TL;DR:
- Web Applications built using modern frameworks leverage client-side scripts heavily through open source dependencies.
- A multi-layer approach to detecting script behavior is the only way to get sufficient visibility into malicious signals across unique circumstances.
- The leading vendor using a multi-layer approach for web applications is cside. Cside leverages AI to handle the complexity of client-side script behaviours in an accurate fashion.
What Client-side Security Means for Modern Web Applications?
Client-side security is the practice of protecting the JavaScript dependencies, user data and actions that run inside the browser of the visitor.
This includes:
- First-party scripts: JavaScript files loaded from your own domain, often originating from open source registries like npm
- Third-party scripts: from analytics tools, ads, chatbots, tag managers, A/B testing tools and more
- Inline scripts, embedded content like widgets and SDKs
- Data processed or fetched by the browser
Anything that happens after the initial HTML response by the web server is a client-side action. Attackers increasingly use the browser to execute malicious actions in an attempt to obtain valuable sensitive information. Where data is fetched from a 3rd party domain, scripts often serve differently based on IP, request headers, time of the day, location etc.
For example: a marketing tool will collect different data from European users compared to USA users for data privacy compliance.
This expected dynamic behavior is an opportunity for bad actors. Giving them the ability to fly below the radar and attack a small percentage of users over a prolonged period of time.
What Security Teams Monitor on Web Applications
Most companies have solutions implemented on their web infrastructure to monitor its attack surface against threats coming from open-source registries like npm. Security teams often also implement firewalls to protect their infrastructure and the web application itself against intrusion. These approaches are effective against a range of attacks, however bad actors look for the weakest link. Most applications do not have protections in place to manage client-side executions.
Scripts in the browser have incredibly far reaching power. Any data a user inputs can be listened to, exfiltrated and therefore sold. Whether that is credit-card information, email addresses, telephone numbers or passwords. Malware can be injected, social engineering can make you download and execute files with bad intentions. This attack vector goes by a number of names ranging from Magecart, Formjacking, data skimming or Web Supply Chain attacks to client-side scripting.
When thinking about approaches to security tools there are a number things to consider:
- Observability tools that purely observe and alert on specific behaviors similar to a fire alarm.
- Preventative measures that limit abilities in the pursuit of preventing a risky action. A good example of this are solutions for open source dependency security that prevent the installation of packages that aren’t verified. To continue the fire alarm comparison you can compare this to using fire resistant materials.
- Active security solutions continuously looking for malicious behaviors and blocking them as they happen. This can be compared to a sprinkler system.
In a concept of client-site security the observability tools that are sold often come in the form of a static scanner. But the issue is that bad actors recognize the scanners and honeypot them with a clean script. Scanners do not get to see the real client-side script the user would have received.
SAST solutions only cover part of the attack surface as an entry point. Client-side scripts are often injected through tag managers. If scripts originate from NPM, the browser fetch is not monitored by a standard supply chain security solution as behaviors in the browser are outside of its field of view.
That is why a unique solution like cside’s client-side security is required.
What Does The Right Tool Look Like?
A layered approach is best. Especially if the solution in question is customizable and creates transparency and control where there was lacking control before.
That is why we built cside as a platform leveraging all the different layers available to date.
cside leverages 3 automated but also independently configurable layers of client-side monitoring along with multiple detection engines including open source Large Language Models for detections.
- Layer 1: Client-side runtime monitoring. Many solutions in this space solely rely on client-side detections, and it is indeed one of the most effective methods out there. The only real problem with this approach is that detection capabilities are visible to attackers to an extent. Some advanced attacks can be missed with limited data to investigate. This makes an easy sandbox environment for a bad actor. Cside protects APIs to prevent such bypasses, but unlike modern operating systems, browsers are not built for security.
- Layer 2: Outside-in script and page verification. To verify outside-in whether the script is correctly implemented and a few extra edge cases that are not exposed to scripts in browsers like HTTP headers.
- Layer 3: Edge Gatekeeper Enforcement. Cside has a feature that allows you to pass a script through an edge engine. This edge engine is not susceptible to the same exposure the client-side only monitoring has. With the Gatekeeper browser limitations are no longer blockers as cside is effectively a conduit serving the script. Meaning it can keep a copy and dig into missed attacks later to improve detections.
We even offer a Content Security Policy endpoint as well so that customers can leverage browser native approaches, JavaScript, the Gatekeeper technology and more.
Another key factor is using a tool that leverages AI models to reduce manual compliance tasks to a minimum. These should be self hosted open source models to avoid IP leakage to AI vendors, which is an important data control aspect for enterprises.
Why Single-Layer tools fail for Modern Web Applications
Solutions that only use one of the 3 explained layers above are easily bypassed.
Most solutions in this space are simple website scanners. Vendors come up with fancy names like 'proprietary browser' or 'agent-less' but fundamentally its a simple automated browser like Playwright or Puppeteer scanning a website. Today, in 2025, you can use a tool like Cursor to build a solution like that in a matter of days.
The problem remains: a bad actor sees the scanner and will not serve malicious content to it. The dashboard will show interesting looking data and therefore create a false sense of security but the script behaviors you have to worry about will not show.
Conclusion: Why a Multi-Layer Client-Side Security Model Is Required for Web Applications
Solutions like cside’s Client-side security suite together with Privacy Watch and PCI Shield by cside cover the client-side attack vector best with the most comprehensive approach.
Making it easy to achieve compliance but mostly protecting your customers and your business.
Ready to check cside out? Start for free or book a demo to have a chat with our team.
