane for generative AI workloads. It provides a unified API across 1,600-plus LLMs and providers and extends the gateway with observability, guardrails, governance, and prompt management. It is designed to take AI applications from prototype to production, with an open-source gateway core and enterprise controls layered on top.

For reliability, it offers conditional routing, fallbacks, retries, load balancing, and canary testing, plus simple and semantic caching. For governance, it provides workspaces, RBAC, budgets, data residency, SSO and SCIM, audit logs, and policy-as-code. Its guardrails library covers PII redaction, jailbreak detection, and safety filters. Portkey was recently acquired by Palo Alto Networks.

Key features include:

• Unified model access: A single API connects to 1,600-plus LLMs and providers across text, vision, audio, and image modalities, with no separate integration per provider.
• Routing and reliability: Conditional routing, fallbacks, automatic retries, load balancing, canary testing, and request timeouts keep applications online during provider failures.
• Guardrails and safety: A library of guardrails enforces PII redaction, jailbreak detection, toxicity and safety filters, and request and response policy checks for agentic workflows.
• Governance and access control: Workspaces, RBAC, budgets, rate limits, quotas, data residency, SSO and SCIM, audit logs, and policy-as-code for consistent enforcement.
• Observability: Detailed logs, latency traces, and token and cost analytics broken down by app, team, or model, with export to reporting tools.
• Key management and prompt tooling: A vault for provider keys with virtual keys for rotation and access control, plus prompt templates, versioning, and environment promotion.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageUnified API across 1,600-plus LLMs and providers, multimodal support, and MCP integration for tool registration.MCP and agent governance are newer relative to its core LLM routing.Security, access control, and governanceRBAC, SSO and SCIM, data residency, audit logs, policy-as-code, and 50-plus guardrails with SOC 2, ISO 27001, HIPAA, and GDPR.Some enterprise governance features such as policy-as-code and data residency are on higher-tier plans.Cost management and observabilityToken and cost analytics by app, team, and model, latency traces, and detailed request logs.Pricing is based on recorded logs, which can scale up at high volumes; some users report limited data export.Deployment and scalabilitySaaS, hybrid, and fully air-gapped options with a 99.99% uptime SLA and semantic caching for performance.Breadth of features can be more than lightweight prototypes need.Integration and extensibilityOpenAI-compatible SDKs, prompt management, and integrations across the GenAI ecosystem and MCP clients.Recent acquisition by Palo Alto Networks may influence the roadmap and packaging.

Source: Portkey

7. TrueFoundry AI Gateway

Best for: Enterprises governing multi-provider AI with self-hosted control.

Strengths: 1,600+ models, low-latency routing, RBAC, MCP, and air-gapped deployment.

Things to consider: Feature-rich and infrastructure-heavy for smaller teams.

TrueFoundry provides a unified AI gateway to manage and govern AI across 1,600-plus models with policy control, real-time monitoring, and cost controls. It connects to OpenAI, Claude, Gemini, Groq, Mistral, and more through one API and supports chat, completion, embedding, and reranking model types. It reports low internal latency and high throughput, and it centralizes key management and team authentication.

Beyond routing, it offers quota and access control, observability, guardrails, and native MCP support for agent workflows. It can also serve self-hosted open-source models in VPC, hybrid, or air-gapped environments using the same policies as hosted models, which suits teams that want infrastructure ownership and data residency.

Key features include:

• Unified model access: One API and one gateway key reach 1,600-plus models across providers, with centralized key management and the ability to swap providers without changing application code.
• Quota and access control: Rate limits per user, service, or endpoint, cost and token-based quotas using metadata filters, RBAC, and governance of service accounts and agent workloads.
• Routing and fallbacks: Latency-based routing to the fastest model, weighted load balancing, automatic fallback to secondary models, and geo-aware routing for regional compliance.
• Observability: Monitoring of token usage, latency, error rates, and request volumes, full request and response logging, metadata tagging, and filtering by model, team, or geography.
• Guardrails and self-hosted models: PII filtering and toxicity detection, integration with external moderation services, and serving of open-source models via vLLM, SGLang, KServe, and Triton.
• MCP and enterprise controls: Native MCP support for tools such as Slack, GitHub, and Datadog with OAuth2 and RBAC, plus SOC 2, HIPAA, and GDPR, SSO, audit logging, and 24/7 SLA-backed support.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageUnified access to 1,600-plus models across providers, self-hosted open-source models, and native MCP support.Some competitors position it as more MLOps-oriented than a pure multi-provider router.Security, access control, and governanceRBAC, OAuth 2.0, API key auth, SSO, audit logging, and configurable PII and toxicity guardrails.Realizing the full governance model benefits from platform and infrastructure ownership.Cost management and observabilityToken-level tracking, cost and token quotas, budget enforcement, and detailed request-level logs and metrics.Depth of controls adds configuration work for smaller teams.Deployment and scalabilityVPC, on-prem, air-gapped, and multi-cloud deployment with low internal latency and high throughput.Self-hosted and Kubernetes-based deployment adds operational overhead.Integration and extensibilityOpenAI-compatible clients, GitOps YAML configuration, MCP tools, and a prompt and agent template repository.Pricing is provided on request and reflects the full-stack platform.

Source: TrueFoundry

8. Helicone AI Gateway

Best for: Teams prioritizing lightweight routing with deep observability.

Strengths: Open-source Rust router, smart routing, caching, and rate limits.

Things to consider: Governance and native MCP support are limited.

Helicone’s AI Gateway is an open-source router written in Rust that pairs LLM request routing with observability. It exposes one API for 100-plus models across 20-plus providers using OpenAI syntax, so teams stop rewriting integrations per provider. It is positioned as a lightweight, high-performance layer that can be run cloud-hosted or self-hosted in seconds via Docker.

Its routing is aware of provider uptime and rate limits, with strategies for latency, cost, and weighted distribution. Every request is logged into Helicone’s monitoring, and OpenTelemetry support exports logs, metrics, and traces. Caching backed by Redis and S3 can cut cost and latency substantially for repeated requests.

Key features include:

• Unified interface: One API using familiar OpenAI syntax reaches OpenAI, Anthropic, Google, AWS Bedrock, and 20-plus more providers across 100-plus models.
• Smart routing: Built-in strategies include model-based latency routing, provider latency-based routing, weighted distribution, and cost optimization, aware of provider uptimes and rate limits.
• Spending control: Rate limiting per user, team, or globally, with support for request counts, token usage, and dollar amounts to prevent runaway costs.
• Caching: Response caching with Redis and S3 backends and intelligent invalidation to reduce cost and latency for repeated requests.
• Tracing and observability: Built-in Helicone integration plus OpenTelemetry support for logs, metrics, and traces, with a dashboard for monitoring and debugging.
• Flexible deployment: A cloud-hosted gateway or self-hosting via Docker and Kubernetes, with low latency and small memory footprint for production.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageOne OpenAI-compatible API for 100-plus models across 20-plus providers with smart routing.No native MCP support, so agent and tool connectivity is not a first-class capability.Security, access control, and governanceGateway-level key handling and rate limiting, with an open, self-hostable codebase.Governance, RBAC, and workspace controls are limited compared with enterprise gateways.Cost management and observabilityDeep request-level logging of latency, tokens, and cost, plus caching to cut spend and OTel export.Observability is tightly coupled to Helicone’s own monitoring platform.Deployment and scalabilityCloud-hosted or self-hosted via Docker and Kubernetes, with low latency and small footprint.The routing gateway is newer and less mature than the observability stack.Integration and extensibilityOne-line OpenAI SDK integration and a config wizard or YAML for routing strategies.Data retention is capped on lower tiers, so long-term history needs higher plans.

Source: Helicone

9. Lunar.dev

Best for: Enterprises governing employee and agent access to AI tools.

Strengths: Vetted MCP catalogs, identity-aligned audit, and self-hosted deployment.

Things to consider: MCP and agent governance first, not LLM inference routing.

Lunar.dev is an enterprise MCP gateway and AI control plane that centralizes how agents and AI applications authenticate, discover tools, and access enterprise resources. It is designed to give security and IT teams visibility and control as AI adoption outpaces governance, closing gaps around accountability, AI sprawl, and over-privileged agents. It is recognized by Gartner as a Representative Vendor in both AI Gateways and MCP Gateways.

The product starts with observability, capturing full lineage across user, agent, model, MCP server, and the final tool or API call, mapped to verified user identity. It then enforces access through an admin-vetted MCP catalog, a risk-evaluation sandbox, and dynamic, time-bound access controls, while keeping approved tools easy for teams to use. It runs self-hosted for data sovereignty.

Key features include:

• Full lineage observability: A centralized inventory of all agents and applications, identity-aligned attribution mapping every action to a verified user, and immutable real-time audit trails.
• Vetted tool access: An enterprise MCP catalog of admin-approved tools, a risk-evaluation sandbox to detect data exposure and unsafe tool execution before rollout, and dynamic, intent-aware, time-bound access.
• Governed skills and tool variants: Tool groups and Skills that combine workflow knowledge and MCP tools, with authentication, RBAC, audit, and versioning applied to every skill and call.
• User authentication without secret exposure: Requests are authenticated with user credentials and resource access is controlled without exposing keys or secrets, with hardened tool variants per agent logic.
• Enterprise assurance: Private deployment and data sovereignty, SSO, roles, audit logs, DLP and sensitive-data controls, and fault-tolerant design.
• Path to unified governance: An MCP gateway that extends to unify governance across LLM and API traffic as usage scales.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageCentralizes MCP tool and agent access with a path to unify LLM and API traffic governance as usage grows.Primarily an MCP and agent gateway rather than a multi-provider LLM inference router.Security, access control, and governanceVetted MCP catalog, risk sandbox, dynamic time-bound access, identity-aligned attribution, and DLP controls.Realizing value depends on curating catalogs and defining access policies up front.Cost management and observabilityFull lineage across user, agent, model, and tool, with immutable real-time audit trails.Focuses on activity governance and audit rather than token-level LLM cost analytics.Deployment and scalabilitySelf-hosted via Docker or Kubernetes with private deployment, data sovereignty, and enterprise support.Self-hosting keeps data in your boundary but places operations on your team.Integration and extensibilityIdentity provider integration, OAuth flows, hardened tool variants, and a custom MCP server catalog.A newer product in an emerging category, so the ecosystem is still maturing.

Source: Lunar.dev

Developer-First and Open-Source LLM Routers

10. LiteLLM

Best for: Platform teams giving developers self-hosted access to many LLMs.

Strengths: 100+ LLMs in OpenAI format, spend tracking, fallbacks, and virtual keys.

Things to consider: Self-managed infrastructure; enterprise controls are paid.

LiteLLM is an open-source AI gateway that provides model access, fallbacks, and spend tracking across 100-plus LLMs, all in the OpenAI format. It is delivered as a Python SDK and a proxy server that teams typically run and operate themselves, which gives full control over networking and data flow. It is widely adopted, with large download and request volumes and use by companies including Netflix and Lemonade.

Its core value is a single, OpenAI-compatible interface that lets platform teams give developers access to many providers while attributing cost to keys, users, teams, or organizations. It adds budgets and rate limits, load balancing, and fallbacks, with an enterprise tier that unlocks JWT auth, SSO, and audit logs.

Key features include:

• Unified model access: A single OpenAI-compatible API and pricing layer spans 100-plus LLM providers, enabling fast model switching and provider comparison during experimentation.
• Spend tracking: Automatic cost attribution to key, user, team, or organization, tag-based tracking, and logging of spend to s3, gcs, and other stores.
• Budgets and rate limits: Per-key and per-team budgets with RPM and TPM rate limits to prevent runaway usage.
• Reliability: LLM fallbacks and load balancing across providers with retry logic.
• Access control and keys: Virtual keys, teams, and, in the enterprise tier, JWT auth, SSO, and audit logs.
• Flexible deployment: Self-hosted by default, with air-gapped deployment available and infrastructure-as-code configuration.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageOne OpenAI-compatible interface across 100-plus LLM providers with fast model switching.Focused on LLM routing; native MCP and agent governance are not core strengths.Security, access control, and governanceVirtual keys, teams, budgets, and, in the enterprise tier, JWT auth, SSO, and audit logs.Key enterprise controls such as SSO, RBAC, and audit logs sit behind the paid tier.Cost management and observabilityCost attribution by key, user, team, or org, tag-based tracking, and logging to external stores.Observability is basic by default; deeper analytics require additional tooling.Deployment and scalabilitySelf-hosted by default with air-gapped options and full control over networking and data.Teams own availability, scaling, and updates; users report latency and stability issues at high volume.Integration and extensibilityOpenAI-compatible SDK and proxy, infrastructure-as-code config, and an active community ecosystem.No formal SLA on the open-source tier, and version regressions are sometimes reported.

Source: LiteLLM

11. OpenRouter

Best for: Developers wanting fast access to a large model catalog.

Strengths: 400+ models across 70+ providers with fallbacks and one billing account.

Things to consider: No self-hosting and limited routing and observability depth.

OpenRouter is a cloud-managed unified interface for LLMs that provides access to 400-plus models across 70-plus providers through a single, OpenAI-compatible endpoint. It emphasizes better prices and uptime with no subscriptions, and it consolidates billing into a single prepaid credit balance instead of separate provider accounts. Setup is quick because the API is compatible with the OpenAI SDK.

Beyond broad access, it provides higher availability by falling back to other providers when one goes down, runs at the edge for lower latency, and supports custom data policies so prompts only reach trusted models and providers. It also spans modalities including chat, image, embeddings, and transcription through one base URL.

Key features include:

• Broad model access: A single interface reaches 400-plus models across 70-plus providers, with the OpenAI SDK working by changing the base URL and key.
• Higher availability: Automatic fallback routes to another provider when the primary returns an error, backed by distributed infrastructure.
• Consolidated billing: A prepaid credit system manages a single balance across providers, with provider token rates passed through.
• Custom data policies: Fine-grained policies ensure prompts only go to the models and providers an organization trusts.
• Edge performance: Requests run at the edge to reduce latency between users and inference.
• Every modality: Chat, image generation, embeddings, and transcription run through one base URL by changing the model string and content type.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageOne OpenAI-compatible endpoint to 400-plus models across 70-plus providers spanning multiple modalities.Conditional routing on custom metadata is not supported, limiting fine-grained control.Security, access control, and governanceCustom data policies restrict prompts to trusted models and providers.Lighter enterprise governance, RBAC, and audit controls than platform-focused gateways.Cost management and observabilityConsolidated prepaid billing with pass-through provider rates and activity logs.Observability is limited to activity logs; a fee applies on credit purchases.Deployment and scalabilityCloud-managed and edge-distributed for availability and low latency.No self-hosting option, so data residency and on-prem requirements are not met.Integration and extensibilityOpenAI SDK compatibility with a base URL and key change, and broad app ecosystem adoption.Added per-request latency can affect multi-step agentic workflows.

Source: OpenRouter

12. Vercel AI Gateway

Best for: Teams on Vercel wanting one endpoint across every modality.

Strengths: Hundreds of models, no markup, fallbacks, ZDR routing, and spend tracking.

Things to consider: Tied to Vercel; limited conditional routing and deep tracing.

Vercel AI Gateway is a cloud-managed routing layer that provides one API key and endpoint for hundreds of models across text, image, video, audio, realtime, speech, transcription, embeddings, and reranking. It passes through provider token rates with no markup, supports bring-your-own-keys, and offers automatic fallbacks when a provider goes down. Migration is typically a base URL swap for existing OpenAI or Anthropic integrations.

It optimizes routing for availability, cost, or latency, failing over to the same model on another provider when one degrades. It provides unified billing and observability across the stack, with dashboards for usage, spend, time to first token, and token counts, plus a Custom Reporting API. Security options include zero-data-retention routing and provider allowlists.

Key features include:

• Unified multimodal access: One endpoint and key reach hundreds of models across text, image, video, realtime, speech, transcription, embeddings, and reranking.
• Routing and fallbacks: Routing optimized for availability, cost, or latency, with automatic failover to the same model on another provider during outages.
• No-markup pricing and BYOK: Provider token rates are passed through with no platform fee, and existing provider commitments flow through with bring-your-own-keys.
• Security and compliance controls: Zero-data-retention routing, a no-training guarantee, provider allowlists, short-lived OIDC tokens, and per-user spend limits.
• Observability and reporting: Dashboards for usage, spend, requests, time to first token, and token counts by model, provider, and project, plus a Custom Reporting API.
• Coding agent support: Routing of coding agents such as Claude Code, OpenAI Codex, and Cline through the gateway with unified spend tracking.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageOne endpoint to hundreds of models across every modality with OpenAI and Anthropic SDK compatibility.Focused on model access; conditional routing, A/B testing, and traffic splitting are not supported.Security, access control, and governanceZero-data-retention routing, no-training guarantee, provider allowlists, OIDC tokens, and API key management.Governance is oriented to routing and spend rather than deep agent or MCP policy.Cost management and observabilityUnified spend tracking, dashboards, and a Custom Reporting API with no markup on tokens.Deeper tracing typically requires adding third-party tools.Deployment and scalabilityCloud-managed with automatic failover and availability across providers.Tightly coupled to the Vercel platform, and serverless limits constrain long-running agents.Integration and extensibilityBase URL swap migration, BYOK, day-zero model support, and coding-agent routing.Semantic caching requires manual setup with a separate store.

Source: Vercel

13. Cloudflare AI Gateway

Best for: Teams on Cloudflare needing edge caching and basic AI controls.

Strengths: Global edge network, caching, dynamic routing, and observability.

Things to consider: Basic versus purpose-built gateways; no native MCP.

Cloudflare AI Gateway is an intelligent control plane for AI applications that connects to any model, dynamically routes requests, and manages usage, billing, and logs from one gateway. It runs on Cloudflare’s global network, so it provides low-latency, distributed access with automatic scaling and built-in security. It is compatible with the OpenAI SDK and the AI SDK and integrates with Cloudflare Workers AI.

Its emphasis is on reducing cost and latency through caching, improving reliability with dynamic routing and fallbacks, and adding observability such as token counts and prompt performance. It also provides rate limiting and safety guardrails, and it unifies billing across providers behind a single API.

Key features include:

• Dynamic routing: Requests route automatically based on latency, cost, or availability, with rules adjusted from the dashboard or API without redeploys.
• Caching: Automatic storage and reuse of frequent requests reduces redundant API calls to save cost and improve response times.
• Observability: Logs, metrics, and usage analytics including token counts, prompt performance, and pattern analysis, with support for custom dashboards and alerting.
• Reliability and safety controls: Fallback routing, rate limiting, and safety guardrails to manage cost, behavior, and compliance across providers.
• Security controls: Protection against leaking sensitive information and against malicious traffic without extra configuration.
• Edge network and unified billing: Global points of presence with automatic scaling, one API across providers, and a single consolidated bill.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageConnects to any model with dynamic routing and OpenAI SDK and AI SDK compatibility.No native MCP support, so agent and tool connectivity is not built in.Security, access control, and governanceSafety guardrails, rate limiting, and controls against leaking sensitive data or malicious traffic.Authentication is handled through the separate Cloudflare Access product.Cost management and observabilityCaching to cut cost and latency, plus logs, token counts, and prompt-performance analytics.Log limits apply on the free tier, which can constrain production workloads.Deployment and scalabilityRuns on Cloudflare’s global edge network with automatic scaling and built-in security.Positioned as a lighter option than purpose-built AI gateways.Integration and extensibilityOne-line setup, OpenAI and AI SDK compatibility, and integration with Workers AI.Programmability beyond Workers is limited, and advanced configuration has a learning curve.

Source: Cloudflare

14. Maxim AI (Bifrost)

Best for: Performance-sensitive teams wanting an open-source, low-overhead gateway.

Strengths: Very low latency in Go, governance, MCP, guardrails, and fallbacks.

Things to consider: Fewer native providers and lighter analytics than broad routers.

Bifrost is the AI gateway from Maxim AI, an open-source project under Apache 2.0 built in Go and positioned for high-performance, production workloads. It provides a drop-in, OpenAI-compatible API that routes to multiple providers with minimal overhead, and it integrates with Maxim’s broader evaluation and observability platform. Vendor benchmarks report very low added latency at high request rates.

It supports 1,000-plus models across providers through a unified interface, including custom deployed models, with automatic failover and load balancing. Enterprise features add governance, guardrails, and a built-in MCP gateway. Setup is designed to be fast, with a single command to run locally and a one-line change to point existing SDKs at it.

Key features include:

• Unified model access: A model catalog reaches 1,000-plus models across providers through a single OpenAI-compatible interface, including custom deployed models.
• Drop-in replacement: A one-line change points existing OpenAI, Anthropic, Vercel AI SDK, LangChain, or Google GenAI code at the gateway.
• Governance: Budgets per team or virtual key, audit logs, access control, and SSO, with virtual keys carrying independent budgets and access.
• Reliability: Automatic provider fallback and adaptive load balancing for high uptime, plus semantic caching to cut repeated inference cost.
• MCP gateway and guardrails: A built-in MCP gateway centralizes tool connections with policy enforcement, and guardrails block unsafe outputs and enforce compliance.
• Observability and performance: Out-of-the-box OpenTelemetry support and a built-in dashboard, with very low added latency at high request rates.

CriterionSolution FitKey ConsiderationsModel, provider, and protocol coverageUnified OpenAI-compatible API to 1,000-plus models with a built-in MCP gateway.Native provider coverage out of the box is narrower than the broadest routers.Security, access control, and governanceBudgets, audit logs, access control, SSO, and guardrails that block unsafe outputs.Enterprise governance features are newer than those of established platforms.Cost management and observabilityBudget tracking per team and virtual key, OTel support, and a built-in dashboard.Deep analytics rely on the broader Maxim platform rather than the gateway alone.Deployment and scalabilityOpen-source Go core with very low overhead at high request rates and enterprise deployment options.Performance figures are vendor-reported benchmarks and should be validated.Integration and extensibilityOne-line drop-in for major SDKs, virtual keys, and Maxim ecosystem integration.A smaller integration ecosystem and fewer connectors than more established gateways.

Source: Maxim AI

Conclusion

Choosing an AI gateway vendor requires balancing flexibility, governance, security, and operational simplicity. Organizations should evaluate how well a gateway supports their AI architecture, including model providers, agent frameworks, enterprise APIs, and deployment requirements, while also considering identity integration, policy enforcement, cost controls, and observability. As AI adoption expands across applications and autonomous agents, a centralized gateway helps reduce integration complexity, enforce consistent security policies, improve visibility into AI usage, and provide the governance needed to operate AI systems safely and at scale.

‍

What is Agentic AI Governance?

Agentic AI governance is the structured management, oversight, and control of autonomous AI systems that plan and execute actions on behalf of an organization. Unlike traditional AI, agentic governance must manage autonomous decision-making, tool use, and multi-step actions to ensure safety, ethics, and compliance, with specialized standards frameworks emerging.

The primary aim of agentic AI governance is to ensure that autonomous agents act in alignment with organizational objectives, regulatory requirements, and ethical standards. This involves monitoring agent behavior, enforcing access controls, and ensuring accountability for decisions made by AI systems. Effective governance reduces the risk of unintended consequences, such as data leakage, security breaches, and operational disruptions.

Key components of agentic AI governance:

• Real-time monitoring & control: Implementing guardrails that oversee agent actions as they happen, not just after.
• Access & policy enforcement: Defining strict boundaries on what systems agents can access (e.g., databases, API connections) and what actions they can take.
• Accountability & transparency: Establishing clear lines of responsibility for agent behaviors and decisions, particularly for high-risk applications.
• Human-in-the-loop: Designing systems that include human intervention or approval for critical tasks.

Challenges and emerging risks include:

• Operational risk: Managing the potential for autonomous agents to trigger workflow failures, cascading errors, inaccurate outputs, or unintended actions in business-critical processes.
• Emergent behavior: Addressing unexpected decision patterns, objective drift, over-optimization, or unanticipated strategies that arise from autonomous planning and tool use.
• Shadow AI agents: Detecting and governing unauthorized AI agents deployed outside approved IT, security, and compliance processes.
• Security threats: Mitigating risks such as prompt injection, excessive permissions, data leakage, credential exposure, memory poisoning, and compromised third-party integrations.
• Shadow MCP servers: Preventing unapproved Model Context Protocol (MCP) servers from exposing sensitive data, granting excessive access, or enabling uncontrolled agent actions.

In this article:

• Challenges and Emerging Risks Raised By Agentic AI
• Key Components of Agentic AI Governance
• Key Agentic AI Governance Frameworks
• Agentic AI Governance Best Practices and Strategies

Challenges and Emerging Risks Raised by Agentic AI

Let’s review some of the main risks facing organizations implementing AI agents in production.

Operational Risk

Operational risk increases when AI agents are connected to business systems, data repositories, workflows, or external tools and are allowed to act with limited human supervision. Because agents can plan, make decisions, call APIs, update records, trigger automations, and execute multi-step tasks, a single incorrect assumption or failed instruction can quickly affect downstream processes. This can result in inaccurate outputs, workflow interruptions, duplicate actions, failed transactions, compliance gaps, or decisions made without sufficient context.

Unlike traditional AI systems that typically generate recommendations or content, agentic systems may directly affect operations. This makes it important to define clear operating boundaries, approval requirements, fallback procedures, escalation paths, and rollback mechanisms. Organizations should also monitor agent performance continuously, test agents under realistic conditions, and ensure that critical workflows include human review where errors could create material business, legal, financial, or reputational impact.

Emergent Behavior

Emergent behavior refers to unexpected actions, strategies, or decision patterns that arise when AI agents operate autonomously across complex environments. These behaviors may not be visible during initial testing because agents can combine tools, instructions, memory, external data, and feedback loops in ways that are difficult to fully predict. An agent may pursue a goal too aggressively, optimize for the wrong outcome, misinterpret priorities, or develop unintended shortcuts to complete a task.

This risk becomes more significant when agents are given broad objectives, long-running tasks, access to multiple systems, or the ability to learn from previous interactions. Even when each individual action appears reasonable, the overall sequence may create unintended consequences. Governance should therefore include behavioral monitoring, scenario testing, limits on autonomous decision-making, regular review of agent goals, and mechanisms to detect drift from approved policies or business intent.

Shadow AI Agents

Shadow AI agents are autonomous or semi-autonomous AI tools deployed without formal approval from IT, security, legal, or compliance teams. They may be created by employees, teams, vendors, or business units seeking faster productivity, but they often operate outside established governance processes. This creates blind spots because the organization may not know which agents exist, what data they access, what systems they connect to, or what actions they are allowed to perform.

The risk is higher than with ordinary shadow AI tools because agents can act, not just assist. An unmanaged agent may store sensitive information, use personal or shared credentials, connect to unauthorized applications, or make changes in business systems without proper logging. To reduce this risk, organizations should maintain an inventory of AI agents, require registration and ownership, enforce identity and access controls, monitor agent activity, and provide approved alternatives so employees are not pushed toward unmanaged tools.

Security Threats

Agentic AI expands the attack surface because agents interact with prompts, files, users, APIs, plugins, databases, browsers, third-party services, and internal systems. Threats include prompt injection, data leakage, excessive permissions, credential exposure, insecure tool use, memory poisoning, malicious instructions hidden in external content, and compromised integrations. Attackers may attempt to manipulate an agent into ignoring rules, revealing sensitive data, taking unauthorized actions, or using trusted tools for harmful purposes.

Traditional application security controls are not always sufficient because agents make dynamic decisions based on context. Security programs should apply least-privilege access, isolate high-risk tools, validate inputs and outputs, restrict sensitive actions, protect credentials, log agent decisions, and monitor unusual behavior. Agents should also be treated as digital identities with defined permissions, lifecycle management, and revocation procedures. The more authority an agent has, the stronger its security controls and human oversight should be.

Related content: Read our guide to the top agentic AI security risks and ways to mitigate them.

Shadow MCP Servers

Shadow MCP servers are unapproved Model Context Protocol servers that connect AI agents to tools, files, databases, applications, or other enterprise resources without formal review. Because MCP servers can expose capabilities to agents in a standardized way, they can significantly increase productivity, but they can also create serious governance and security risks when deployed outside approved controls. An unmanaged MCP server may expose sensitive data, grant excessive tool access, bypass normal security checks, or introduce untrusted third-party code into agent workflows.

These servers can also create hidden attack paths through tool poisoning, prompt injection, weak authentication, poor logging, insecure configuration, or unclear ownership. Since agents may rely on MCP server descriptions and tool metadata to decide what actions to take, malicious or poorly designed servers can influence agent behavior in ways that are difficult for users to detect. Organizations should require MCP server registration, security review, access scoping, authentication, logging, approval workflows, and continuous monitoring before allowing MCP servers to interact with enterprise AI agents or sensitive systems.

Key Components of Agentic AI Governance

While agentic AI governance is rapidly evolving, as of the time of this writing, here are some of the essential elements of a governance program.

1. Real-Time Monitoring and Control

Real-time monitoring is necessary for maintaining oversight of agentic AI systems. Continuous observation allows organizations to detect anomalous behavior, operational failures, or policy violations as they occur. Monitoring solutions must provide granular visibility into agent actions, data flows, and interactions with APIs and other systems. By aggregating and analyzing logs in real time, organizations can identify issues and intervene before they escalate into major incidents.

Control mechanisms are also important for governance. These include automated response workflows, kill switches, and throttling controls that can halt or limit agent activity when risks are detected. Integrating monitoring with automated controls supports rapid containment of threats and reduces the likelihood of business disruption. Together, real-time monitoring and control support responsive agentic AI governance.

2. Access and Policy Enforcement

Access control ensures that AI agents only interact with resources, data, and APIs that are necessary for their operation. This involves defining and enforcing permissions at a granular level, applying the principle of least privilege. Policy enforcement mechanisms ensure that agents comply with organizational rules, regulatory requirements, and ethical guidelines. These policies can cover data usage, transaction limits, workflow boundaries, and acceptable behaviors.

Automated enforcement of access and policy rules is important in environments where agents operate at scale and speed. Dynamic policy engines and identity management systems can adjust permissions based on context, risk level, or operational status. By embedding access and policy enforcement into agentic AI workflows, organizations reduce the risk of unauthorized actions, data exposure, and regulatory noncompliance.

3. Accountability and Transparency

Accountability in agentic AI governance means ensuring that all actions taken by autonomous agents can be traced back to responsible parties. This requires audit trails, clear ownership structures, and mechanisms for assigning responsibility for agent behavior and outcomes. Transparent logging and reporting are necessary for internal oversight and external compliance, enabling organizations to demonstrate control over AI operations.

Transparency also extends to the decision-making processes of AI agents. Organizations should document how agents are designed, trained, and deployed, including the logic and data sources behind their actions. Providing explanations for agent decisions builds trust with stakeholders and regulators and supports root cause analysis when issues arise. By prioritizing accountability and transparency, organizations can foster responsible AI use.

4. Human in the Loop

Human in the loop (HITL) is a governance approach that embeds human oversight into critical stages of agentic AI operation. This ensures that humans review, validate, or approve decisions and actions taken by AI agents, especially in high-risk or sensitive scenarios. HITL can be implemented through approval workflows, escalation procedures, and manual overrides, providing a safeguard for situations where automated decisions may have significant consequences.

Integrating HITL processes improves the reliability and ethical alignment of agentic AI systems. It also enables organizations to balance the efficiency gains of automation with the need for human judgment and accountability. By designing workflows that require human involvement at key decision points, organizations can reduce the risks of automation bias, emergent behaviors, and operational errors.

5. Agent Observability and Runtime Control

Agent observability is the ability to see, reconstruct, and explain what an AI agent is doing during operation. This includes visibility into prompts, plans, tool calls, retrieved context, memory updates, identity used, permissions exercised, external systems accessed, intermediate reasoning artifacts where appropriate, approvals, errors, and final actions.

Observability is especially important for agentic AI because the risk is not limited to a single model output; risk can emerge across a sequence of delegated actions, API calls, tool invocations, and context changes. Agentic AI can create obscure event records, along with expanded attack surfaces, privilege creep, and behavioral misalignment, which makes traceability a core governance requirement.

Runtime control turns observability into intervention. Organizations need controls that can enforce policy while the agent is operating, not only during pre-deployment review. These controls may include allowlists and denylists for tools, step-up authentication for sensitive actions, just-in-time permission grants, rate limits, transaction thresholds, sandboxing, session isolation, automated blocking, human approval gates, and emergency kill switches.

Key Agentic AI Governance Frameworks

Agentic AI Governance Frameworks at a Glance

The following table summarizes the primary governance frameworks for agentic AI. We explore each one in more detail below.

FrameworkRelevant ForKey RequirementsCIS MCP Companion GuideGoverning MCP servers, agent-tool connectivity, and agent access controlsMCP inventory, authentication, authorization, logging, secure configuration, monitoringOWASP Top 10 for Agentic ApplicationsSecuring autonomous agents and agentic workflowsThreat modeling, least privilege, observability, secure tool use, incident responseISO/IEC 42001:2023Enterprise AI governance and management systemsRisk management, accountability, documentation, human oversight, continuous improvementEU AI ActRegulatory compliance for AI systems operating in the EURisk management, transparency, human oversight, traceability, cybersecurity, conformity assessmentsNIST AI Risk Management FrameworkManaging AI risk throughout the AI lifecycleRisk identification, measurement, governance, monitoring, communication, lifecycle controls

1. CIS Model Context Protocol (MCP) Companion Guide

The CIS Model Context Protocol (MCP) Companion Guide applies CIS Controls v8.1 to environments where AI agents interact with tools, APIs, data sources, and enterprise systems through MCP. It focuses on securing the protocol layer that enables agent actions, tool execution, and access to organizational resources.

As MCP adoption grows, it becomes an important governance layer because it controls how agents discover capabilities and interact with external systems. The guide helps organizations establish controls around agent permissions, integrations, monitoring, and operational security in MCP-based environments.

Relevant for: Organizations deploying MCP servers, agent platforms, AI gateways, and tool-connected AI agents.

Key requirements:

• Maintain an inventory of MCP servers and connected tools
• Implement authentication and authorization controls
• Enforce least-privilege access
• Log and monitor agent tool activity
• Apply secure configuration and vulnerability management

2. OWASP Top 10 for Agentic Applications

The OWASP Top 10 for Agentic Applications is a security framework designed to address the most significant risks affecting autonomous AI systems. It focuses on agents that can plan tasks, make decisions, use tools, and take actions across multiple systems and workflows.

The framework helps organizations identify common attack paths and governance failures before agents are deployed into production. It is commonly used for threat modeling, security reviews, red teaming, and the design of security controls for agentic applications.

Relevant for: Security teams, AI engineering teams, and organizations deploying autonomous AI agents.

Key requirements:

• Conduct threat modeling and risk assessments
• Enforce least-privilege permissions
• Monitor agent behavior and tool usage
• Secure agent-tool interactions
• Establish incident response procedures

3. ISO/IEC 42001:2023

ISO/IEC 42001 is the first international management system standard dedicated to AI governance. It provides a structured framework for managing AI risks, responsibilities, policies, and operational controls across the entire AI lifecycle.

Unlike technical security frameworks, ISO/IEC 42001 focuses on governance processes and organizational oversight. It helps organizations establish repeatable AI governance practices and demonstrate that AI systems are managed through formal accountability and risk management processes.