Simon Wijckmans
Founder and CEO of cside. Previously a product manager on Cloudflare Page Shield (now Cloudflare Client-Side Security). Co-chair of the W3C Anti-Fraud Community Group and a Forbes 30 Under 30 honoree. Building accessible security against client-side attacks, web security is not an enterprise-only problem.
Articles by Simon Wijckmans
cside Wins the SourceForge Fall 2026 Leader Award
SourceForge named cside a Fall 2026 Leader, an award for products whose user reviews rank in the top 5% of the 100,000 products listed on SourceForge.
Simon WijckmansOct 6, 202610 best browser fingerprinting tools in 2026
Compare the 10 best browser fingerprinting tools in 2026, from open-source libraries to fraud platforms, ranked with cside first for fraud signals.
Simon WijckmansOct 5, 20269 best credential stuffing prevention tools in 2026, ranked
The best credential stuffing prevention tools for 2026, ranked, with cside first for device and bot detection, then 8 real tools compared honestly.
Simon WijckmansAug 21, 20269 best device fingerprinting software in 2026, ranked and compared
The 9 best device fingerprinting software options for 2026, ranked, with cside first for a device ID plus a real-time fraud verdict from one first-party script.
Simon WijckmansAug 21, 2026Best device intelligence for fraud prevention: 9 tools ranked for 2026
The best device intelligence for fraud prevention in 2026, ranked. cside first for device ID plus a fraud verdict, then 8 real vendors compared.
Simon WijckmansAug 21, 2026Best device intelligence platforms in 2026, ranked and compared
Compare the best device intelligence platforms for 2026, ranked, with cside first for device ID plus AI agent, VPN, and bot detection from one script.
Simon WijckmansAug 21, 20268 best digital skimming protection tools in 2026, ranked
Compare the 8 best digital skimming protection tools for 2026, ranked, with cside first for real-session script monitoring and PCI DSS coverage.
Simon WijckmansAug 21, 20268 best Castle alternatives in 2026, cside compared
Looking for a Castle alternative? Compare 8 tools side by side: cside starts at $99/mo with specialized AI agent detection, PCI DSS coverage, and a free tier. Ranked for Q4 2026.
Simon WijckmansAug 21, 2026DataDome Pricing in 2026: Plans, Costs, and a Cheaper Alternative
What DataDome actually costs in 2026: its quote-based model, the public AWS Marketplace tiers, and how cside compares from $99/month with a free tier.
Simon WijckmansAug 21, 2026DataDome vs Cloudflare: bot and client-side security compared (2026)
DataDome vs Cloudflare compared for bot management and client-side security: deployment, pricing, and use cases, plus where cside fits as a first-party third option.
Simon WijckmansAug 21, 2026DataDome vs Imperva: bot and client-side protection compared (2026)
DataDome vs Imperva compared for bot management and client-side protection: positioning, pricing, and use cases, plus where cside fits.
Simon WijckmansAug 21, 2026Ecommerce Fraud Prevention: A Practical Guide for 2026
A practical ecommerce fraud prevention guide: the main fraud types, how to stop each one, and a layered defense framework from browser to checkout.
Simon WijckmansAug 21, 2026FingerprintJS pricing in 2026: free library vs Fingerprint Pro, explained
A clear guide to FingerprintJS pricing in 2026: the free open-source library versus Fingerprint Pro's per-API-call plans, plus a cheaper alternative.
Simon WijckmansAug 21, 20268 best GreyNoise alternatives and competitors in 2026
GreyNoise labels internet scan noise and IP reputation. Compare 8 GreyNoise alternatives for 2026, plus where cside adds browser-session signals.
Simon WijckmansAug 21, 2026How to prevent fake job applicants: a step-by-step guide for 2026
How to prevent fake job applicants: verify identity, read device and network signals during the application, and spot the red flags before you hire.
Simon WijckmansAug 21, 2026How to Prevent JavaScript Injection: A Practical Step-by-Step Guide
A practical guide to preventing JavaScript injection: fix XSS, lock down third-party scripts with CSP and SRI, and monitor real browser sessions.
Simon WijckmansAug 21, 20269 best IPQualityScore alternatives in 2026, cside compared
Looking for an IPQualityScore alternative? Compare 9 IPQS alternatives for 2026, ranked, with cside first for first-party device and VPN detection.
Simon WijckmansAug 21, 2026Jscrambler pricing in 2026: plans, model, and what to expect
A buyer's guide to Jscrambler pricing in 2026: its quote-based model, the two products it sells, and how it compares to cside's public client-side security prices.
Simon WijckmansAug 21, 20269 best Kount alternatives and competitors in 2026, ranked
Looking for a Kount alternative? Compare the 9 best fraud-prevention platforms for 2026, ranked, with cside first for device intelligence and chargeback proof.
Simon WijckmansAug 21, 2026Online payment fraud prevention: a practical guide for 2026
A practical guide to online payment fraud prevention: the main fraud types, the prevention layers that stop them, and where device evidence at checkout fits.
Simon WijckmansAug 21, 2026PerimeterX Pricing in 2026: What HUMAN Security Costs (and a Transparent Alternative)
PerimeterX (now HUMAN Security) has no public pricing. Here is the known model in 2026, its modules, and a transparent, listed-price alternative.
Simon WijckmansAug 21, 20269 best Sardine alternatives in 2026, compared
Looking for a Sardine alternative or competitor? Compare the 9 best fraud and device-intelligence options for 2026, ranked, with honest verdicts.
Simon WijckmansAug 21, 20269 best SEON alternatives in 2026, cside compared
Looking for a SEON alternative? Compare the 9 best SEON competitors for 2026, with cside ranked first for device intelligence and fraud signals.
Simon WijckmansAug 21, 2026SEON vs Fingerprint: fraud detection compared (2026)
SEON vs Fingerprint compared for fraud detection: positioning, pricing, and use cases, plus where cside fits as a first-party third option.
Simon WijckmansAug 21, 20267 best Stytch alternatives in 2026, ranked for auth and fraud teams
Comparing Stytch alternatives? Here are 7 real auth and CIAM options ranked, plus where cside fits as a complementary device and fraud signal layer.
Simon WijckmansAug 21, 20269 best ThumbmarkJS alternatives in 2026, ranked and compared
Looking for a ThumbmarkJS alternative? Compare the 9 best options for 2026, ranked, with cside first for a first-party device ID plus a fraud verdict.
Simon WijckmansAug 21, 2026What Causes Third-Party JavaScript Security Risks
Third-party scripts execute with full browser access. Learn what makes third-party JavaScript a security risk and why server-side tools miss it.
Simon WijckmansAug 19, 2026What Is Data Skimming Protection for Ecommerce
Data skimming steals card data in the browser, invisible to server tools. Learn what data skimming protection is and how to stop Magecart attacks.
Simon WijckmansAug 19, 2026What Is a Business Associate Agreement (BAA)? HIPAA BAAs Explained
A Business Associate Agreement (BAA) is a HIPAA-required contract between a covered entity and a vendor that handles protected health information on its behalf, binding the vendor to safeguard that data. This guide explains what a BAA covers, who needs one, and why some website vendors refuse to sign.
Simon WijckmansAug 18, 2026What Is an Approved Scanning Vendor (ASV)? PCI ASV Scans Explained
An Approved Scanning Vendor (ASV) is a company certified by the PCI Security Standards Council to run the external vulnerability scans that PCI DSS requirement 11.3.2 mandates every quarter. This guide explains what an ASV scan covers, how it differs from internal scans and penetration tests, and what it cannot see.
Simon WijckmansAug 18, 2026What Is Cardholder Data (CHD)? PCI Definitions, CDE, and SAD Explained
Cardholder data (CHD) is the payment card information PCI DSS exists to protect: the primary account number alone or with the cardholder's name, expiration date, or service code. This guide defines CHD, sensitive authentication data (SAD), and the cardholder data environment (CDE), and explains what each means for scope.
Simon WijckmansAug 18, 2026What Is Customer Journey Hijacking? How Injected Scripts Steal Shoppers
Customer journey hijacking is the manipulation of a visitor's session by unauthorized code (injected ads, forced redirects, swapped affiliate tags) that diverts them away from the intended purchase path. This guide explains how it happens, what it costs, and how to see it on your own site.
Simon WijckmansAug 18, 2026What Is DOM-Based XSS? How DOM Cross-Site Scripting Works
DOM-based XSS is a cross-site scripting attack where the vulnerability lives entirely in client-side JavaScript: the page's own code reads attacker-controlled input and writes it into the DOM unsafely. This guide explains how it differs from reflected and stored XSS, common sources and sinks, and how to detect it.
Simon WijckmansAug 18, 2026What Is ePHI? Electronic Protected Health Information Under HIPAA Explained
ePHI is electronic protected health information: any individually identifiable health data that is created, stored, or transmitted electronically, and that HIPAA requires covered entities and business associates to safeguard. This guide defines ePHI, distinguishes it from PHI and de-identified data, and lists the 18 HIPAA identifiers.
Simon WijckmansAug 18, 2026What Is JavaScript Injection? Script Injection Attacks Explained
JavaScript injection is the insertion of attacker-controlled script into a web page so it executes in visitors' browsers with the page's full privileges. This guide covers the injection paths (XSS, compromised third parties, extensions), what injected scripts actually do, and how to detect them.
Simon WijckmansAug 18, 2026PCI DSS Report on Compliance (RoC): What It Is and When You Need One
A PCI DSS Report on Compliance is required for Level 1 merchants and service providers. Learn what a RoC covers, who signs it, and how to prepare.
Simon WijckmansAug 18, 2026What Is PII Harvesting? How Scripts Collect Personal Data at Scale
PII harvesting is the systematic collection of personally identifiable information from websites and forms, usually by scripts that read what users type, sometimes criminal, sometimes an over-collecting vendor tag. This guide explains the techniques, the difference from PII itself, and how to see harvesting on your own pages.
Simon WijckmansAug 18, 2026What Is RASP? Runtime Application Self-Protection Defined
RASP (Runtime Application Self-Protection) is a security technology that runs inside an application and blocks attacks from within at runtime, using the application's own context. This guide defines RASP, compares it to WAFs, and explains where its server-side model stops, and what plays the equivalent role in the browser.
Simon WijckmansAug 18, 2026What is SAQ D? Complete Guide for Merchants and Service Providers
SAQ D is the longest PCI DSS self-assessment questionnaire and applies to the widest scope. Understand who needs it, what it covers, and how to prepare.
Simon WijckmansAug 18, 2026What Is That Tracker? A Field Guide to the Domains in Your Network Tab
You open DevTools and see requests to doubleclick.net, adnxs.com, clarity.ms, scorecardresearch.com, domains you never added. This guide explains what the most common tracker domains actually are, who operates them, what data they touch, and when an unknown domain in your network tab is a real problem.
Simon WijckmansAug 18, 2026What Is Web Tracking? How Websites Identify and Follow Visitors
Web tracking is the collection of data about visitors' behavior across websites, using cookies, pixels, fingerprinting, and session-replay scripts. This guide explains how each technique works, who is doing the tracking, what the law requires, and how site owners can see what their own pages are collecting.
Simon WijckmansAug 18, 2026Carding Attack: What It Is and How to Detect the Automation Behind It
A carding attack tests stolen or generated card numbers against your checkout at scale. Understand the attack, spot the browser-layer signature, and stop it.
Simon WijckmansAug 17, 2026Card Not Present Fraud: How CNP Attacks Work and How to Prevent Them
Card not present fraud drives most online payment losses. Understand how CNP attacks work, the browser signals that expose them, and the controls that stop them.
Simon WijckmansAug 17, 2026What is PCI DSS? A Practical Guide to the Payment Card Industry Data Security Standard
PCI DSS is the security standard every business handling payment cards must follow. Understand the 12 requirements, compliance levels, and how to prepare.
Simon WijckmansAug 17, 2026Phia cookie stuffing: forced clicks and ad hijacking
How Phia's forced affiliate clicks and ad hijacking worked, and six tests merchants can run on their own order data.
Simon WijckmansAug 15, 2026PCI DSS Requirements: The 12 Requirements Explained (4.0.1)
PCI DSS has 12 requirements grouped under six security goals. Understand what each requires, what changed in 4.0.1, and where most environments have gaps.
Simon WijckmansAug 14, 2026What is a BIN Attack? How to Detect and Stop Automated Card Testing
A BIN attack tests thousands of stolen or generated card numbers against your checkout. Detect the browser-layer signature and stop it before it costs you.
Simon WijckmansAug 14, 2026What is an AI Agent? Definition, Examples, and What It Means for Your Website
An AI agent is a system that uses an LLM to complete multi-step tasks autonomously. Understand the definition, examples, and why agents change website security.
Simon WijckmansAug 14, 2026Browser Fingerprinting for Fraud Prevention: How It Works and Why It Matters
Browser fingerprinting produces a stable identifier from dozens of browser properties. Understand how it works, how it differs from device fingerprinting, and where it fits.
Simon WijckmansAug 13, 2026How to Detect Anthropic Computer Use on Your Website
Anthropic's Computer Use agent controls a real browser to complete tasks. Detect the signature at the browser layer before the agent transacts on your site.
Simon WijckmansAug 13, 2026What is Account Takeover (ATO)? Definition, Attack Patterns, and Prevention
What is ATO? Account takeover (ATO) is one of the most common online fraud vectors. Understand what ATO is, the attack patterns behind it, and how to stop it at the browser layer.
Simon WijckmansAug 13, 2026What is device intelligence? A plain-English guide to how it works
Device intelligence builds a stable device identifier from browser signals, not cookies, so it survives VPNs, incognito mode, and cookie clearing.
Simon WijckmansAug 12, 2026Transaction and Payment Fraud Detection Software: The Checkout Evidence Gap
Payment fraud detection software has to capture browser session evidence at checkout, not after, so merchants can win chargeback disputes later.
Simon WijckmansAug 11, 2026What are device-bound sessions? How they stop session hijacking
Device-bound sessions tie an authenticated session to the device that created it, so a stolen token replayed from another device is rejected.
Simon WijckmansAug 11, 2026What is CTEM? Continuous Threat Exposure Management explained
CTEM is a continuous security framework for discovering, prioritizing, and validating exposures across your attack surface, including the browser layer.
Simon WijckmansAug 11, 2026How to detect bots on your website in 2026
Detecting bots in 2026 means combining network, browser, and behavioral signals into one verdict that also flags AI agents like OpenAI Operator.
Simon WijckmansAug 10, 2026What is device fingerprinting? The definitive 2026 guide
Device fingerprinting identifies a device from 250+ browser, hardware and network signals that survive cookie-clearing, incognito mode and VPN use.
Simon WijckmansAug 10, 2026Fraud prevention software: full platforms vs signal layers explained
Fraud prevention software splits into transaction scoring platforms and browser-layer signal providers. Here is how each fits your fraud stack.
Simon WijckmansAug 7, 2026Password sharing detection tools for SaaS: what works and what doesn't
Device fingerprinting catches colleagues sharing one SaaS login across multiple desktops, the abuse that IP-based and authentication-only tools miss.
Simon WijckmansAug 7, 2026What is account takeover fraud? Definition, mechanics, and prevention
Account takeover fraud uses stolen credentials to hijack real accounts. Learn how credential stuffing attacks work and how to detect them at login.
Simon WijckmansAug 7, 2026iGaming fraud prevention: AI agents, ATO, and PCI compliance
iGaming fraud prevention spans AI agent promo abuse, account takeover on player accounts, and PCI DSS 4.0.1 script monitoring on deposit pages.
Simon WijckmansAug 6, 2026How to block AI agents on your website: a practical implementation guide
AI agents pass WAF and CDN filters because they run in real browsers. Blocking them takes a browser-layer script that reads signals inside the session.
Simon WijckmansAug 5, 2026How to dispute a chargeback as a merchant: evidence and process guide
Disputing a chargeback means filing a representment package before your card network deadline, backed by delivery proof and device evidence.
Simon WijckmansAug 5, 2026What is a fraud detection API? How it works and what to look for
A fraud detection API returns a device fingerprint, AI agent flag, VPN status, and risk score in real time before a login or checkout completes.
Simon WijckmansAug 4, 2026Multi-accounting detection software: stop bonus abuse and referral fraud
Multi-accounting detection software links accounts to the same device fingerprint, catching bonus abuse and referral fraud before payouts go out.
Simon WijckmansAug 4, 2026iGaming fraud detection: bonus abuse, ATO, and PCI compliance in 2026
iGaming fraud spans AI-agent bonus abuse, wallet account takeover, VPN multi-accounting, and deposit-page skimming. Here is how to detect each one.
Simon WijckmansAug 3, 2026PCI DSS compliance cost in 2026: what you will actually pay
PCI DSS compliance cost runs from about $5,000 a year for small merchants to over $5 million for enterprises, and automation cuts the biggest drivers.
Simon WijckmansAug 3, 2026Bot protection in 2026: why browser-layer detection catches what WAFs miss
AI agents run inside real Chromium browsers and slip past WAFs. Browser-layer detection reads canvas entropy and session cadence to catch them.
Simon WijckmansJul 31, 2026Chargeback fraud prevention: how device evidence wins disputes in 2026
Chargeback fraud prevention hinges on device evidence captured at checkout, the proof Visa CE 3.0 accepts when you contest a card-not-present dispute.
Simon WijckmansJul 31, 2026Account takeover solutions: understanding the category before you build a shortlist
Account takeover solutions span four layers: WAF, MFA, browser device intelligence, and behavioral analytics. No single vendor covers them all.
Simon WijckmansJul 30, 2026Best account sharing detection software 2026: an honest comparison
Device fingerprinting counts how many distinct devices sit behind one login, catching the seat abuse that IP-based tools and MFA controls miss.
Simon WijckmansJul 30, 2026Fake account detection: why email verification is not enough in 2026
Email verification and CAPTCHA confirm an endpoint, not a person. Device fingerprinting is what catches fake account signups at registration.
Simon WijckmansJul 30, 2026Best VPN detection software 2026: TLS handshake fingerprint TLS fingerprinting vs IP blocklists
The best VPN detection tools use TLS handshake fingerprint TLS fingerprinting to catch the residential proxies and VPN configurations that IP blocklists miss entirely.
Simon WijckmansJul 29, 2026PCI DSS compliance checklist 2026: Requirements 6.4.3 and 11.6.1 explained
Requirements 6.4.3 and 11.6.1 became mandatory in March 2025. Here is what belongs on a modern PCI DSS compliance checklist, and how to automate it.
Simon WijckmansJul 29, 2026Card testing fraud prevention software: how to stop automated card validation at checkout
See how browser-layer detection stops automated card testing at checkout using session behavior, AI agent signals, and device fingerprinting.
Simon WijckmansJul 28, 2026What Is Formjacking? How Attackers Steal Card Data in Real Time
Formjacking injects JavaScript into checkout pages to steal payment data in real time. WAFs and CSPs cannot stop it. Learn how the attack works and how to detect it.
Simon WijckmansJul 28, 2026What is credential stuffing? Definition, examples, and detection
Credential stuffing tests stolen username and password pairs from breaches against other sites. Learn how it works and how device signals catch it.
Simon WijckmansJul 28, 2026Account sharing detection: how to identify seat abuse before it costs you revenue
Account sharing detection spots when several people share one login. See how device fingerprinting flags seat abuse without adding user friction.
Simon WijckmansJul 27, 2026Best bot protection and mitigation software in 2026: 6 tools
Compare six bot protection and mitigation tools for 2026 by detection layer: network-edge platforms that stop volumetric attacks, and browser-layer tools that catch AI agents operating inside real browser sessions.
Simon WijckmansJul 27, 2026How to get the browser time zone in JavaScript (2026 guide)
Get the browser time zone in JavaScript with one line of Intl code, read the UTC offset, handle DST, and use the zone as a fraud signal.
Simon WijckmansJul 27, 2026Browser Fingerprint Spoofing: How Attackers Bypass Detection and How to Stop Them
How attackers spoof browser fingerprints to evade fraud detection, and why layered signals catch what canvas-and-UA spoofing cannot.
Simon WijckmansJul 26, 2026Applicant fraud detection software: identifying fake job applicants before they are hired
Applicant fraud detection software flags fake job applicants by analyzing device, network, and location signals during the application session.
Simon WijckmansJul 24, 2026Bank fraud prevention software: how browser-layer signals close the detection gap
Bank fraud prevention software must catch account takeover, new account fraud and synthetic identity fraud, and each vector leaves a browser-layer signal.
Simon WijckmansJul 24, 2026How to comply with PCI DSS 4.0.1 Requirement 6.4.3: a practical checklist
PCI DSS 6.4.3 requires a full inventory of every payment page script, with authorization, justification, and integrity controls for each one.
Simon WijckmansJul 24, 2026Best Magecart protection software 2026: script integrity on payment pages
Compare the best Magecart protection software for 2026, and see how real-time script monitoring meets PCI DSS 4.0.1 Requirements 6.4.3 and 11.6.1.
Simon WijckmansJul 23, 2026Best privacy monitoring software 2026: beyond cookie consent
The best privacy monitoring software watches what third-party scripts actually do in the browser at runtime, not just which cookies a page sets.
Simon WijckmansJul 23, 2026How to detect and prevent credential stuffing in 2026: three signals that actually work
Detect and prevent credential stuffing with three signals that survive IP rotation: cross-account device reuse, new-device logins, and proxy detection.
Simon WijckmansJul 23, 2026Account takeover fraud detection: how browser-layer signals catch ATO before login
Browser-layer signals flag attacker sessions before login completes, catching credential-stuffing attempts before any account is compromised.
Simon WijckmansJul 22, 2026AI agent security: why traditional bot detection cannot see the new threat
Autonomous AI agents run inside real browsers and slip past WAFs and CDN bot filters. Here is how browser-layer signals catch them per session.
Simon WijckmansJul 22, 2026The 8 best CAPTCHA alternatives in 2026
CAPTCHAs are dead, and bots solve them faster than humans in 2026. Here are the eight replacements web teams actually deploy, ranked by user friction and bot resistance.
Simon WijckmansJul 22, 2026Best chargeback evidence software 2026: win more disputes with session-level proof
Chargeback evidence software captures device fingerprint and session behavior at checkout, so merchants can prove what happened when disputes land.
Simon WijckmansJul 22, 2026Best Chargeback Software: 10 Prevention Platforms for 2026
Chargeback prevention software stops disputes before they reach your acquirer. Ranked by VAMP fit and evidence quality: the 10 platforms for 2026.
Simon WijckmansJul 22, 2026The 10 best fraud detection software platforms in 2026
The fraud detection software fraud teams actually pick in 2026, ranked by browser-layer evidence, explainability, and false-positive economics.
Simon WijckmansJul 22, 2026The 10 best payment fraud detection software platforms in 2026
The payment fraud detection tools merchants actually pick in 2026, ranked by checkout evidence, Visa CE 3.0 support, and false-positive economics.
Simon WijckmansJul 22, 2026The 10 best transaction monitoring software platforms in 2026
The transaction monitoring tools compliance and fraud teams pick in 2026, ranked by AML fit, alert quality, and false-positive economics.
Simon WijckmansJul 22, 2026Cookie Theft and Session Hijacking: How Attackers Steal Sessions and How to Stop Them
Cookie theft is when an attacker captures a session token from a logged-in user and replays it to impersonate them. No password needed, no MFA prompt. Here is how the attack works and how to stop it.
Simon WijckmansJul 21, 2026Magento PCI Compliance: Meeting PCI DSS 4.0.1 on Magento Stores
Magento merchants are not automatically PCI DSS compliant. Here is what Requirements 6.4.3 and 11.6.1 demand, what ASV scans miss, and how to close the client-side gap.
Simon WijckmansJul 21, 2026What Is Price Scraping and How to Stop It (2026)
Price scrapers harvest your catalog prices in real time, feeding competitor repricing engines. IP blocks and CAPTCHAs fail. Browser-layer behavioral detection does not.
Simon WijckmansJul 20, 2026Homoglyph attacks in 2026: аpple.com is not apple.com (and how to actually detect the difference)
Homoglyph attacks use visually identical Unicode characters to register lookalike domains for phishing and script injection. Here is how they work, why browsers stopped protecting you, and what actually detects them.
Simon WijckmansJul 19, 2026TLS fingerprinting in 2026: what the ClientHello reveals (and where the signal fails)
TLS fingerprinting identifies the client library from the ClientHello handshake, before a single byte of HTTP is decrypted. Here is what it catches, what it misses, and where it belongs in a full detection stack.
Simon WijckmansJul 19, 20268 types of credit card fraud your CS team will see in 2026 (and how to spot each one)
The 8 credit card fraud patterns your CS and fraud teams will see in 2026, with the concrete signal that separates each one from a legitimate transaction.
Simon WijckmansJul 19, 2026Credential Harvesting: How Attackers Steal Passwords in 2026
Credential harvesting has moved from bulk phishing to session cookie theft, Evilginx style MFA bypass, and third party script injection at login. Here is how detection actually works.
Simon WijckmansJul 19, 2026What is cside? Browser-layer visibility for every visitor, human or agentic
cside is a browser-layer platform that gives security, fraud, privacy, and compliance teams visibility into what runs in every visitor's browser, human or agentic.
Simon WijckmansJul 19, 2026Friendly fraud in 2026: why the customer wins the chargeback (and how to actually fight back)
Friendly fraud is not fraud in the traditional sense. It is a legitimate cardholder disputing a charge they actually made. Here is why most merchants lose these disputes and what CE 3.0 evidence changes.
Simon WijckmansJul 19, 2026New Account Fraud: What It Is, the Main Types, and How Detection Works
New account fraud (NAF) is fraud committed using a newly opened account. It comes in three forms, synthetic identity fraud, genuine identity manipulation, and fake account creation, each exploiting a different gap in standard registration controls.
Simon WijckmansJul 18, 2026What Is a Laptop Farm? How Fraud Operators Scale Human-Like Attacks
A laptop farm is a physical setup where operators run multiple devices under separate identities to simulate distinct users. Learn how they work and how browser signals expose them.
Simon WijckmansJul 18, 2026How to Detect AI Agents and Stealth Browsers: The Signals That Give Them Away
A signal-by-signal guide to detecting stealth and anti-detect browsers: CDP and webdriver tells, headless quirks, font and WebGL drift, and behavior.
Simon WijckmansJul 15, 2026Does Shopify Make You PCI Compliant? What 6.4.3 & 11.6.1 Still Require
Shopify is a PCI DSS Level 1 service provider, but that certifies Shopify's own systems, not your storefront. Requirements 6.4.3 and 11.6.1 stay yours.
Simon WijckmansJul 15, 2026Ecommerce Fraud Prevention Software: 10 Best Platforms 2026
10 best ecommerce fraud prevention software platforms for 2026, scored on browser-layer evidence, false-positive cost, and PCI DSS 4.0.1 coverage.
Simon WijckmansJul 15, 2026Bot Detection in the Age of AI Agents: Why Legacy Tools Miss Them
Edge bot tools score IPs, user agents, and rate. AI agents beat each. A gap-by-gap look at where legacy detection breaks and what browser signals add.
Simon WijckmansJul 14, 2026Detect AI agents by behavior: mouse, scroll, typing
Behavioral signals catch AI agents that pass CAPTCHA and rotate IPs: mouse paths and keystroke timing automation can't fake. See how cside scores it.
Simon WijckmansJul 14, 2026How to Detect Account Takeover Before It Happens: Browser and Device Signals
Instrument browser and device signals that fire before account takeover: fingerprint drift, headless and stealth-browser tells, proxy, and velocity.
Simon WijckmansJul 14, 2026PCI DSS Requirement 11.6.1 Explained
What PCI DSS Requirement 11.6.1 mandates for payment page tamper detection: the control text, the 2025-03-31 deadline, and the evidence a QSA expects.
Simon WijckmansJul 14, 2026Browser-Layer Script Activity Logging and Incident Response: Complete Guide for 2026
SIEM and EDR tools log the endpoint. WAFs log the network. Neither logs what third-party scripts do inside your users' browsers. This guide covers what browser-layer script activity logging captures and how incident response works when a script on your site is compromised.
Simon WijckmansJul 13, 2026Magecart Attacks Explained: How Web Skimming Works in the Browser
A plain explainer of how Magecart web skimming works: how the code gets in, how it reads your form fields, and how it exfiltrates card data unseen.
Simon WijckmansJul 13, 2026JavaScript Security Vulnerabilities: How Obfuscated Scripts Evade CSP and How to Stop Them
Why CSP cannot stop obfuscated JavaScript attacks, and what browser-layer behavioral monitoring adds that source allowlists cannot.
Simon WijckmansJul 12, 2026AI Agent and Bot Detection: Telling Humans, Good Bots, and Malicious Agents Apart
A classification taxonomy and intent-based enforcement model for separating humans, good bots, and malicious agents, then deciding what each one gets.
Simon WijckmansJul 11, 2026How AI Agents Break Account Security and How to Detect Bot-Driven ATO
How AI agents drive account takeover through credential replay, session and token reuse, and recovery abuse, and the browser signals that expose them.
Simon WijckmansJul 11, 2026Adyen and PCI DSS: What the Processor Covers vs. What You Must Do
Map the PCI DSS 6.4.3 and 11.6.1 script-ownership boundary to each Adyen integration: Hosted Pages, Drop-in, Components, and API-only checkout flows.
Simon WijckmansJul 10, 2026Formjacking vs Magecart vs Digital Skimming: What's the Difference?
Digital skimming is the data-theft outcome, formjacking is the capture technique, and Magecart is the threat-actor ecosystem. Here is how they relate.
Simon WijckmansJul 10, 2026How to detect multi-account fraud in fintech and SaaS: device fingerprinting beyond velocity limits
Velocity rules catch the obvious multi-account operator. Device fingerprinting catches the one who rotates email providers and IPs.
Simon WijckmansJul 10, 2026Third-Party Script Risk Management: A Governance Framework
A governance framework for third-party script risk: inventory, ownership, data tiers, change monitoring, review cadence, RACI, and audit evidence.
Simon WijckmansJul 10, 2026Credential Stuffing: How to Detect and Stop It at the Login
Credential stuffing tests breached username and password pairs at scale. Learn the login signals that expose it and the layered controls that stop it.
Simon WijckmansJul 9, 2026Does Stripe Make You PCI Compliant? What PCI DSS 6.4.3 & 11.6.1 Still Require
Stripe shrinks your PCI DSS scope and can move you to SAQ A, but it does not make your site fully compliant. Requirements 6.4.3 and 11.6.1 stay yours.
Simon WijckmansJul 9, 2026How to Block AI Content Scrapers on Your Website
AI scrapers harvest pricing, product data, and content at scale. Learn the signal stack that exposes them, and protect data without blocking users.
Simon WijckmansJul 9, 2026How to convert account sharers into paying customers
Account sharers are not adversaries. They are unconverted customers who already chose your product.
Simon WijckmansJul 9, 2026How to build chargeback evidence that wins disputes: what risk scores and visitor IDs actually prove
A risk score is a model's opinion about a transaction. A visitor ID is a pseudonymous identifier.
Simon WijckmansJul 8, 2026Top Platforms for Detecting Autonomous AI Activity on the Web
Compare the top platforms for detecting autonomous, undeclared AI agents that browse real browser sessions with no user-agent on your live website.
Simon WijckmansJul 8, 2026What Is Online Card Skimming? How Attackers Steal Payment Card Data from Websites
Malicious JavaScript on checkout pages captures card numbers before encryption. How online card skimming works, real examples, and PCI DSS 4.0.1 requirements.
Simon WijckmansJul 8, 2026How to prevent account takeover: detecting credential attacks before they reach login
Risk engines and visitor IDs fire at the login event. The browser layer sees the attack setup before authentication starts.
Simon WijckmansJul 7, 2026Account sharing vs account takeover: what's the difference and why both cost you revenue
Account sharing and account takeover produce similar session signals but require completely different responses.
Simon WijckmansJul 6, 2026AI Agent Traffic Monitoring Tools for Enterprise
How enterprise CISOs monitor, report on, and govern AI agent traffic at scale: platform comparison, browser vs network layer, SIEM, procurement.
Simon WijckmansJul 6, 2026How much revenue are you losing to account sharing? Benchmarks and calculation framework
Account sharing revenue loss is calculable.
Simon WijckmansJul 5, 2026How to stop account sharing on streaming and OTT platforms
Password sharing enforcement on streaming platforms has become a mainstream conversation since Netflix's crackdown.
Simon WijckmansJul 4, 2026What Is Impossible Travel Detection and How Does It Work?
Impossible travel detection flags sessions where location jumps faster than physically possible. Learn how it works and what the browser layer adds.
Simon WijckmansJul 4, 2026How to prevent account sharing in SaaS: device fingerprinting vs session controls vs concurrent limits
Every shared SaaS seat is lost ARR. Session controls slow the leak; device fingerprint history closes it.
Simon WijckmansJul 3, 2026How to stop account sharing on online learning platforms: detecting credential sharing without blocking enrolled students
Online learning platforms see high rates of credential sharing driven by cost sensitivity. Concurrent session limits miss the most common pattern.
Simon WijckmansJul 2, 2026Which Client-Side Security Tools Give Real-Time Browser Attack Visibility?
Real-time browser attack visibility needs session monitoring, behavioural deviation detection, and sub-minute change detection. Six tools evaluated.
Simon WijckmansJul 2, 2026How to stop account sharing in hotel loyalty programmes: detecting credential misuse without blocking family accounts
Hotel loyalty programmes lose points revenue and status benefit value to three distinct sharing patterns.
Simon WijckmansJul 1, 2026Account sharing prevention in healthcare: protecting patient portal credentials and HIPAA compliance
Healthcare credential sharing is not a revenue problem. It is a compliance problem.
Simon WijckmansJun 30, 2026Best Client-Side Monitoring Platforms for Fintech in 2026
Fintech faces PCI DSS 4.0.1, GDPR, and financial PII risks general client-side security tools are not built for. Five platforms reviewed for 2026.
Simon WijckmansJun 30, 2026How to enforce device limits without cookies: GDPR-compliant account sharing prevention
Cookie-based device tracking fails under GDPR and fails in private browsing.
Simon WijckmansJun 29, 2026Script Monitoring for Websites: 5 Best Platforms Compared
Script monitoring detects third-party script behaviour in real browser sessions. Platforms compared on coverage, baselining, and PCI DSS evidence.
Simon WijckmansJun 29, 2026How to stop account sharing on gaming platforms: detecting boosting services and account selling without flagging households
Account sharing in gaming takes three distinct forms: boosting, account selling, and household access. Device fingerprint history tells them apart.
Simon WijckmansJun 28, 2026Client-Side Security for eCommerce and Fintech: Top Platforms in 2026
eCommerce and fintech sites face Magecart skimming and PCI DSS 4.0.1. Five client-side security platforms reviewed for payment-page script protection.
Simon WijckmansJun 28, 2026Why Sampling-Based Security Tools Miss Runtime Attacks on Gambling Platforms
Sampling tools watch under 10% of sessions, so geo-targeted and VIP attacks built to hit the unmonitored 90% pass clean audits while running live.
Simon WijckmansJun 28, 2026How to stop account sharing on ecommerce platforms: detecting shared memberships without blocking household shoppers
Ecommerce account sharing takes three distinct forms: subscription, loyalty, and business account sharing, each with its own detection signature.
Simon WijckmansJun 27, 2026How to Detect and Block Unknown AI Agents on Your Website
Unknown AI agents have no user-agent and ignore robots.txt. Learn the browser-layer signals that reveal undeclared agents and how to act on them.
Simon WijckmansJun 27, 2026UK Gambling Commission Licence Conditions and Third-Party Script Security: What Operators Need to Know
UKGC LCCP compliance requires a secure technical environment. Third-party scripts that redirect players or exfiltrate data create direct exposure.
Simon WijckmansJun 27, 2026Account sharing in B2B SaaS: how to enforce seat-based licensing without blocking legitimate teams
B2B SaaS seat sharing is the most under-detected form of credential abuse.
Simon WijckmansJun 26, 2026How to Block Playwright Automation on Your Website
Playwright runs real browsers that look identical to humans at the network layer. Here is how to detect it, and why robots.txt and IP blocks all fail.
Simon WijckmansJun 26, 2026Inside the Polymarket $3M client-side supply-chain attack
How attackers drained $3M from Polymarket through a compromised vendor script, without touching the smart contracts. Supply chain attack anatomy.
Simon WijckmansJun 26, 2026Shadow Tracking Pixels on Gambling Sites: The GDPR and Advertising Compliance Problem Operators Cannot See
Unauthorised Facebook, TikTok, or LinkedIn pixels on gambling sites trigger simultaneous GDPR and ad-platform liability. Here's why.
Simon WijckmansJun 26, 2026How to stop account sharing in airline loyalty programmes: detecting credential misuse without flagging frequent flyers
Frequent flyer accounts are shared in three distinct patterns, each with different revenue and compliance implications.
Simon WijckmansJun 25, 2026How to Block PerplexityBot on Your Website
PerplexityBot crawls your content for AI search results. Learn how to block it, why it faced copyright criticism, and how Perplexity Shopper differs.
Simon WijckmansJun 25, 2026Shadow GTM Containers on Multi-Brand Gambling Platforms: What They Are and How to Detect Them
Unauthorised GTM containers can run any JavaScript on your gambling domains. How shadow containers appear, what they do, and why tools miss them.
Simon WijckmansJun 25, 2026How to detect and prevent account sharing without hurting legitimate users
The biggest objection to account sharing detection is false positives: what if we flag a subscriber who is just using multiple devices?
Simon WijckmansJun 24, 2026How to Block GPTBot (and Why You Might Not Want To)
GPTBot crawls your site to train OpenAI models. Here is how to block it with robots.txt and IP ranges, plus what that block still leaves uncovered.
Simon WijckmansJun 24, 2026Session Recording Tools on Gambling Sites: The PII Exfiltration Risk Operators Are Missing
Session recording tools on gambling sites can silently exfiltrate player PII when misconfigured or compromised. Here are the three ways it happens.
Simon WijckmansJun 24, 2026Account sharing detection: how to close the enforcement gap that concurrent session limits miss
Concurrent session limits flag the obvious case. They do not distinguish between a single user on two devices and two people sharing one account.
Simon WijckmansJun 23, 2026How to Block Applebot-Extended on Your Website
Applebot-Extended is Apple's AI training crawler that feeds Apple Intelligence. Learn how it differs from Applebot and how to opt out via robots.txt.
Simon WijckmansJun 23, 2026How to Monitor Third-Party Scripts Across 100 or More Casino Domains
A practical guide to monitoring third-party scripts across 100-plus casino domains: script sprawl, cross-domain alerts, and scaling cside.
Simon WijckmansJun 23, 2026Agentic AI Security Risks for Websites: Privacy, Compliance, and Detection
Agentic AI browsers bypass cookie consent, execute real JavaScript, and create GDPR compliance gaps that CDN-level bot detection cannot see.
Simon WijckmansJun 22, 2026How to Block DeepSeekBot on Your Website
DeepSeekBot crawls your site for a Chinese AI company. Learn how to block it with robots.txt, IP rules, and the real data sovereignty risks it raises.
Simon WijckmansJun 22, 2026Malta Gaming Authority Compliance and Client-Side Script Security: What MGA-Licensed Operators Need to Cover
MGA rules require a secure, auditable platform. Third-party JavaScript on licensed sites is a compliance gap most operators have not audited.
Simon WijckmansJun 22, 2026Third-Party Script Attacks on iGaming Platforms in 2026: The New Attack Surface Operators Are Missing
Third-party JavaScript is the primary unmonitored attack surface on iGaming platforms. The seven attack classes, and why standard tools miss them.
Simon WijckmansJun 21, 2026GDPR and Online Gambling: Why Unauthorised Pixels Create a Dual Liability Problem
Unauthorised pixels on gambling sites trigger GDPR liability and ad-account bans at once, even when the operator never installed them. Here's why.
Simon WijckmansJun 20, 2026HIPAA Website Tracking Compliance: The Healthcare Guide to Third-Party Scripts
HHS OCR ruled that tracking pixels and third-party scripts on healthcare websites can expose PHI. Here's what covered entities must do to comply.
Simon WijckmansJun 20, 2026How to Block Bytespider (TikTok's AI Crawler)
Bytespider crawls your site for Bytedance's AI systems. Learn how to block it with robots.txt and IP ranges, and the data sovereignty concerns.
Simon WijckmansJun 20, 2026How Malicious Scripts Hijack Casino Player Journeys
Script-injected redirects divert casino players before they reach the lobby. Network tools miss them entirely. Here's how detection must work.
Simon WijckmansJun 19, 2026Client-Side Script Security for APAC Online Gambling Operators
How APAC online gambling operators in Japan, Singapore, the Philippines, and Australia can monitor third-party scripts across real player sessions.
Simon WijckmansJun 19, 2026How to Block Amazon Buy for Me on Your Website
Amazon Buy for Me shops your site for Prime users. Learn how it collects pricing and product data and how browser-layer detection gives you control.
Simon WijckmansJun 19, 2026How Compromised Affiliate Scripts Steal Online Casino Revenue
Compromised affiliate scripts redirect players, steal commissions, and manipulate UTM attribution on casino pages, silently and at scale.
Simon WijckmansJun 18, 2026How Browser Extensions Attack Online Casino Players: What Operators Can Do About It
Browser extensions can steal session tokens and hijack payments on casino sites. Here's how they attack, why servers miss it, and how to detect them.
Simon WijckmansJun 18, 2026How to Block CCBot (Common Crawl's AI Crawler)
CCBot feeds Common Crawl datasets used to train GPT-3, BLOOM, LLaMA, and many other AI models. Learn how to block it and what blocking actually does.
Simon WijckmansJun 18, 2026PCI DSS 6.4.3 Script Inventory and Authorization: How to Build the Record
The script inventory and authorization workflow for PCI DSS 6.4.3: what fields each record needs, who signs off, and a sample inventory row to copy.
Simon WijckmansJun 18, 2026How to Block AI-Powered Fake Account Creation with Signup Shield
AI agents create fake accounts with human-like behaviour that defeats CAPTCHA. Learn the browser-layer signals that reveal automated registrations.
Simon WijckmansJun 18, 2026How to Block ClaudeBot: IP Ranges, User-Agent and robots.txt (2026)
ClaudeBot crawls your site using the ClaudeBot/1.0 user-agent string and Anthropic's published IP ranges. Here is the exact robots.txt directive, the current IP list, and platform-specific firewall rules to stop it.
Simon WijckmansJun 16, 2026How to Prevent Fake Account Creation with cside Signup Shield: Why Browser-Layer Detection Catches What Email Verification Misses
Email verification confirms a mailbox exists. It cannot see the browser. Here is why browser-layer detection catches fake account creation it misses.
Simon WijckmansJun 15, 2026Web Supply Chain Attack Explained: The Polyfill[.]io Incident, Full Timeline & Lessons (2024-2026)
A web supply chain attack turns trusted third-party code against visitors. See how the Polyfill[.]io attack hit 490,000+ sites and what it teaches about JavaScript supply chain risk.
Simon WijckmansJun 14, 2026How to Choose an AI Agent Detection Solution
A five-step buying guide for CISOs evaluating AI agent detection solutions: architecture, classification, vendor profiles, and POC methodology.
Simon WijckmansJun 12, 2026How to Block OpenAI Operator on Your Website
OpenAI Operator browses your site like a real user. Learn how to detect and block it using browser-layer signals and when you should not block it.
Simon WijckmansJun 10, 2026DBSC vs Device Fingerprinting: What Chrome's Session Security Does Not Cover
Chrome's DBSC stops stolen-cookie replay, but it is Chrome-only, post-login, and not a device-identity layer. Here is the fraud it leaves open.
Simon WijckmansJun 9, 2026How to Block Perplexity Shopper on Your Website
Perplexity Shopper browses and buys from retail websites on behalf of Pro users. Learn how to detect its browser-layer signals and govern the traffic.
Simon WijckmansJun 9, 2026AI API security: when shared infrastructure returns another user's data
Shared caches, connection pools, and request routers make AI API security hard. Here's how cross-tenant response bleed happens and what to monitor in the browser.
Simon WijckmansJun 5, 2026Device Code Phishing: How OAuth Token Theft Bypasses MFA and How to Detect It
Device code phishing steals tokens after MFA passes. OAuth flow mechanics, FOCI blast radius, and session-layer detection of token replay.
Simon WijckmansJun 5, 2026AI is compressing the exploit cycle: Google's AI-developed zero-day and what it means for browsers
Google flagged a zero-day it believes was AI-developed. The real AI security shift isn't smarter phishing, it's how fast exploits reach the browser.
Simon WijckmansJun 3, 2026The Browser Session Is Now a Security Control Plane. Attackers Knew That Years Ago.
Google's DBSC proposal validates a clear security shift: browser sessions need device-aware validation after login, not only MFA.
Simon WijckmansMay 30, 2026Account Takeover Prevention Software: 10 Tools for 2026
Compare account takeover prevention software across identity, fraud, device, behavioral, and bot defense layers to find the right fit for your stack.
Simon WijckmansMay 27, 2026The Snowball Effect: How Mini Shai-Hulud Turns npm into a Worm Distribution Network
Mini Shai-Hulud turned npm packages into a credential-theft loop. Here is how the AntV wave spread and what teams should monitor next.
Simon WijckmansMay 19, 2026Why CAPTCHAs Are No Longer Reliable Bot Defense
CAPTCHAs are no longer a reliable primary bot defense. Learn why visible challenges fail and how resource-wasting defenses raise attacker cost.
Simon WijckmansMay 19, 2026Funnull Sanctioned: What the Polyfill[.]io Attack Exposed About Infrastructure Laundering
OFAC's Funnull sanctions show why the Polyfill attack was part of a larger infrastructure laundering and browser supply-chain risk.
Simon WijckmansMay 18, 2026On-Device Inference Is Coming for Your Security Stack: For Better and Worse
On-device AI can protect sensitive data and power endpoint defense, but it also creates new prompt injection, telemetry, and browser attack paths.
Simon WijckmansMay 18, 2026Best AI Agent Detection Tools for Websites: 2026 Comparison
Seven AI agent detection tools compared for websites: cside, HUMAN Security, DataDome, Cloudflare, Imperva, Akamai, and AWS WAF. Detection approach, pricing, and implementation for each.
Simon WijckmansMay 15, 2026AI-Agent Based Credit Card Testing Bots | How to Stop Them
AI credit card testing agents use real browsers to test stolen credentials at scale. Learn how to detect and block them before a transaction completes.
Simon WijckmansMay 15, 2026What Are Stealth (or 'Anti-Detect') Browsers and When to Block Them
Stealth browsers bypass bot detection. Anti-detect browsers spoof fingerprints. Learn the signals that reveal both, even when they look human.
Simon WijckmansMay 14, 2026cside Named SourceForge Spring 2026 Top Performer for Client-Side Security
cside was named a SourceForge Spring 2026 Top Performer, based on user trust in client-side security, PCI evidence, and support.
Simon WijckmansMay 13, 2026How to Detect AI Agents on Your Website | Full Guide
How to detect AI agent traffic through identity, network, browser, and behavioral signals: free log analysis plus specialized tools.
Simon WijckmansMay 13, 2026cside Co-Chairs W3C Anti-Fraud Browser Security
Simon Wijckmans now co-chairs W3C AFCG as cside helps shape privacy-preserving browser signals for AI-era fraud.
Simon WijckmansMay 12, 2026What Is Mastercard First-Party Trust? How It Reduces Chargebacks
Mastercard First-Party Trust deflects friendly fraud disputes before they become formal chargebacks. Here is how the evidence framework works.
Simon WijckmansMay 11, 2026Mastercard First Party Trust: Improve EFM and ECP Ratios with Device Fingerprinting
Mastercard's First Party Trust program uses device fingerprinting to deflect friendly fraud disputes before they inflate your EFM and ECP ratios.
Simon WijckmansMay 8, 2026PCI DSS 6.4.3 & 11.6.1 Compliance Tools: 2026 Comparison
Compare PCI DSS 6.4.3 and 11.6.1 compliance tools: features, pricing, and reviews for cside, Feroot, Cloudflare, Reflectiz, and DomDog side by side.
Simon WijckmansMay 7, 2026Friendly Fraud in Travel and Hospitality: The 2026 Playbook
Travel and hospitality merchants face the highest-value friendly fraud disputes. How CE 3.0 and browser-layer evidence rebalance the win rate.
Simon WijckmansMay 6, 2026Mastercard Scam Merchant Monitoring: SMMP Enforcement Active, What Merchants Must Do Now
Mastercard SMMP is 30+ days into active enforcement. Which merchants face investigation risk now, what the 72-hour acquirer window means in practice, and how to close the evidence gap before the next trigger fires.
Simon WijckmansMay 5, 2026Utah SB 73: You Are Now Liable for Users' VPNs
Utah SB 73 holds operators liable when users bypass age gates with VPNs. An IP blocklist cannot keep pace. Behavioural detection is what works.
Simon WijckmansMay 5, 2026CE 3.0 Auto-Qualification: What Changed on 17 October 2025 and What To Do Now
Visa auto-qualifies transactions for Compelling Evidence 3.0 via Visa Secure and Visa Data Only. What changed, who benefits, and the evidence gap.
Simon WijckmansMay 1, 2026Friendly Fraud in Gaming and iGaming: The 2026 Chargeback Playbook
iGaming merchants run the highest chargeback ratios of any vertical. VAMP 2026 tightened the line. How CE 3.0 plus browser-layer evidence rebalances the book.
Simon WijckmansApr 29, 2026VAMP Thresholds 2026: Ratio Formula, Rules, and Merchant Survival Guide
Visa VAMP thresholds tightened to 1.5% on 1 April 2026: $8-per-transaction fines, no warning tier. How to calculate the VAMP ratio and use CE 3.0.
Simon WijckmansApr 29, 2026Compelling Evidence 3.0 Requirements: What Visa Mandates and What Actually Wins the Case
The four data elements Visa requires for CE 3.0, and what separates winning representments from losing ones.
Simon WijckmansApr 28, 2026How OpenClaw Agents Bypass Bot Detection (And How to Stop Them)
OpenClaw agents paired with stealth browser tooling can bypass legacy bot detection. Learn how agentic fraud works and how browser fingerprinting helps stop it.
Simon WijckmansApr 28, 2026CTEM at the browser layer: one third-party script, five findings
A live analysis of one Skeepers widget on a major international bank surfaced a 360-day cookie on auth subdomains, a CSP gap, and a server-controlled sub-script. Here's what CTEM looks like applied to the browser layer.
Simon WijckmansApr 27, 2026Friendly Fraud in SaaS and Subscription Businesses: The 2026 Playbook
SaaS friendly fraud has its own shape: descriptor drift, recurring billing, CE 3.0 eligibility. Here's how to fight it in 2026.
Simon WijckmansApr 27, 2026How to Remove a TC40 from Your VAMP Ratio: The CE 3.0 Mechanic
TC40 fraud reports feed your VAMP ratio without a chargeback. A successful CE 3.0 representment is the only way to remove one. Here's how it works.
Simon WijckmansApr 21, 2026How Advanced Location Data Prevents Account Takeover and Detects Unsafe AI-Agent Token Reuse
How advanced location data helps security teams detect impossible travel, stolen-session reuse, and unsafe AI-agent activity before account takeover turns into fraud or data loss.
Simon WijckmansApr 15, 2026How Compromised Third-Party Scripts Can Prompt-Inject AI Agents
Third-party scripts already adapt website behavior by browser characteristics. That same flexibility can be abused to detect AI agents and inject misleading instructions or altered content.
Simon WijckmansApr 13, 2026Account Takeover Prevention: Stop ATO with Browser-Layer Detection
MFA alone does not stop account takeover. This guide covers layered account takeover prevention — from phishing-resistant MFA to browser fingerprinting and session monitoring.
Simon WijckmansApr 7, 2026DarkSword: pure JavaScript exploit chain weaponizes legitimate websites
DarkSword is a full-chain iOS exploit delivered via watering-hole compromises of legitimate websites. It runs entirely in JavaScript, evades binary mitigations, and drops JavaScript-based backdoors that exfiltrate sensitive data.
Simon WijckmansMar 20, 2026AppsFlyer Web SDK supply-chain compromise - polymorphic crypto stealer
A registrar-level DNS hijack of appsflyer.com served a polymorphic crypto-stealing payload through the AppsFlyer Web SDK and affected thousands of sites and some Node.js server environments. This post summarizes telemetry, forensic indicators, IOCs, detection guidance, and remediation steps.
Simon WijckmansMar 18, 2026OpenClaw Scanner for Third-Party Scripts
A free, open-source scanner that inventories third-party scripts, detects fingerprinting, audits security headers and cookies, and flags PCI DSS exposure on payment pages. Run a quick 30-second audit to reveal what code executes in your users' browsers.
Simon WijckmansMar 18, 2026Inside Coruna - Web Script IOS Exploit
Your website could have been used to distribute this iOS exploit kit and you wouldn't have known. A full technical breakdown of Coruna: five exploit chains, 23 CVEs, and the delivery infrastructure that makes every website a potential attack vector.
Simon WijckmansMar 8, 2026"Microsoft Clairty" Isn't Microsoft Clarity: Deobfuscating a Typosquatted Ad Fraud Script
cside observed a new malicious client-side injection originating from a malicious browser extension impersonating Microsoft Clarity and overwriting referral tokens to redirect referral revenue to a malicious actor.
Simon WijckmansMar 3, 2026GDPR Tools 2026: 6 Categories and the Software for Each
No single platform covers GDPR compliance alone. The 6 tool types: consent management, client-side monitoring, DSAR, data mapping, security, and automation.
Simon WijckmansFeb 3, 2026E-Skimming: How the Attack Works and How to Prevent It (2026)
E-skimming injects code on checkout pages to capture card numbers before encryption. How Magecart attacks work and what PCI DSS 4.0.1 §6.4.3 requires.
Simon WijckmansJan 29, 2026Third-party script security: best practices for securing third-party scripts on web pages
Third-party scripts can expose sensitive data in your users' browsers. Learn best practices to secure client-side code and reduce breach risk.
Simon WijckmansJan 21, 2026CPA (Colorado Privacy Act): Guide to Requirements + Website Compliance
Get a clear breakdown of Colorado Privacy Act rules, enforcement timelines, and how to manage third-party scripts correctly.
Simon WijckmansJan 16, 2026How to detect VPN traffic on your website
VPN detection in five signals: IP block ownership, JA4 TLS fingerprint, timezone drift, WebRTC, and behavior. IP lists alone miss residential VPNs.
Simon WijckmansJan 14, 2026Top AI Tools For Website Privacy Compliance in 2026 (GDPR, CPRA)
Website privacy compliance is getting harder. Fortunately these AI-powered tools automate the heavy lifting across GDPR, CCPA, and HIPAA.
Simon WijckmansJan 13, 20262026 Web Security Predictions from cside's CEO
2026 will look different from past years. We'll be watching for: deepfake-powered phishing, LLM hallucinated security recommendations, and AI agent attackers.
Simon WijckmansJan 8, 202610 common GDPR website compliance failures (and how to prevent them)
Common GDPR website compliance failures, why your team doesn't notice them on your website, and how to prevent unlawful data collection.
Simon WijckmansDec 30, 2025Best client-side security for eCommerce?
eCommerce sites are heavy consumers of client-side tracking tags which creates a significant risk for malicious exfiltration of sensitive data but also legitimate tags collecting more data than is necessary to sell to data brokers. The cside solution solves these concerns with ease.
Simon WijckmansDec 26, 2025GDPR Penalties for Websites: How to Avoid Fines in 2026
Third-party scripts are a fast-growing GDPR enforcement trigger. See fine categories, real enforcement cases, and how to avoid website liability.
Simon WijckmansDec 26, 2025Best client-side security for Financial Institutions?
Nation-state targets like Financial Institutions need to partner with vendors that understand limitations and work to get as close to full coverage as is possible. Read why many choose cside's multi-layer model.
Simon WijckmansDec 24, 2025How to comply with GDPR website requirements (2026 guide)
Reducing GDPR risk starts with knowing what embedded third-party scripts collect. The six control areas regulators check, explained for 2026.
Simon WijckmansDec 24, 2025CSS Security: Protecting Against CSS-Based Attacks
CSS controls what your users see. This guide covers CSS-based attack vectors, from clickjacking to input manipulation, and how to stop them.
Simon WijckmansDec 23, 2025The British Airways Attack of 2018 - The Deeper Story
The 2018 British Airways attack affected 429,612 individuals. See why cside bought the attacker domain to turn it into a lesson on modern web security.
Simon WijckmansDec 15, 2025How cside brought AI to Client-Side Security
In 2024, cside launched the first client-side security solution with integrated AI for JavaScript security analysis and compliance automation.
Simon WijckmansDec 14, 2025Addressing Incorrect Claims Made by Reflectiz About cside
Learn why Reflectiz’s scanner-based claims about cside are incorrect and how cside’s real-time client-side security provides deeper protection, full payload forensics, and PCI DSS 4.0.1 compliance.
Simon WijckmansDec 8, 2025Script Integrity Management for e-commerce Brands (SRI, Dynamic Scripts)
Deep dive into script integrity vs Subresource Integrity vs behavioral monitoring for PCI DSS 6.4.3, 11.6.1, ISO 27001, and HIPAA compliance.
Simon WijckmansNov 26, 2025How WebView mobile apps are dangerous for banking
Banking "apps" that run on browser environments expose credentials without teams realizing it. This article explores examples of WebView mobile app attacks.
Simon WijckmansNov 21, 2025Why Chargeback Indemnification No Longer Works With the New VAMP Ratio
Chargeback indemnification won't shield you under the 2026 VAMP rules. Penalties and terminations still hit. Here's how to adapt.
Simon WijckmansOct 9, 2025Client-Side Security: How to Monitor Every Browser Script
Client-side security monitors the scripts running in your users' browsers, detecting Magecart skimming and data exfiltration that your WAF and server never see.
Simon WijckmansOct 2, 2025Mockito docs hijacked
Some attacks are stupidly low tech. Mockito, a popular open source package contained a malicious link in their Github Docs.
Simon WijckmansSep 30, 2025Vibe Coding Security Risks: Client-Side Exposures in AI Platforms (Lovable, Copilot, Cursor & more)
Understand the common vulnerabilities in code made with AI coding platforms like Lovable, Copilot, Cursor, + Replit. See how to fix them before you ship them.
Simon WijckmansSep 30, 2025QSA Assessment Checklist for Client-Side PCI Requirements
We put together a shorthand checklist, red flags to look for, and the compliance differences between CSP, Crawlers, and Client-side scripts.
Simon WijckmansSep 9, 2025How to comply with PCI 6.4.3 and 11.6.1 | Practical guide for security teams
A practical guide to PCI 6.4.3 for security teams in eCommerce, FinTech, and SaaS. Learn why CSP or Crawlers are not enough to protect your users.
Simon WijckmansAug 19, 2025Client-Side Attack Report Q2 2025
Q2 2025: cside tracked 72,740 compromised sites. Chinese PWA scams, Google OAuth abuse, a CoinMarketCap wallet drainer, ClickFix and SEO poisoning.
Simon WijckmansJul 30, 2025The PII Blind Spot in Web Security
But PII moves through the frontend, where controls are weaker and visibility is often limited.
Simon WijckmansJul 30, 2025UK Internet Age Verification System explained for cyber security
The goal of the UK Internet Age Verification System is to protect children browsing on the internet. But these checks come with new cybersecurity risks and privacy concerns.
Simon WijckmansJul 29, 2025cside at PCI SSC 2025 North America Community Meeting
We are in town for the PCI SSC 2025 North America Community Meeting, September 16th to 18th.
Simon WijckmansJul 24, 2025How Chrome extensions can remove security headers
Many browsers actively update extensions without specific approval or opt-in. This means that an extension today can behave wildly differently tomorrow, and you will not be made aware of it.
Simon WijckmansJul 21, 2025cside at BlackHat USA 2025
cside is exhibiting at BlackHat USA 2025.
Simon WijckmansJul 9, 2025Why crawlers can't help with PCI compliance (alone)
Crawlers act like a user but are very clearly not a real human user. If a malicious script would get injected because of a user interaction, the crawler will not see the malicious script unless it makes that user interaction
Simon WijckmansJul 3, 2025PCI Compliance 4.0.1: A Practical Implementation Guide Webinar
We partnered up with VikingCloud, the largest global PCI compliance QSA and security firm on 2 webinars giving you the full context and info to implement PCI DS 4.0.1. With a special focus on requirements 6.4.3 & 11.6.1.
Simon WijckmansJun 26, 2025Why We’re Called cside
We named ourselves after the part of the web that no one else was protecting: the client-side.
Simon WijckmansJun 25, 2025Malicious North Korean actors attempt to infiltrate technology companies
Catching fraudulent job applicants.
Simon WijckmansMay 1, 2025Client-Side Attack Recap - Q1 2025
cside's research uncovered nearly 300,000 compromised websites in Q1 of 2025.
Simon WijckmansApr 30, 2025VikingCloud approves cside for PCI DSS requirement 6.4.3 and 11.6.1
cside has partnered with VikingCloud to perform a deep technical assessment of the security solutions we offer under the enterprise plan, within the scope of PCI compliance. With proper implementation, our products meet requirements 6.4.3 and 11.6.1.
Simon WijckmansApr 24, 2025Free vs Paid PCI DSS Compliance: What Actually Works
Compare PCI DSS 6.4.3 and 11.6.1 approaches, the evidence QSAs review, and a practical 30-day plan for payment-page security.
Simon WijckmansApr 23, 2025What is PCI SSF? PCI SSF vs PCI DSS Explained (2026)
PCI SSF applies to payment software vendors. PCI DSS applies to merchants and anyone else handling cardholder data. Here is the practical breakdown for 2026.
Simon WijckmansApr 22, 2025Adyen PCI DSS Compliance: Merchant Steps and SAQ Levels
Adyen is PCI DSS Level 1 certified, but merchants still own requirements 6.4.3 and 11.6.1 on their own checkout page.
Simon WijckmansMar 21, 2025Is Braintree PCI DSS Compliant? What Merchants Still Own
Yes: Braintree is PCI DSS Level 1 certified. Your payment page still needs §6.4.3 and §11.6.1 script monitoring, even on SAQ A. Here's what you still own.
Simon WijckmansMar 21, 2025Stripe PCI Compliance: What Stripe Covers, What You Own
Stripe covers its own infrastructure. Merchants own §6.4.3 script authorization and §11.6.1 header monitoring on the checkout page.
Simon WijckmansMar 21, 2025BSidesSF and RSAC Event
When cside is exhibiting, the afterparties are in town! Organized by us, Socket, Arcjet and Incident! Find our booth at BSidesSF (follow the laser), and booth 2438 at RSAC. Register for the 30th of April Book a meeting Join us for a cybersecurity networking event at the Rooftop of our investor Uncork Capital in San Francisco! Organized by cside, Socket, Arcjet, and Incident, these events bring together 250+ techies, cybersecurity professionals, and BS
Simon WijckmansMar 13, 2025How to be a PCI DSS SAQ A company (6.4.3 and 11.6.1)
One sentence sparks debate. Because sites load scripts dynamically, a script from any page can persist into checkout, potentially interfering with payments. Third-party scripts, even if unrelated or on pages loaded before the payment pages, can introduce vulnerabilities.
Simon WijckmansMar 7, 2025Bybit Attack: $1.5B stolen through malicious JavaScript
The attackers injected malicious JavaScript into the website interface where Bybit's employees normally approve transactions. This malicious code was hidden in such a way that everything looked normal on the screen, but behind the scenes, it changed important details.
Simon WijckmansFeb 27, 2025cside is now SOC2 compliant
We're proud to announce our SOC2 type 2 audit has passed and we passed with the highest degree of approval.
Simon WijckmansFeb 5, 2025Demystifying the January 2025 updates to PCI DSS SAQ A
A full detailed explanation, chart and guide to the changes regarding PCI DSS 4.0.1 - 6.4.3 and 11.6.1
Simon WijckmansFeb 2, 2025Affiliate tracking and its cyber security risks
Malicious actors often exploit tracking pixels to inject harmful scripts on otherwise normal websites.
Simon WijckmansJan 20, 2025Why Content Security Policy doesn't work
Content Security Policy (CSP) is a security feature provided by web browsers that a website owner can use to define a set of rules that control which resources (e.g., scripts, styles, images) can be loaded and executed by the browser. We call this the client-side, which is at the very end of the web supply chain. When properly configured, it helps prevent a wide range of attacks. But those first three words make all the difference. It can help prevent: Cross-Site Scripting (XSS): By restricti
Simon WijckmansJan 7, 2025Ad marketplaces security and compliance risks
For businesses monetizing through ad marketplace models, the less traditional 3rd-party advertising networks, analytics platforms, and marketing scripts are indispensable. They're needed to drive revenue by boosting engagement and tracking user behavior.
Simon WijckmansDec 23, 2024A new Progressive Web App danger very few know about
With the rise in adoption of PWAs comes an increase in client-side security risks. And the industry? It's barely talking about it.
Simon WijckmansDec 20, 2024The Polyfill[.]io attack - More than just a redirect attack
A redirect was only what was caught. With control of one third-party script on half a million sites, far worse was possible. Here is why it mattered.
Simon WijckmansDec 6, 2024How web extensions can hurt your site (INFIRC[.]com and INFIRD[.]com)
The domain infirc[.]com and infird[.]com have caused quite the stir recently, and highlighted the dangers of infected or malicious web extensions.
Simon WijckmansOct 18, 2024The Internet Archive Hack: How JavaScript fits in the picture
The Internet Archive, also known as The Wayback Machine, experienced a security breach yesterday. This was not the first time it had been ta
Simon WijckmansOct 18, 2024The biggest Magecart attacks in history (so far)
The biggest Magecart breaches on record, from British Airways (2018) through CosmicSting (2024) and 2025's ongoing campaigns, plus how browser-side monitoring stops the skimmers.
Simon WijckmansOct 17, 2024Why do websites need 3rd party scripts?
When developing a website, you'll often include libraries to help speed up the development process, and avoid reinventing the wheel. However
Simon WijckmansOct 10, 2024cside joins the PCI Security Standards Council as an Associate Participating Organization
We're proud to announce that we've joined the Payment Card Industry Security Standards Council (PCI SSC) as an Associate Participating Organization.
Simon WijckmansOct 7, 2024Carlsberg a target in Magento "CosmicSting" malware attack
The term "Magecart" refers to attacks on the Magento platform. Recently, another large campaign was found to target Magento sites again. Among these, Carlsberg was one of the compromised websites. The pattern of these attacks is almost always the same. A single line of JavaScript loads content from a remote website. In other words, a 3rd party script. That code is then heavily obfuscated to delay detection even more. In this case, the payment process was quietly changed. A fake payment method
Simon WijckmansOct 4, 2024cside joins the W3C
We're incredibly proud to announce we have joined the W3C Web Application Security Working Group. The mission of the Web Application Security Working Group is to develop mechanisms and best practices to improve the security of web applications. Our whole team has been involved in cybersecurity for years. Through cside, we now aim to raise awareness and set higher standards for client-side security. By joining forces, we are one step closer to achieving both of our goals. We want to publicly t
Simon WijckmansOct 4, 2024Threat feeds fail to detect attack for +2 years
On this website, we can see it's been active since August of 2022. We've notified this, and other websites of this attack.
Simon WijckmansOct 2, 2024Why do developers obfuscate JavaScript?
As a client-side security company protecting JavaScript, we see a lot of obfuscated scripts. When you use our tool, you can actually see the deobfuscated version of the scripts to see what it is doing. Deobfuscation has been around for a while, but why is code obfuscated in the first place? JavaScript obfuscation came around to protect the source code of web applications from being easily understood, copied, or exploited by unauthorized users. Obfuscation as a concept predates JavaScript and e
Simon WijckmansOct 1, 2024ButterCMS unreported downtime and security concerns
ButterCMS is a popular tool used to manage content for blogs. Earlier this week, we noticed a potentially severe security incident which tri
Simon WijckmansSep 23, 2024cside raises a $6m seed round
We're incredibly proud to announce our seed round of $6m, just six months after raising our pre-seed of $1.7m. Led by Uncork Capital as the lead, with participation from Mantis and PrimeSet. We also welcome back Scribble VC and Roar Ventures who supported us in the pre-seed. Together with this news, we've opened up our free tier to all. You can now sign up and start using cside to monitor, secure, and optimize 3rd party scripts. We founded cside to put client-side security on the map. For t
Simon WijckmansSep 16, 2024cside picked for TechCrunch Disrupt Startup Battlefield 2024
We're incredibly proud to announce that we were selected for TechCrunch Disrupt Startup Battlefield in 2024. This year's Startup Battlefield participants span artificial intelligence (AI), software as a service (SaaS), fintech, security, sustainability, space exploration, and more. Out of thousands of startups, just 200 make the cut, and we are absolutely thrilled to be among this select group. We can not wait to share our product with the world, Oct. 28 - Wed, Oct. 30 at Moscone West in San F
Simon WijckmansSep 5, 2024How to speed up JavaScript
Conversion rates are correlated with site loading speeds. But e-commerce sites have a ton of JavaScript which slows things down... the solution is here.
Simon WijckmansSep 2, 2024What are digital skimmers?
Recently, we read of a new significant cyberattack campaign that targeted hundreds of online stores, exploiting vulnerabilities in third-party scripts and plugins. This is a perfect example of a 'digital skimmer'. Digital skimmers are snippets of code maliciously injected into legitimate websites. They target personal and credit card information. This problem is on the rise and is part of the reason cside was created. cside is able to detect this malicious code and prevent it from affecti
Simon WijckmansAug 29, 2024Why browsers are becoming increasingly more dangerous
Technologies like WebAssembly (WASM), WebGPU, and IndexedDB have transformed what browsers can achieve. This evolution has expanded the func
Simon WijckmansAug 23, 2024The true cost of a cyber attack
Calculating the true cost of a cyber attack is difficult. None are the same. Yet we report on this in as much detail as possible to accurately represent the full picture of when this happens to your business.
Simon WijckmansAug 12, 2024Is Tuaw a scam in the making?
When we saw the new Fireship video, we were reminded of the recent Polyfill attack. Our first article was picked up by cybersecurity news outlets.
Simon WijckmansAug 2, 2024The Copay event-stream attack illustrates dependency risks
In November 2018, the JavaScript ecosystem was rattled by a sophisticated attack on Copay, a popular cryptocurrency wallet provider. Known as the event-stream attack, this incident exposed the risks of relying on third-party dependencies in software development. Copay is now known as Bitpay Wallet. Understanding the attack: Event-stream, a popular npm package, was widely used by numerous projects to manage streams
Simon WijckmansJul 29, 2024The Segway cyber attack explained
In January 2022, the Segway web store suffered a web supply chain attack - also often referred to as a Magecart attack. In these types of attacks, malicious JavaScript code is added that loads from the client-side, known as third-party scripts. Many common tools are third-party scripts. Things like analytics, captchas and more. But this avenue can also be used for malicious reasons, as was the case here. In this attack on Segway, their store is set up on Magento. The attackers targeted vulnera
Simon WijckmansJul 25, 2024Don't deploy scripts site-wide
Third-party scripts are often deployed site-wide, typically injected in the head tags in web frameworks like Next.js via the '_document.js' file. This widespread implementation, while convenient for developers and often recommended by onboarding guides, means these scripts run across the entire site. This is simpler to implement, but it also introduces security risks and performance issues that are often overlooked. The recent Kaiser Permanente data leak shows the dangers of having poorly manag
Simon WijckmansJul 22, 2024What is an attack vector and what are hidden ones
An attack vector in cybersecurity is the way an attacker takes advantage of security weaknesses. Some are more obscure than others. One that's been our focus is third-party JavaScript. Since these scripts are installed by the website owner yet executed in the visitors' browsers, they're in a unique position. If something malicious occurs within these scripts, neither party is aware. The visitor is affected, and the website owner becomes liable. We've seen this too many times, for example, the
Simon WijckmansJul 15, 2024How expired domains lead to cyber attacks
In 2018, British Airways was attacked through the exploitation of a third-party JavaScript package running on its site.
Simon WijckmansJul 8, 2024The Polyfill attack explained
A tampered JavaScript file injected by the polyfill[.]io domain redirected a percentage of users to adult and betting websites based on their User-Agent. A Japanese X user "piyokango" was likely the first to report his attack on the 24th of June.
Simon WijckmansJul 3, 2024What Is a Supply Chain Attack? The Browser Supply Chain Explained
cside is a cybersecurity product that lives in the browser supply chain space. We and other vendors operating here like to talk about that supply chain. But, what exactly do we mean by it? The browser supply chain is the combination of components and processes that come together to render web pages, execute scripts, and ensure smooth functionality. This supply chain includes everything from the initial request for a webpage to the final rendering of that page in a user's browser. As well as dyn
Simon WijckmansJul 2, 2024More than 490k websites targeted in web supply chain attack
The cdn.polyfill[.]io domain is being used in a web supply chain attack. We were first to report the real scale: more than 490,000 affected websites.
Simon WijckmansJun 25, 2024The BrowseAloud Supply-Chain Attack: A Case Study in Cryptojacking
This attack affected more than 4,000 websites, including government and educational sites, exposing thousands of users to cryptojacking without their knowledge.
Simon WijckmansJun 10, 2024Supply Chain Risk Doesn't End At NPM
By only checking NPM (or another registry), you're not protected from attacks through third-party scripts.
Simon WijckmansMay 30, 2024Ticketmaster Data Breach Déjà Vu: What You Need to Know
Yesterday on May 29, 2024, news broke of an alleged data breach involving Ticketmaster, a prominent ticket sales and distribution company. Ticketmaster has confirmed unauthorized activity within a third-party cloud database environment, claiming to have exposed the personal information of over 500 million customers. This breach includes sensitive data such as emails, phone numbers, addresses, and financial details. ShinyHunters, a notorious attacker, reposted the breach . According to reports,
Simon WijckmansMay 30, 2024Kaiser Permanente Data Leak: A Case of Miscommunication and Inadequate Disclosure
On April 29th, healthcare giant Kaiser Permanente disclosed a data leak impacting 13.4 million current and former insurance members. The incident was rooted in improperly managed 3rd party scripts. The Incident Kaiser Permanente used tracking codes to monitor how its members navigated through its website and mobile applications. Some of these pages contained sensitive healthcare data, leading to the 3rd party scripts inadvertently transmitted information to third-party vendors they weren't
Simon WijckmansMay 25, 2024Threat Feeds In The AI Era
The idea behind threat feeds is valid. But, we'd argue it's past its prime at this point. And with where technology is today, there are better options. Threat feeds are (often) a list of community-sourced security information. When someone notices a vulnerability, they'll put out a notice to the thread feed manually. It then gets picked up, and featured in the feed where security folk at their respective companies read it and check their own systems to see if they are prone to potential danger.
Simon WijckmansApr 28, 2024The 2021 cdnjs Vulnerability in Detail
Verifying that your 3rd party script sources are reputable is important. But that alone may not be enough. That's what the world learned in 2021, when a massive vulnerability in Cloudlfare's cdnjs was flagged. Here's the rundown of what, and how, it happened. Cdnjs is one of the most commonly used JavaScript Content Delivery Networks (CDNs) of today. Over 12% of all websites on the internet inject at least one script through cdnjs. A researcher with the screen name 'RyotaK' shared a supply cha
Simon WijckmansApr 28, 2024The risk of only protecting your payment portals from 3rd party javascript attacks
PCI DSS 4.0 is here. By March 2025, it mandates that payment portals need to have a way to authorize each script on payment pages. Websites need to maintain an inventory of all scripts (on those payment portals at least) and ensure their integrity. You now need to detect and respond to unauthorized modifications on payment pages, including changes to HTTP headers and page contents. Organizations must check these configurations at least once every seven days or as determined by their risk analysi
Simon WijckmansApr 15, 2024PCI DSS Compliance Software for 4.0.1 (Complete Guide)
How PCI DSS compliance software helps merchants meet 4.0.1, including requirement 6.4.3 script inventory and 11.6.1 tamper detection. Comparison of leading platforms and buyer criteria.
Simon WijckmansMar 4, 2024