Foire aux questions

Question 1

Does a CSP provide enough security?

côté · Accepted Answer

CSP is a great base-layer for client-side security, but it cannot see script contents. Depending on your needs and risk profile, it may or may not be sufficient.

Question 2

Why doesn't a Content Security Policy (CSP) make us PCI compliant?

côté · Accepted Answer

PCI DSS requires monitoring scripts for changes. CSP can only control sources, not inspect payloads, so it cannot meet PCI DSS requirements.

Question 3

Why do you offer CSP for free?

côté · Accepted Answer

We fundamentally believe every individual and operation should be able to secure themselves, regardless of resources.

Question 4

How do client-side attacks actually happen?

côté · Accepted Answer

Client-side attacks typically occur when a malicious actor compromises a third-party service your website uses.

Question 5

Why can't traditional security tools detect client-side threats?

côté · Accepted Answer

Traditional security tools are designed for server infrastructure and can't see what's executing in users' browsers.

Question 6

What's the difference between client-side security and server-side security?

côté · Accepted Answer

Server-side security protects your infrastructure, while client-side security protects where your applications actually execute in users' browsers.

Question 7

What's the difference between client-side security and application security?

côté · Accepted Answer

Client-side security is a critical subset of AppSec that focuses on protecting applications where they actually execute--in users' browsers.

Question 8

Can cside work alongside my existing WAF without conflicts?

côté · Accepted Answer

Yes, because client-side security monitors an entirely different dimension of the application stack.

Question 9

Does cside's JavaScript proxy add latency like a WAF does to all traffic?

côté · Accepted Answer

cside only adds 8-20 milliseconds to specific dynamic JavaScript files we proxy, with static scripts cached for faster loading.

Question 10

How does cside's approach compare to the complexity of managing a WAF?

côté · Accepted Answer

cside is much simpler because we're only handling JavaScript files, not your entire web infrastructure.

Question 11

What happens if cside's proxy goes down? Will my website break?

côté · Accepted Answer

Your website will continue working as intended with our fail-open design and 99.99% uptime SLA.

Question 12

Will cside's proxy approach break my website like a misconfigured WAF might?

côté · Accepted Answer

No, your website will continue working normally as we only intercept third-party scripts with fail-open design.

Question 13

Can I choose which scripts go through cside's proxy and which don't?

côté · Accepted Answer

Yes, that's why we call it a hybrid proxy. You have granular control over which scripts get proxied and which don't.

Question 14

How is cside's hybrid proxy different from a WAF that proxies HTTPS traffic?

côté · Accepted Answer

cside's hybrid proxy is much more targeted than a WAF, only proxying JavaScript files from third-party sources while leaving your main website traffic untouched.

Question 15

What is client-side security, and why do I need it?

côté · Accepted Answer

Client-side security protects your website visitors from malicious JavaScript attacks that happen directly in their browsers.

Question 16

How much does fraudulent hiring typically cost companies?

côté · Accepted Answer

The cost of hiring a fraudulent actor extends far beyond wasted salary expenses and in some cases has even bankrupted the victims.

Question 17

Why are tech companies and government contractors particularly at risk?

côté · Accepted Answer

Tech companies and government contractors are prime targets because they handle valuable intellectual property, source code, infrastructure credentials and sensitive data that foreign adversaries want to access.

Question 18

What makes device fingerprinting effective for detecting fake job applicants?

côté · Accepted Answer

Device fingerprinting analyzes a range of technical signals from each applicant's browser and device to create a unique SHA-256 identifier with high accuracy.

Question 19

What makes cside's approach to privacy automation different from other solutions?

côté · Accepted Answer

Cside maintains its own proprietary threat intelligence specifically focused on client-side security and unauthorized data collection, giving us faster detection than solutions relying on third-party sources.

Question 20

What types of unauthorized data collection can cside detect automatically?

côté · Accepted Answer

Cside automatically detects all forms of unauthorized data collection, including unlawful cookie injection or exfiltration, personal data exfiltration from LocalStorage or SessionStorage, payment information theft, and tracking without consent.

Question 21

How quickly can cside detect privacy violations on my website?

côté · Accepted Answer

cside provides real-time privacy violation detection across all client-side scripts on your site.

Question 22

Can cside prevent privacy violations before they happen?

côté · Accepted Answer

Cside is designed to prevent privacy violations before they occur, not just detect them as they are happening.

Question 23

What's the difference between cside and traditional privacy compliance tools?

côté · Accepted Answer

Traditional privacy solutions use crawlers that miss dynamic threats and only catch data exfiltration attempts that the vendors are willing to expose.

Question 24

Why should I use cside to automate privacy monitoring for GDPR and CCPA compliance?

côté · Accepted Answer

cside automates privacy monitoring of client-side dependencies by providing real-time visibility into every third-party script on your website and ensuring you stay compliant with regulations without manual oversight.

Question 25

What privacy risks do third-party scripts create for my website visitors?

côté · Accepted Answer

Third-party scripts can create massive privacy risks because they have access to everything your users do on your site.

Question 26

Why can't I just rely on cookie consent popups for privacy protection?

côté · Accepted Answer

Legacy consent popups only show you what companies claim they're collecting, not what hidden scripts actually send. Many third-party scripts can quietly track users or exfiltrate sensitive data regardless of consent settings.

Question 27

What types of businesses need privacy monitoring the most?

côté · Accepted Answer

Any business handling sensitive user data needs robust privacy monitoring.

Question 28

How does cside help with GDPR, CCPA, and other privacy compliance requirements?

côté · Accepted Answer

Cside automatically monitors and prevents unauthorized data collection at the browser level, providing real-time privacy violation detection across all third-party scripts on your site.

Question 29

What happens during a PCI DSS audit and how do I prepare?

côté · Accepted Answer

During a PCI DSS audit, qualified security assessors will review your compliance documentation and test your security controls to verify that you're meeting all applicable requirements.

Question 30

How does cside's pricing work for PCI DSS compliance monitoring?

côté · Accepted Answer

Cside offers flexible pricing based on your website traffic. Starting with a free plan for up to 5,000 monthly pageviews.

Question 31

How long does it take to implement cside's PCI DSS compliance automation?

côté · Accepted Answer

Onboarding is quick.

Question 32

What ongoing support does cside provide for PCI DSS compliance maintenance?

côté · Accepted Answer

cside provides comprehensive ongoing support, including automated weekly compliance reports, real-time alerts for any security concerns, and continuous monitoring that operates 24/7.

Question 33

What specific PCI DSS requirements does cside automate for my business?

côté · Accepted Answer

Cside specifically addresses compliance for PCI DSS requirements 6.4.3 and 11.6.1.

Question 34

How does cside help me prepare for PCI DSS audits?

côté · Accepted Answer

cside automatically generates all the documentation auditors need to verify your compliance with requirements 6.4. 3 and 11.6.1.

Question 35

How does cside's automated monitoring save my business money on PCI DSS compliance?

côté · Accepted Answer

Non-compliance with PCI DSS can cost your business between $5,000 and $500,000 per incident.

Question 36

Why should I choose a proxy-based solution over other PCI DSS compliance approaches?

côté · Accepted Answer

A proxy-based solution provides the most comprehensive protection because it intercepts and analyzes every script request in real-time, seeing what the user gets.

Question 37

What compliance requirements does client-side security help with?

côté · Accepted Answer

Several major compliance frameworks now require client-side monitoring. PCI DSS 4.0.1 specifically requires monitoring and blocking client-side script payloads (requirements 6.4.3 and 11.6.1).

Question 38

How does cside protect user privacy and handle data collection?

côté · Accepted Answer

We take privacy seriously and don't collect or sell any user data for advertising.

Question 39

Why should I use cside to automate my PCI DSS 4.0.1 compliance instead of doing it manually?

côté · Accepted Answer

Manual PCI DSS compliance is incredibly time-consuming and error-prone, especially when tracking dozens of dynamic scripts that change frequently on payment pages.

Question 40

How does cside meet PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1?

côté · Accepted Answer

For requirement 6.4.3, we continuously monitor and hash every third-party script before it reaches your users' browsers.

Question 41

What's the difference between cside and other client-side security solutions?

côté · Accepted Answer

Most solutions use outdated approaches that miss sophisticated attacks, often heavily leveraging public threat feed intel.

Question 42

How quickly can I implement cside and see results?

côté · Accepted Answer

For our proxy solution, you just add one script tag to your website, and you'll see live data within minutes.

Question 43

What happens when malicious scripts use legitimate APIs and domains to hide their activity?

côté · Accepted Answer

Bad actors often use legitimate services to mask their malicious activity. Making it harder to detect the malicious payloads.

Question 44

Why is client-side security better than traditional threat intelligence tools like Snyk, Veracode, or Checkmarx?

côté · Accepted Answer

Traditional threat intelligence tools like Snyk, Veracode, Checkmarx, Spectral, JIT, GitLab, Rapid7, Tenable, Qualys, Aikido Security, and Semgrep rely on static threat feeds that are essentially obsolete by the time they're flagged.

Question 45

When is the best time to implement client-side security?

côté · Accepted Answer

The best time is before you experience a breach, but ideally, client-side security should be implemented as soon as possible.

Question 46

Who should implement client-side security solutions?

côté · Accepted Answer

Any business that needs a strong web presence should think about client-side security.

Question 47

How much does client-side security cost compared to a data breach?

côté · Accepted Answer

Pricing varies immensely based on the site and requirements.

Question 48

How does cside solve the client-side blind spot that WAFs can't address?

côté · Accepted Answer

Cside puts itself in the middle between the 3rd party and the end user, making it easy to stop attacks by analyzing JavaScript content asynchronously and hashing a list of bad scripts, preventing them from being loaded again.

Question 49

Why is the browser environment invisible to WAF monitoring?

côté · Accepted Answer

A WAF (Web Application Firewall) operates at the perimeter, analyzing traffic as it crosses between external networks and your internal network towards your web servers.

Question 50

Can a WAF protect against supply chain attacks on third-party JavaScript libraries?

côté · Accepted Answer

WAFs cannot protect against client-side supply chain attacks because they don't intercept the fetch to the 3rd party endpoint and therefore have no visibility into the JavaScript files from the 3rd party sources.

Question 51

How do conditional client-side attacks avoid WAF detection?

côté · Accepted Answer

Sophisticated client-side attacks use conditional logic that only triggers under specific circumstances - certain geographic locations, specific times, or particular user behaviors.

Question 52

Why do WAF logs miss evidence of client-side data theft?

côté · Accepted Answer

WAF logs only capture the initial delivery of third-party scripts to browsers, not what those scripts do afterward.

Question 53

Can my WAF see when third-party scripts change and potentially become malicious?

côté · Accepted Answer

WAFs don't perform content analysis of JavaScript files, and especially if the malicious payload originates from a 3rd party URL, the WAF would not live in the flow of the request.

Question 54

How do client-side attacks bypass WAF signature-based detection?

côté · Accepted Answer

WAF signatures are designed to catch known attack patterns in HTTP requests targeting server vulnerabilities by analyzing inbound requests.

Question 55

Why doesn't my WAF flag third-party scripts that become compromised?

côté · Accepted Answer

WAFs analyze incoming requests to determine if they're malicious, but third-party scripts are delivered from external CDNs and domains that your WAF considers legitimate.

Question 56

Can a WAF detect when malicious JavaScript is stealing user data from my website?

côté · Accepted Answer

No, because the data theft happens entirely within the user's browser after your WAF has finished its job.

Question 57

What's the fundamental difference between server-side attacks that WAFs catch and client-side attacks miss?

côté · Accepted Answer

Server-side attacks target your web server infrastructure through malicious requests, SQL injections, or application vulnerabilities.

Question 58

Why can't my WAF protect against client-side attacks like Magecart and skimming?

côté · Accepted Answer

WAFs are designed to analyze HTTP requests coming into your server; however, client-side attacks occur after your legitimate content has already been delivered to the user's browser.

Question 59

Can cside work alongside my existing WAF without conflicts?

côté · Accepted Answer

Because client-side security monitors an entirely different dimension of the application stack, there is no interference.

Question 60

Does cside's JavaScript proxy add latency like a WAF does to all traffic?

côté · Accepted Answer

cside only adds 8-20 milliseconds (the blink of an eye typically lasts between 100 and 400 milliseconds) of latency to the specific, highly dynamic JavaScript files we proxy.

Question 61

How does cside's approach compare to the complexity of managing a WAF?

côté · Accepted Answer

Cside is much simpler because we're only handling JavaScript files, not your entire web infrastructure. With a WAF, you need to configure rules for all your traffic, manage SSL certificates, handle different content types, and worry about breaking legitimate requests. A WAF also has no overlap with cside, as a WAF monitors inbound requests, not client-side activity or server responses to the client-side. While some WAF vendors inject Content Security Policies, we built cside from the ground up t

Question 62

How does the implementation complexity compare between cside and deploying a WAF?

côté · Accepted Answer

Implementing cside is dramatically simpler than deploying a WAF.

Question 63

What happens if cside's proxy goes down? Will my website break?

côté · Accepted Answer

Your website will continue working as intended.

Question 64

What happens if cside detects a malicious script on my website?

côté · Accepted Answer

When a script passes through cside, it is analysed in detail using a range of detection engines asynchronously.

Does a CSP provide enough security?

Why doesn't a Content Security Policy (CSP) make us PCI compliant?

Why do you offer CSP for free?

Can cside work alongside my existing WAF without conflicts?

Does cside's JavaScript proxy add latency like a WAF does to all traffic?

How does cside's approach compare to the complexity of managing a WAF?

How does the implementation complexity compare between cside and deploying a WAF?

What happens if cside's proxy goes down? Will my website break?

What happens if cside detects a malicious script on my website?

Will cside's proxy approach break my website like a misconfigured WAF might?

Can I choose which scripts go through cside's proxy and which don't?

How is cside's hybrid proxy different from a WAF that proxies HTTPS traffic?

How does cside's client-side security platform work differently?

Does cside actually show the code of the scripts in the dashboard?

How does cside assure AI safety?

Can cside detect attacks that only target specific users or time periods?

How does the cside proxy approach work without breaking my website?

Does cside impact website performance or slow down page loading?

What kind of reporting and dashboard features does cside provide?

Why should I choose cside over writing my own Content Security Policies or basic script monitoring?

Can cside work with modern websites built on React, Angular, or other frameworks?

What about SSL/TLS certificates, do I need to manage them for cside like I do for a WAF?

Can cside work with modern websites built on React, Angular, or other frameworks?

How do client-side attacks actually happen?

Why can't traditional security tools detect client-side threats?

What's the difference between client-side security and server-side security?

What's the difference between client-side security and application security?

What is client-side security, and why do I need it?

What types of client-side attacks are happening right now?

How do client-side attacks actually happen?

What's the difference between client-side security and server-side security?

What's the difference between client-side security and application security?

What is client-side security, and why do I need it?

Why can't traditional security tools detect client-side threats?

What is client-side intelligence, and what use cases does it cover?

What is client-side intelligence, and what use cases does it cover?

Can cside work alongside my existing WAF without conflicts?

Does cside's JavaScript proxy add latency like a WAF does to all traffic?

How does cside's approach compare to the complexity of managing a WAF?

What happens if cside's proxy goes down? Will my website break?

Will cside's proxy approach break my website like a misconfigured WAF might?

Can I choose which scripts go through cside's proxy and which don't?

How is cside's hybrid proxy different from a WAF that proxies HTTPS traffic?

How does cside solve the client-side blind spot that WAFs can't address?

Why is the browser environment invisible to WAF monitoring?

Can a WAF protect against supply chain attacks on third-party JavaScript libraries?

How do conditional client-side attacks avoid WAF detection?

Why do WAF logs miss evidence of client-side data theft?

Can my WAF see when third-party scripts change and potentially become malicious?

How do client-side attacks bypass WAF signature-based detection?

Why doesn't my WAF flag third-party scripts that become compromised?

Can a WAF detect when malicious JavaScript is stealing user data from my website?

What's the fundamental difference between server-side attacks that WAFs catch and client-side attacks miss?

Why can't my WAF protect against client-side attacks like Magecart and skimming?

How much does fraudulent hiring typically cost companies?

Why are tech companies and government contractors particularly at risk?

What makes device fingerprinting effective for detecting fake job applicants?

How quickly can cside detect and flag suspicious job applications?

What's the difference between regular background checks and device fingerprinting for hiring?

What makes cside's approach to privacy automation different from other solutions?

What types of unauthorized data collection can cside detect automatically?

How quickly can cside detect privacy violations on my website?

Can cside prevent privacy violations before they happen?

What's the difference between cside and traditional privacy compliance tools?

Why should I use cside to automate privacy monitoring for GDPR and CCPA compliance?

What privacy risks do third-party scripts create for my website visitors?

Why can't I just rely on cookie consent popups for privacy protection?

What types of businesses need privacy monitoring the most?

How does cside help with GDPR, CCPA, and other privacy compliance requirements?

What happens during a PCI DSS audit and how do I prepare?

How does cside's pricing work for PCI DSS compliance monitoring?

How long does it take to implement cside's PCI DSS compliance automation?

What ongoing support does cside provide for PCI DSS compliance maintenance?

What specific PCI DSS requirements does cside automate for my business?

How does cside help me prepare for PCI DSS audits?

How does cside's automated monitoring save my business money on PCI DSS compliance?

Why should I choose a proxy-based solution over other PCI DSS compliance approaches?

What compliance requirements does client-side security help with?

How does cside protect user privacy and handle data collection?