Blog
Notes from the
detection layer.
Plain-language writing on behavioral detection: what it measures, where it stops, and how to turn it into a policy you can defend.
Measurement is not proof (and why that is fine)
A detection score is an estimate, not a verdict of identity. That is not a weakness — it is the only honest way to describe what session scoring can do.
Read the postFrom a bot score to a policy: allow, flag, block
A score is not a decision. This is how the bands, verdicts, and actions fit together, and why enforcement belongs on your server.
Read the postSigned vs spoofed agents: Web Bot Auth in practice
Agents are increasingly signing their requests. Here is how verified, spoofed, and unresolved signers differ, and why an unknown signer should never be punished.
Read the postMAKE THE NEXT REQUEST MAKE SENSE.
See the evidence
for yourself.
One script on your site.
One API call from your server.
Every signal behind the verdict, in your own portal.