Simon Wijckmans
Founder and CEO of cside. Previously a product manager on Cloudflare Page Shield (now Cloudflare Client-Side Security). Co-chair of the W3C Anti-Fraud Community Group and a Forbes 30 Under 30 honoree. Building accessible security against client-side attacks, web security is not an enterprise-only problem.
Articles by Simon Wijckmans
What Is a Business Associate Agreement (BAA)? HIPAA BAAs Explained
A Business Associate Agreement (BAA) is a HIPAA-required contract between a covered entity and a vendor that handles protected health information on its behalf, binding the vendor to safeguard that data. This guide explains what a BAA covers, who needs one, and why some website vendors refuse to sign.
Simon WijckmansAug 18, 2026What Is an Approved Scanning Vendor (ASV)? PCI ASV Scans Explained
An Approved Scanning Vendor (ASV) is a company certified by the PCI Security Standards Council to run the external vulnerability scans that PCI DSS requirement 11.3.2 mandates every quarter. This guide explains what an ASV scan covers, how it differs from internal scans and penetration tests, and what it cannot see.
Simon WijckmansAug 18, 2026What Is Cardholder Data (CHD)? PCI Definitions, CDE, and SAD Explained
Cardholder data (CHD) is the payment card information PCI DSS exists to protect: the primary account number alone or with the cardholder's name, expiration date, or service code. This guide defines CHD, sensitive authentication data (SAD), and the cardholder data environment (CDE), and explains what each means for scope.
Simon WijckmansAug 18, 2026What Is Customer Journey Hijacking? How Injected Scripts Steal Shoppers
Customer journey hijacking is the manipulation of a visitor's session by unauthorized code (injected ads, forced redirects, swapped affiliate tags) that diverts them away from the intended purchase path. This guide explains how it happens, what it costs, and how to see it on your own site.
Simon WijckmansAug 18, 2026What Is DOM-Based XSS? How DOM Cross-Site Scripting Works
DOM-based XSS is a cross-site scripting attack where the vulnerability lives entirely in client-side JavaScript: the page's own code reads attacker-controlled input and writes it into the DOM unsafely. This guide explains how it differs from reflected and stored XSS, common sources and sinks, and how to detect it.
Simon WijckmansAug 18, 2026What Is ePHI? Electronic Protected Health Information Under HIPAA Explained
ePHI is electronic protected health information: any individually identifiable health data that is created, stored, or transmitted electronically, and that HIPAA requires covered entities and business associates to safeguard. This guide defines ePHI, distinguishes it from PHI and de-identified data, and lists the 18 HIPAA identifiers.
Simon WijckmansAug 18, 2026What Is JavaScript Injection? Script Injection Attacks Explained
JavaScript injection is the insertion of attacker-controlled script into a web page so it executes in visitors' browsers with the page's full privileges. This guide covers the injection paths (XSS, compromised third parties, extensions), what injected scripts actually do, and how to detect them.
Simon WijckmansAug 18, 2026PCI DSS Report on Compliance (RoC): What It Is and When You Need One
A PCI DSS Report on Compliance is required for Level 1 merchants and service providers. Learn what a RoC covers, who signs it, and how to prepare.
Simon WijckmansAug 18, 2026What Is PII Harvesting? How Scripts Collect Personal Data at Scale
PII harvesting is the systematic collection of personally identifiable information from websites and forms, usually by scripts that read what users type, sometimes criminal, sometimes an over-collecting vendor tag. This guide explains the techniques, the difference from PII itself, and how to see harvesting on your own pages.
Simon WijckmansAug 18, 2026What Is RASP? Runtime Application Self-Protection Defined
RASP (Runtime Application Self-Protection) is a security technology that runs inside an application and blocks attacks from within at runtime, using the application's own context. This guide defines RASP, compares it to WAFs, and explains where its server-side model stops, and what plays the equivalent role in the browser.
Simon WijckmansAug 18, 2026What is SAQ D? Complete Guide for Merchants and Service Providers
SAQ D is the longest PCI DSS self-assessment questionnaire and applies to the widest scope. Understand who needs it, what it covers, and how to prepare.
Simon WijckmansAug 18, 2026What Is That Tracker? A Field Guide to the Domains in Your Network Tab
You open DevTools and see requests to doubleclick.net, adnxs.com, clarity.ms, scorecardresearch.com, domains you never added. This guide explains what the most common tracker domains actually are, who operates them, what data they touch, and when an unknown domain in your network tab is a real problem.
Simon WijckmansAug 18, 2026What Is Web Tracking? How Websites Identify and Follow Visitors
Web tracking is the collection of data about visitors' behavior across websites, using cookies, pixels, fingerprinting, and session-replay scripts. This guide explains how each technique works, who is doing the tracking, what the law requires, and how site owners can see what their own pages are collecting.
Simon WijckmansAug 18, 2026Carding Attack: What It Is and How to Detect the Automation Behind It
A carding attack tests stolen or generated card numbers against your checkout at scale. Understand the attack, spot the browser-layer signature, and stop it.
Simon WijckmansAug 17, 2026Card Not Present Fraud: How CNP Attacks Work and How to Prevent Them
Card not present fraud drives most online payment losses. Understand how CNP attacks work, the browser signals that expose them, and the controls that stop them.
Simon WijckmansAug 17, 2026What is PCI DSS? A Practical Guide to the Payment Card Industry Data Security Standard
PCI DSS is the security standard every business handling payment cards must follow. Understand the 12 requirements, compliance levels, and how to prepare.
Simon WijckmansAug 17, 2026Phia cookie stuffing: Bill Gates' daughter's app, explained
Bloomberg alleges Phia, co-founded by Phoebe Gates, forced affiliate clicks. How it worked, and six tests merchants can run on their own order data.
Simon WijckmansAug 15, 2026PCI DSS Requirements: The 12 Requirements Explained (4.0.1)
PCI DSS has 12 requirements grouped under six security goals. Understand what each requires, what changed in 4.0.1, and where most environments have gaps.
Simon WijckmansAug 14, 2026What is a BIN Attack? How to Detect and Stop Automated Card Testing
A BIN attack tests thousands of stolen or generated card numbers against your checkout. Detect the browser-layer signature and stop it before it costs you.
Simon WijckmansAug 14, 2026What is an AI Agent? Definition, Examples, and What It Means for Your Website
An AI agent is a system that uses an LLM to complete multi-step tasks autonomously. Understand the definition, examples, and why agents change website security.
Simon WijckmansAug 14, 2026Browser Fingerprinting for Fraud Prevention: How It Works and Why It Matters
Browser fingerprinting produces a stable identifier from dozens of browser properties. Understand how it works, how it differs from device fingerprinting, and where it fits.
Simon WijckmansAug 13, 2026How to Detect Anthropic Computer Use on Your Website
Anthropic's Computer Use agent controls a real browser to complete tasks. Detect the signature at the browser layer before the agent transacts on your site.
Simon WijckmansAug 13, 2026What is Account Takeover (ATO)? Definition, Attack Patterns, and Prevention
What is ATO? Account takeover (ATO) is one of the most common online fraud vectors. Understand what ATO is, the attack patterns behind it, and how to stop it at the browser layer.
Simon WijckmansAug 13, 2026Browser Fingerprint Spoofing: How Attackers Bypass Detection and How to Stop Them
How attackers spoof browser fingerprints to evade fraud detection, and why layered signals catch what canvas-and-UA spoofing cannot.
Simon WijckmansJul 26, 2026Cookie Theft and Session Hijacking: How Attackers Steal Sessions and How to Stop Them
Cookie theft is when an attacker captures a session token from a logged-in user and replays it to impersonate them. No password needed, no MFA prompt. Here is how the attack works and how to stop it.
Simon WijckmansJul 21, 2026Magento PCI Compliance: Meeting PCI DSS 4.0.1 on Magento Stores
Magento merchants are not automatically PCI DSS compliant. Here is what Requirements 6.4.3 and 11.6.1 demand, what ASV scans miss, and how to close the client-side gap.
Simon WijckmansJul 21, 2026What Is Price Scraping and How to Stop It (2026)
Price scrapers harvest your catalog prices in real time, feeding competitor repricing engines. IP blocks and CAPTCHAs fail. Browser-layer behavioral detection does not.
Simon WijckmansJul 20, 2026What is cside? Browser-layer visibility for every visitor, human or agentic
cside is a browser-layer platform that gives security, fraud, privacy, and compliance teams visibility into what runs in every visitor's browser, human or agentic.
Simon WijckmansJul 19, 2026What Is a Laptop Farm? How Fraud Operators Scale Human-Like Attacks
A laptop farm is a physical setup where operators run multiple devices under separate identities to simulate distinct users. Learn how they work and how browser signals expose them.
Simon WijckmansJul 18, 2026What Is Formjacking? How the Attack Works and How to Stop It
Formjacking is a client-side attack that injects JavaScript to capture payment and login data as users type. Learn how the attack works, why traditional tools miss it, and how to detect it.
Simon WijckmansJul 18, 2026How to Detect AI Agents and Stealth Browsers: The Signals That Give Them Away
A signal-by-signal guide to detecting stealth and anti-detect browsers: CDP and webdriver tells, headless quirks, font and WebGL drift, and behavior.
Simon WijckmansJul 15, 2026Does Shopify Make You PCI Compliant? What 6.4.3 & 11.6.1 Still Require
Shopify is a PCI DSS Level 1 service provider, but that certifies Shopify's own systems, not your storefront. Requirements 6.4.3 and 11.6.1 stay yours.
Simon WijckmansJul 15, 2026Ecommerce Fraud Prevention Software: 10 Best Platforms 2026
10 best ecommerce fraud prevention software platforms for 2026, scored on browser-layer evidence, false-positive cost, and PCI DSS 4.0.1 coverage.
Simon WijckmansJul 15, 2026Bot Detection in the Age of AI Agents: Why Legacy Tools Miss Them
Edge bot tools score IPs, user agents, and rate. AI agents beat each. A gap-by-gap look at where legacy detection breaks and what browser signals add.
Simon WijckmansJul 14, 2026Detect AI agents by behavior: mouse, scroll, typing
Behavioral signals catch AI agents that pass CAPTCHA and rotate IPs: mouse paths and keystroke timing automation can't fake. See how cside scores it.
Simon WijckmansJul 14, 2026How to Detect Account Takeover Before It Happens: Browser and Device Signals
Instrument browser and device signals that fire before account takeover: fingerprint drift, headless and stealth-browser tells, proxy, and velocity.
Simon WijckmansJul 14, 2026PCI DSS Requirement 11.6.1 Explained
What PCI DSS Requirement 11.6.1 mandates for payment page tamper detection: the control text, the 2025-03-31 deadline, and the evidence a QSA expects.
Simon WijckmansJul 14, 2026Browser-Layer Script Activity Logging and Incident Response: Complete Guide for 2026
SIEM and EDR tools log the endpoint. WAFs log the network. Neither logs what third-party scripts do inside your users' browsers. This guide covers what browser-layer script activity logging captures and how incident response works when a script on your site is compromised.
Simon WijckmansJul 13, 2026Magecart Attacks Explained: How Web Skimming Works in the Browser
A plain explainer of how Magecart web skimming works: how the code gets in, how it reads your form fields, and how it exfiltrates card data unseen.
Simon WijckmansJul 13, 202610 Best Bot Detection Tools for 2026 (Including AI Agents)
The 10 best bot detection tools for 2026, ranked by detection layer, AI agent coverage, and false-positive rate. Head-to-head comparison of edge, device, and browser signals.
Simon WijckmansJul 12, 2026JavaScript Security Vulnerabilities: How Obfuscated Scripts Evade CSP and How to Stop Them
Why CSP cannot stop obfuscated JavaScript attacks, and what browser-layer behavioral monitoring adds that source allowlists cannot.
Simon WijckmansJul 12, 2026AI Agent and Bot Detection: Telling Humans, Good Bots, and Malicious Agents Apart
A classification taxonomy and intent-based enforcement model for separating humans, good bots, and malicious agents, then deciding what each one gets.
Simon WijckmansJul 11, 2026How AI Agents Break Account Security and How to Detect Bot-Driven ATO
How AI agents drive account takeover through credential replay, session and token reuse, and recovery abuse, and the browser signals that expose them.
Simon WijckmansJul 11, 2026Adyen and PCI DSS: What the Processor Covers vs. What You Must Do
Map the PCI DSS 6.4.3 and 11.6.1 script-ownership boundary to each Adyen integration: Hosted Pages, Drop-in, Components, and API-only checkout flows.
Simon WijckmansJul 10, 2026Formjacking vs Magecart vs Digital Skimming: What's the Difference?
Digital skimming is the data-theft outcome, formjacking is the capture technique, and Magecart is the threat-actor ecosystem. Here is how they relate.
Simon WijckmansJul 10, 2026Third-Party Script Risk Management: A Governance Framework
A governance framework for third-party script risk: inventory, ownership, data tiers, change monitoring, review cadence, RACI, and audit evidence.
Simon WijckmansJul 10, 2026Credential Stuffing: How to Detect and Stop It at the Login
Credential stuffing tests breached username and password pairs at scale. Learn the login signals that expose it and the layered controls that stop it.
Simon WijckmansJul 9, 2026Does Stripe Make You PCI Compliant? What PCI DSS 6.4.3 & 11.6.1 Still Require
Stripe shrinks your PCI DSS scope and can move you to SAQ A, but it does not make your site fully compliant. Requirements 6.4.3 and 11.6.1 stay yours.
Simon WijckmansJul 9, 2026What Is Online Card Skimming? How Attackers Steal Payment Card Data from Websites
Malicious JavaScript on checkout pages captures card numbers before encryption. How online card skimming works, real examples, and PCI DSS 4.0.1 requirements.
Simon WijckmansJul 8, 2026What Is Impossible Travel Detection and How Does It Work?
Impossible travel detection flags sessions where location jumps faster than physically possible. Learn how it works and what the browser layer adds.
Simon WijckmansJul 4, 2026Inside the Polymarket $3M client-side supply-chain attack
How attackers drained $3M from Polymarket through a compromised vendor script, without touching the smart contracts. Supply chain attack anatomy.
Simon WijckmansJun 26, 2026Agentic AI Security Risks for Websites: Privacy, Compliance, and Detection
Agentic AI browsers bypass cookie consent, execute real JavaScript, and create GDPR compliance gaps that CDN-level bot detection cannot see.
Simon WijckmansJun 22, 2026HIPAA Website Tracking Compliance: The Healthcare Guide to Third-Party Scripts
HHS OCR ruled that tracking pixels and third-party scripts on healthcare websites can expose PHI. Here's what covered entities must do to comply.
Simon WijckmansJun 20, 2026PCI DSS 6.4.3 Script Inventory and Authorization: How to Build the Record
The script inventory and authorization workflow for PCI DSS 6.4.3: what fields each record needs, who signs off, and a sample inventory row to copy.
Simon WijckmansJun 18, 2026Web Supply Chain Attack Explained: The Polyfill.io Incident, Full Timeline & Lessons (2024-2026)
A web supply chain attack turns trusted third-party code against visitors. See how the Polyfill.io attack hit 490,000+ sites and what it teaches about JavaScript supply chain risk.
Simon WijckmansJun 14, 2026DBSC vs Device Fingerprinting: What Chrome's Session Security Does Not Cover
Chrome's DBSC stops stolen-cookie replay, but it is Chrome-only, post-login, and not a device-identity layer. Here is the fraud it leaves open.
Simon WijckmansJun 9, 2026AI API security: when shared infrastructure returns another user's data
Shared caches, connection pools, and request routers make AI API security hard. Here's how cross-tenant response bleed happens and what to monitor in the browser.
Simon WijckmansJun 5, 2026MFA Didn't Fail, the Trust Model Did: Device Code Phishing and OAuth Token Theft (Kali365)
Kali365 abuses the OAuth 2.0 device authorization grant to steal Microsoft 365 tokens after MFA. A technical breakdown of the flow, FOCI, and detection.
Simon WijckmansJun 5, 2026AI is compressing the exploit cycle: Google's AI-developed zero-day and what it means for browsers
Google flagged a zero-day it believes was AI-developed. The real AI security shift isn't smarter phishing, it's how fast exploits reach the browser.
Simon WijckmansJun 3, 2026The Browser Session Is Now a Security Control Plane. Attackers Knew That Years Ago.
Google's DBSC proposal validates a clear security shift: browser sessions need device-aware validation after login, not only MFA.
Simon WijckmansMay 30, 2026The Snowball Effect: How Mini Shai-Hulud Turns npm into a Worm Distribution Network
Mini Shai-Hulud turned npm packages into a credential-theft loop. Here is how the AntV wave spread and what teams should monitor next.
Simon WijckmansMay 19, 2026Why CAPTCHAs Are No Longer Reliable Bot Defense
CAPTCHAs are no longer a reliable primary bot defense. Learn why visible challenges fail and how resource-wasting defenses raise attacker cost.
Simon WijckmansMay 19, 2026Funnull Sanctioned: What the Polyfill[.]io Attack Exposed About Infrastructure Laundering
OFAC's Funnull sanctions show why the Polyfill attack was part of a larger infrastructure laundering and browser supply-chain risk.
Simon WijckmansMay 18, 2026On-Device Inference Is Coming for Your Security Stack: For Better and Worse
On-device AI can protect sensitive data and power endpoint defense, but it also creates new prompt injection, telemetry, and browser attack paths.
Simon WijckmansMay 18, 2026cside Named SourceForge Spring 2026 Top Performer for Client-Side Security
cside was named a SourceForge Spring 2026 Top Performer, based on user trust in client-side security, PCI evidence, and support.
Simon WijckmansMay 13, 2026cside Co-Chairs W3C Anti-Fraud Browser Security
Simon Wijckmans now co-chairs W3C AFCG as cside helps shape privacy-preserving browser signals for AI-era fraud.
Simon WijckmansMay 12, 2026How OpenClaw Agents Bypass Bot Detection (And How to Stop Them)
OpenClaw agents paired with stealth browser tooling can bypass legacy bot detection. Learn how agentic fraud works and how browser fingerprinting helps stop it.
Simon WijckmansApr 28, 2026How Advanced Location Data Prevents Account Takeover and Detects Unsafe AI-Agent Token Reuse
How advanced location data helps security teams detect impossible travel, stolen-session reuse, and unsafe AI-agent activity before account takeover turns into fraud or data loss.
Simon WijckmansApr 15, 2026How Compromised Third-Party Scripts Can Prompt-Inject AI Agents
Third-party scripts already adapt website behavior by browser characteristics. That same flexibility can be abused to detect AI agents and inject misleading instructions or altered content.
Simon WijckmansApr 13, 2026DarkSword: pure JavaScript exploit chain weaponizes legitimate websites
DarkSword is a full-chain iOS exploit delivered via watering-hole compromises of legitimate websites. It runs entirely in JavaScript, evades binary mitigations, and drops JavaScript-based backdoors that exfiltrate sensitive data.
Simon WijckmansMar 20, 2026AppsFlyer Web SDK supply-chain compromise - polymorphic crypto stealer
A registrar-level DNS hijack of appsflyer.com served a polymorphic crypto-stealing payload through the AppsFlyer Web SDK and affected thousands of sites and some Node.js server environments. This post summarizes telemetry, forensic indicators, IOCs, detection guidance, and remediation steps.
Simon WijckmansMar 18, 2026OpenClaw Scanner for Third-Party Scripts
A free, open-source scanner that inventories third-party scripts, detects fingerprinting, audits security headers and cookies, and flags PCI DSS exposure on payment pages. Run a quick 30-second audit to reveal what code executes in your users' browsers.
Simon WijckmansMar 18, 2026Inside Coruna - Web Script IOS Exploit
Your website could have been used to distribute this iOS exploit kit and you wouldn't have known. A full technical breakdown of Coruna: five exploit chains, 23 CVEs, and the delivery infrastructure that makes every website a potential attack vector.
Simon WijckmansMar 8, 2026"Microsoft Clairty" Isn't Microsoft Clarity: Deobfuscating a Typosquatted Ad Fraud Script
cside observed a new malicious client-side injection originating from a malicious browser extension impersonating Microsoft Clarity and overwriting referral tokens to redirect referral revenue to a malicious actor.
Simon WijckmansMar 3, 2026Third-party script security: best practices for securing third-party scripts on web pages
Third-party script security best practices to stop Magecart: script inventory, least-privilege access, integrity checks, and runtime monitoring.
Simon WijckmansJan 21, 2026How to detect VPN traffic on your website
VPN detection in five signals: IP block ownership, JA4 TLS fingerprint, timezone drift, WebRTC, and behavior. IP lists alone miss residential VPNs.
Simon WijckmansJan 14, 20262026 Web Security Predictions from cside's CEO
2026 will look different from past years. We'll be watching for: deepfake-powered phishing, LLM hallucinated security recommendations, and AI agent attackers.
Simon WijckmansJan 8, 2026Best client-side security for eCommerce?
eCommerce sites are heavy consumers of client-side tracking tags which creates a significant risk for malicious exfiltration of sensitive data but also legitimate tags collecting more data than is necessary to sell to data brokers. The cside solution solves these concerns with ease.
Simon WijckmansDec 26, 2025Best client-side security for Financial Institutions?
Nation-state targets like Financial Institutions need to partner with vendors that understand limitations and work to get as close to full coverage as is possible. Read why many choose cside's multi-layer model.
Simon WijckmansDec 24, 2025The British Airways Attack of 2018 - The Deeper Story
The 2018 British Airways attack affected 429,612 individuals. See why cside bought the attacker domain to turn it into a lesson on modern web security.
Simon WijckmansDec 15, 2025How cside brought AI to Client-Side Security
In 2024, cside launched the first client-side security solution with integrated AI for JavaScript security analysis and compliance automation.
Simon WijckmansDec 14, 2025Addressing Incorrect Claims Made by Reflectiz About cside
Learn why Reflectiz’s scanner-based claims about cside are incorrect and how cside’s real-time client-side security provides deeper protection, full payload forensics, and PCI DSS 4.0.1 compliance.
Simon WijckmansDec 8, 2025Script Integrity Management for e-commerce Brands (SRI, Dynamic Scripts)
Deep dive into script integrity vs Subresource Integrity vs behavioral monitoring for PCI DSS 6.4.3, 11.6.1, ISO 27001, and HIPAA compliance.
Simon WijckmansNov 26, 2025How WebView mobile apps are dangerous for banking
Banking "apps" that run on browser environments expose credentials without teams realizing it. This article explores examples of WebView mobile app attacks.
Simon WijckmansNov 21, 2025Client-Side Security: How to Monitor Every Browser Script
Client-side security monitors the scripts running in your users' browsers, detecting Magecart skimming and data exfiltration that your WAF and server never see.
Simon WijckmansOct 2, 2025Mockito docs hijacked
Some attacks are stupidly low tech. Mockito, a popular open source package contained a malicious link in their Github Docs.
Simon WijckmansSep 30, 2025Vibe Coding Security Risks: Client-Side Exposures in AI Platforms (Lovable, Copilot, Cursor & more)
Understand the common vulnerabilities in code made with AI coding platforms like Lovable, Copilot, Cursor, + Replit. See how to fix them before you ship them.
Simon WijckmansSep 30, 2025QSA Assessment Checklist for Client-Side PCI Requirements
We put together a shorthand checklist, red flags to look for, and the compliance differences between CSP, Crawlers, and Client-side scripts.
Simon WijckmansSep 9, 2025Client-Side Attack Report Q2 2025
Q2 2025: cside tracked 72,740 compromised sites. Chinese PWA scams, Google OAuth abuse, a CoinMarketCap wallet drainer, ClickFix and SEO poisoning.
Simon WijckmansJul 30, 2025The PII Blind Spot in Web Security
But PII moves through the frontend, where controls are weaker and visibility is often limited.
Simon WijckmansJul 30, 2025UK Internet Age Verification System explained for cyber security
The goal of the UK Internet Age Verification System is to protect children browsing on the internet. But these checks come with new cybersecurity risks and privacy concerns.
Simon WijckmansJul 29, 2025cside at PCI SSC 2025 North America Community Meeting
We are in town for the PCI SSC 2025 North America Community Meeting, September 16th to 18th.
Simon WijckmansJul 24, 2025How Chrome extensions can remove security headers
Many browsers actively update extensions without specific approval or opt-in. This means that an extension today can behave wildly differently tomorrow, and you will not be made aware of it.
Simon WijckmansJul 21, 2025cside at BlackHat USA 2025
cside is exhibiting at BlackHat USA 2025.
Simon WijckmansJul 9, 2025Why crawlers can't help with PCI compliance (alone)
Crawlers act like a user but are very clearly not a real human user. If a malicious script would get injected because of a user interaction, the crawler will not see the malicious script unless it makes that user interaction
Simon WijckmansJul 3, 2025PCI Compliance 4.0.1: A Practical Implementation Guide Webinar
We partnered up with VikingCloud, the largest global PCI compliance QSA and security firm on 2 webinars giving you the full context and info to implement PCI DS 4.0.1. With a special focus on requirements 6.4.3 & 11.6.1.
Simon WijckmansJun 26, 2025Why We’re Called cside
We named ourselves after the part of the web that no one else was protecting: the client-side.
Simon WijckmansJun 25, 2025Malicious North Korean actors attempt to infiltrate technology companies
Catching fraudulent job applicants.
Simon WijckmansMay 1, 2025Client-Side Attack Recap - Q1 2025
cside's research uncovered nearly 300,000 compromised websites in Q1 of 2025.
Simon WijckmansApr 30, 2025VikingCloud approves cside for PCI DSS requirement 6.4.3 and 11.6.1
cside has partnered with VikingCloud to perform a deep technical assessment of the security solutions we offer under the enterprise plan, within the scope of PCI compliance. With proper implementation, our products meet requirements 6.4.3 and 11.6.1.
Simon WijckmansApr 24, 2025Free vs Paid PCI DSS Compliance: What Actually Works
The short answer: Without an off the shelf solution, you'd have to build a DIY monitoring tool that would cos significantly more in wages than a prebuilt solution's vendor costs.
Simon WijckmansApr 23, 2025Do you need PCI SSF or PCI DSS? Here's the difference
PCI SSF is for the software, and PCI DSS is for everything else. Let's dive in.
Simon WijckmansApr 22, 2025Adyen PCI DSS Compliance: Merchant Steps and SAQ Levels
Adyen is PCI DSS Level 1 certified, but merchants still own requirements 6.4.3 and 11.6.1 on their own checkout page.
Simon WijckmansMar 21, 2025Braintree PCI DSS Compliance: What PayPal Merchants Still Need to Do
Braintree holds PCI Level 1 certification as a PayPal service. Merchants remain responsible for payment page script monitoring under §6.4.3 and §11.6.1 regardless of integration type.
Simon WijckmansMar 21, 2025Stripe PCI Compliance: What Stripe Covers, What You Own
Stripe covers its own infrastructure. Merchants own §6.4.3 script authorization and §11.6.1 header monitoring on the checkout page.
Simon WijckmansMar 21, 2025BSidesSF and RSAC Event
When cside is exhibiting, the afterparties are in town! Organized by us, Socket, Arcjet and Incident! Find our booth at BSidesSF (follow the laser), and booth 2438 at RSAC. Register for the 30th of April Book a meeting Join us for a cybersecurity networking event at the Rooftop of our investor Uncork Capital in San Francisco! Organized by cside, Socket, Arcjet, and Incident, these events bring together 250+ techies, cybersecurity professionals, and BS
Simon WijckmansMar 13, 2025How to be a PCI DSS SAQ A company (6.4.3 and 11.6.1)
One sentence sparks debate. Because sites load scripts dynamically, a script from any page can persist into checkout, potentially interfering with payments. Third-party scripts, even if unrelated or on pages loaded before the payment pages, can introduce vulnerabilities.
Simon WijckmansMar 7, 2025Bybit Attack: $1.5B stolen through malicious JavaScript
The attackers injected malicious JavaScript into the website interface where Bybit's employees normally approve transactions. This malicious code was hidden in such a way that everything looked normal on the screen, but behind the scenes, it changed important details.
Simon WijckmansFeb 27, 2025cside is now SOC2 compliant
We're proud to announce our SOC2 type 2 audit has passed and we passed with the highest degree of approval.
Simon WijckmansFeb 5, 2025Demystifying the January 2025 updates to PCI DSS SAQ A
A full detailed explanation, chart and guide to the changes regarding PCI DSS 4.0.1 - 6.4.3 and 11.6.1
Simon WijckmansFeb 2, 2025Affiliate tracking and its cyber security risks
Malicious actors often exploit tracking pixels to inject harmful scripts on otherwise normal websites.
Simon WijckmansJan 20, 2025Why Content Security Policy doesn't work
Content Security Policy (CSP) is a security feature provided by web browsers that a website owner can use to define a set of rules that control which resources (e.g., scripts, styles, images) can be loaded and executed by the browser. We call this the client-side, which is at the very end of the web supply chain. When properly configured, it helps prevent a wide range of attacks. But those first three words make all the difference. It can help prevent: Cross-Site Scripting (XSS): By restricti
Simon WijckmansJan 7, 2025Ad marketplaces security and compliance risks
For businesses monetizing through ad marketplace models, the less traditional 3rd-party advertising networks, analytics platforms, and marketing scripts are indispensable. They're needed to drive revenue by boosting engagement and tracking user behavior.
Simon WijckmansDec 23, 2024A new Progressive Web App danger very few know about
With the rise in adoption of PWAs comes an increase in client-side security risks. And the industry? It's barely talking about it.
Simon WijckmansDec 20, 2024The Polyfill[.]io attack - More than just a redirect attack
A redirect was only what was caught. With control of one third-party script on half a million sites, far worse was possible. Here is why it mattered.
Simon WijckmansDec 6, 2024How web extensions can hurt your site (INFIRC[.]com and INFIRD[.]com)
The domain infirc[.]com and infird[.]com have caused quite the stir recently, and highlighted the dangers of infected or malicious web extensions.
Simon WijckmansOct 18, 2024The Internet Archive Hack: How JavaScript fits in the picture
The Internet Archive, also known as The Wayback Machine, experienced a security breach yesterday. This was not the first time it had been ta
Simon WijckmansOct 18, 2024The biggest Magecart attacks in history (so far)
The biggest Magecart breaches on record, from British Airways (2018) to CosmicSting (2024), and the browser-side monitoring that stops the skimmers.
Simon WijckmansOct 17, 2024Why do websites need 3rd party scripts?
When developing a website, you'll often include libraries to help speed up the development process, and avoid reinventing the wheel. However
Simon WijckmansOct 10, 2024cside joins the PCI Security Standards Council as an Associate Participating Organization
We're proud to announce that we've joined the Payment Card Industry Security Standards Council (PCI SSC) as an Associate Participating Organization.
Simon WijckmansOct 7, 2024Carlsberg a target in Magento "CosmicSting" malware attack
The term "Magecart" refers to attacks on the Magento platform. Recently, another large campaign was found to target Magento sites again. Among these, Carlsberg was one of the compromised websites. The pattern of these attacks is almost always the same. A single line of JavaScript loads content from a remote website. In other words, a 3rd party script. That code is then heavily obfuscated to delay detection even more. In this case, the payment process was quietly changed. A fake payment method
Simon WijckmansOct 4, 2024cside joins the W3C
We're incredibly proud to announce we have joined the W3C Web Application Security Working Group. The mission of the Web Application Security Working Group is to develop mechanisms and best practices to improve the security of web applications. Our whole team has been involved in cybersecurity for years. Through cside, we now aim to raise awareness and set higher standards for client-side security. By joining forces, we are one step closer to achieving both of our goals. We want to publicly t
Simon WijckmansOct 4, 2024Threat feeds fail to detect attack for +2 years
On this website, we can see it's been active since August of 2022. We've notified this, and other websites of this attack.
Simon WijckmansOct 2, 2024Why do developers obfuscate JavaScript?
As a client-side security company protecting JavaScript, we see a lot of obfuscated scripts. When you use our tool, you can actually see the deobfuscated version of the scripts to see what it is doing. Deobfuscation has been around for a while, but why is code obfuscated in the first place? JavaScript obfuscation came around to protect the source code of web applications from being easily understood, copied, or exploited by unauthorized users. Obfuscation as a concept predates JavaScript and e
Simon WijckmansOct 1, 2024ButterCMS unreported downtime and security concerns
ButterCMS is a popular tool used to manage content for blogs. Earlier this week, we noticed a potentially severe security incident which tri
Simon WijckmansSep 23, 2024cside raises a $6m seed round
We're incredibly proud to announce our seed round of $6m, just six months after raising our pre-seed of $1.7m. Led by Uncork Capital as the lead, with participation from Mantis and PrimeSet. We also welcome back Scribble VC and Roar Ventures who supported us in the pre-seed. Together with this news, we've opened up our free tier to all. You can now sign up and start using cside to monitor, secure, and optimize 3rd party scripts. We founded cside to put client-side security on the map. For t
Simon WijckmansSep 16, 2024cside picked for TechCrunch Disrupt Startup Battlefield 2024
We're incredibly proud to announce that we were selected for TechCrunch Disrupt Startup Battlefield in 2024. This year's Startup Battlefield participants span artificial intelligence (AI), software as a service (SaaS), fintech, security, sustainability, space exploration, and more. Out of thousands of startups, just 200 make the cut, and we are absolutely thrilled to be among this select group. We can not wait to share our product with the world, Oct. 28 - Wed, Oct. 30 at Moscone West in San F
Simon WijckmansSep 5, 2024How to speed up JavaScript
Conversion rates are correlated with site loading speeds. But e-commerce sites have a ton of JavaScript which slows things down... the solution is here.
Simon WijckmansSep 2, 2024What are digital skimmers?
Recently, we read of a new significant cyberattack campaign that targeted hundreds of online stores, exploiting vulnerabilities in third-party scripts and plugins. This is a perfect example of a 'digital skimmer'. Digital skimmers are snippets of code maliciously injected into legitimate websites. They target personal and credit card information. This problem is on the rise and is part of the reason cside was created. cside is able to detect this malicious code and prevent it from affecti
Simon WijckmansAug 29, 2024Why browsers are becoming increasingly more dangerous
Technologies like WebAssembly (WASM), WebGPU, and IndexedDB have transformed what browsers can achieve. This evolution has expanded the func
Simon WijckmansAug 23, 2024The true cost of a cyber attack
Calculating the true cost of a cyber attack is difficult. None are the same. Yet we report on this in as much detail as possible to accurately represent the full picture of when this happens to your business.
Simon WijckmansAug 12, 2024Is Tuaw a scam in the making?
When we saw the new Fireship video, we were reminded of the recent Polyfill attack. Our first article was picked up by cybersecurity news outlets.
Simon WijckmansAug 2, 2024The Copay event-stream attack illustrates dependency risks
In November 2018, the JavaScript ecosystem was rattled by a sophisticated attack on Copay, a popular cryptocurrency wallet provider. Known as the event-stream attack, this incident exposed the risks of relying on third-party dependencies in software development. Copay is now known as Bitpay Wallet. Understanding the attack: Event-stream, a popular npm package, was widely used by numerous projects to manage streams
Simon WijckmansJul 29, 2024The Segway cyber attack explained
In January 2022, the Segway web store suffered a web supply chain attack - also often referred to as a Magecart attack. In these types of attacks, malicious JavaScript code is added that loads from the client-side, known as third-party scripts. Many common tools are third-party scripts. Things like analytics, captchas and more. But this avenue can also be used for malicious reasons, as was the case here. In this attack on Segway, their store is set up on Magento. The attackers targeted vulnera
Simon WijckmansJul 25, 2024Don't deploy scripts site-wide
Third-party scripts are often deployed site-wide, typically injected in the head tags in web frameworks like Next.js via the '_document.js' file. This widespread implementation, while convenient for developers and often recommended by onboarding guides, means these scripts run across the entire site. This is simpler to implement, but it also introduces security risks and performance issues that are often overlooked. The recent Kaiser Permanente data leak shows the dangers of having poorly manag
Simon WijckmansJul 22, 2024What is an attack vector and what are hidden ones
An attack vector in cybersecurity is the way an attacker takes advantage of security weaknesses. Some are more obscure than others. One that's been our focus is third-party JavaScript. Since these scripts are installed by the website owner yet executed in the visitors' browsers, they're in a unique position. If something malicious occurs within these scripts, neither party is aware. The visitor is affected, and the website owner becomes liable. We've seen this too many times, for example, the
Simon WijckmansJul 15, 2024How expired domains lead to cyber attacks
In 2018, British Airways was attacked through the exploitation of a third-party JavaScript package running on its site.
Simon WijckmansJul 8, 2024The Polyfill attack explained
A tampered JavaScript file injected by the polyfill[.]io domain redirected a percentage of users to adult and betting websites based on their User-Agent. A Japanese X user "piyokango" was likely the first to report his attack on the 24th of June.
Simon WijckmansJul 3, 2024What Is a Supply Chain Attack? The Browser Supply Chain Explained
cside is a cybersecurity product that lives in the browser supply chain space. We and other vendors operating here like to talk about that supply chain. But, what exactly do we mean by it? The browser supply chain is the combination of components and processes that come together to render web pages, execute scripts, and ensure smooth functionality. This supply chain includes everything from the initial request for a webpage to the final rendering of that page in a user's browser. As well as dyn
Simon WijckmansJul 2, 2024More than 490k websites targeted in web supply chain attack
The cdn.polyfill[.]io domain is being used in a web supply chain attack. We were first to report the real scale: more than 490,000 affected websites.
Simon WijckmansJun 25, 2024The BrowseAloud Supply-Chain Attack: A Case Study in Cryptojacking
This attack affected more than 4,000 websites, including government and educational sites, exposing thousands of users to cryptojacking without their knowledge.
Simon WijckmansJun 10, 2024Supply Chain Risk Doesn't End At NPM
By only checking NPM (or another registry), you're not protected from attacks through third-party scripts.
Simon WijckmansMay 30, 2024Ticketmaster Data Breach Déjà Vu: What You Need to Know
Yesterday on May 29, 2024, news broke of an alleged data breach involving Ticketmaster, a prominent ticket sales and distribution company. Ticketmaster has confirmed unauthorized activity within a third-party cloud database environment, claiming to have exposed the personal information of over 500 million customers. This breach includes sensitive data such as emails, phone numbers, addresses, and financial details. ShinyHunters, a notorious attacker, reposted the breach . According to reports,
Simon WijckmansMay 30, 2024Kaiser Permanente Data Leak: A Case of Miscommunication and Inadequate Disclosure
On April 29th, healthcare giant Kaiser Permanente disclosed a data leak impacting 13.4 million current and former insurance members. The incident was rooted in improperly managed 3rd party scripts. The Incident Kaiser Permanente used tracking codes to monitor how its members navigated through its website and mobile applications. Some of these pages contained sensitive healthcare data, leading to the 3rd party scripts inadvertently transmitted information to third-party vendors they weren't
Simon WijckmansMay 25, 2024Threat Feeds In The AI Era
The idea behind threat feeds is valid. But, we'd argue it's past its prime at this point. And with where technology is today, there are better options. Threat feeds are (often) a list of community-sourced security information. When someone notices a vulnerability, they'll put out a notice to the thread feed manually. It then gets picked up, and featured in the feed where security folk at their respective companies read it and check their own systems to see if they are prone to potential danger.
Simon WijckmansApr 28, 2024The 2021 cdnjs Vulnerability in Detail
Verifying that your 3rd party script sources are reputable is important. But that alone may not be enough. That's what the world learned in 2021, when a massive vulnerability in Cloudlfare's cdnjs was flagged. Here's the rundown of what, and how, it happened. Cdnjs is one of the most commonly used JavaScript Content Delivery Networks (CDNs) of today. Over 12% of all websites on the internet inject at least one script through cdnjs. A researcher with the screen name 'RyotaK' shared a supply cha
Simon WijckmansApr 28, 2024The risk of only protecting your payment portals from 3rd party javascript attacks
PCI DSS 4.0 is here. By March 2025, it mandates that payment portals need to have a way to authorize each script on payment pages. Websites need to maintain an inventory of all scripts (on those payment portals at least) and ensure their integrity. You now need to detect and respond to unauthorized modifications on payment pages, including changes to HTTP headers and page contents. Organizations must check these configurations at least once every seven days or as determined by their risk analysi
Simon WijckmansApr 15, 2024PCI DSS Compliance Software for 4.0.1 (Complete Guide)
How PCI DSS compliance software helps merchants meet 4.0.1, including requirement 6.4.3 script inventory and 11.6.1 tamper detection. Comparison of leading platforms and buyer criteria.
Simon WijckmansMar 4, 2024