How Session Enrichment​ Improves Edge Security Decisions

There has never been more security deployed at the edge than there is today. Content delivery networks (CDNs), web application firewalls (WAFs), and other edge security tools continually improve how organizations protect internet-facing applications.

Solutions like Cloudflare provide organizations with one of the most capable security platforms available, inspecting billions of requests every day, blocking known exploits, mitigating DDoS attacks, enforcing WAF policies, and stopping commodity bots. CDNs are the first line of defense for every user request. But at the same time, attackers have evolved.

Today's account takeover campaigns, credential stuffing attacks, fake account creation, inventory abuse, and AI-driven automation rarely arrive looking obviously malicious. They often originate from residential proxy networks, static ISP proxies, consumer VPNs, mobile carriers, legitimate cloud providers, or newly observed infrastructure that has never before been associated with abuse. Increasingly, attackers invest as much effort into appearing like legitimate users than they do into exploiting software vulnerabilities.

This has resulted in a shift in web security where it’s no longer enough to determine whether an HTTP request is malicious, but whether the session generating that request should be trusted.

This blog examines this shift and how security and fraud teams can add missing session trust to transform their CDNs into trust-aware decision engines.

Edge Security Is Exceptionally Good at What It Was Built to Do…

Today’s edge security stack combines everything from CDNs and WAFs, bot management, and DDoS mitigation to rate limiting, API protection, threat intelligence, challenge mechanisms, and rules engines. Together, these capabilities enable organizations to stop enormous volumes of malicious traffic before it ever reaches an application. Decisions can be made in milliseconds at the network edge, close to the user, and without introducing unnecessary latency. For most attacks, this works remarkably well, but modern fraud introduces a different problem.

…but the Hardest Traffic to Detect Isn't Obviously Malicious

Consider a credential stuffing campaign routed through a large residential proxy network. Every request may appear technically valid.

• The browser behaves normally.
• TLS fingerprints look legitimate.
• JavaScript executes successfully.
• The source IP belongs to an actual household.
• No individual IP makes more than one or two requests

Nothing about the individual request necessarily violates a WAF rule. But the attacker’s objective isn’t to just bypass a firewall, it’s rather to become indistinguishable from a legitimate customer, making detection and blocking more difficult.

This approach therefore changes what defenders need to understand. Instead of asking, "Is this request malicious?", security teams increasingly need to ask, "Can this session be trusted?"

The Missing Context: Network and Infrastructure Transparency

This is where session enrichment complements edge security. While CDNs excel at evaluating requests, session enrichment evaluates the trustworthiness of the session behind those requests.

Session enrichment provides an explainable trust assessment that includes transparent network and infrastructure-level attributes. It identifies anonymization technologies, residential proxy usage, VPNs, emerging proxy infrastructure, automation frameworks, AI-driven traffic, and other behaviors that are difficult to infer from individual requests alone.

But rather than just simply returning network attributes, session enrichment also provides a policy-ready decision object containing an enforcement recommendation, the reason for that recommendation, and the underlying session assessment that produced it. This enables Cloudflare Workers and other programmable edge platforms to make consistent, transparent, and auditable trust-aware enforcement decisions on intelligence that is often missing from existing security stacks.

Session enrichment doesn't replace a CDN – it increases the value of it by supplying intelligence it was never designed to produce.

Importantly, each session enrichment response includes a unique decisionId, enabling organizations to correlate authentication events with Cloudflare or other CDN logs, SIEM alerts, fraud investigations, and customer support cases. Rather than simply knowing a request was blocked, teams know why it was blocked and can trace that decision throughout downstream workflows.

Five Use Cases for Adding a Trust Layer to Prevent Authentication-Based Attacks

Following are five use case examples that demonstrate how session enrichment can improve edge enforcement using attributes in the session object below.

  {
    "allowed": false,
    "reason": "Anonymous connections blocked",
    "assessment": {
      "vpn": true,
      "proxied": false,
      "anon": true,
      "rdp": false,
      "dch": true,
      "cc": "US",
      "ip": "146.70.202.60",
      "ts": "2026-07-07T23:54:48Z",
      "complete": true,
      "id": "35ea59be-539d-4f65-b699-77ddc13c5df2",
      "sid": "test-app",
      "service": "PROTON_VPN",
      "cpd": "test-cpd-value",
      "ai_agentic": false,
      "ai_crawling": false
    },
    "decisionId": "1a08c38d-810e-4a90-8705-dd3d9a76c529"
  }

Example #1: Applying Progressive Authentication for Anonymous Sessions

A login attempt originating from an anonymized VPN isn't automatically fraudulent, but it represents elevated uncertainty.

Consider the following session trust assessment:

{
  "allowed": false,
  "reason": "Anonymous connections blocked",
  "assessment": {
    "vpn": true,
    "anon": true,
    "service": "PROTON_VPN",
    "sid": "login"
  }
}

• allowed provides an immediate policy outcome that the CDN or authentication workflow can consume.
• reason gives a clear, human-readable explanation for why the session requires additional scrutiny.
• vpn indicates the login originates from a commercial VPN.
• anon confirms the connection is intentionally anonymized, increasing uncertainty during authentication.
• service identifies the specific VPN provider, enabling provider-specific policies or investigations.
• sid demonstrates that this decision applies specifically to the login workflow, allowing organizations to apply different policies for login versus other user actions.

Rather than treating every VPN user as malicious, the authentication flow can introduce progressive friction only when trust signals warrant it. This approach increases confidence during login without unnecessarily challenging legitimate users.

Rather than forcing developers to build policy logic around individual attributes, session enrichment provides a policy-ready decision with a transparent explanation that Cloudflare or other CDNs can immediately enforce or customize.

Example #2: Implementing Stronger Controls During Account Creation

Fraudsters commonly create accounts through commercial VPNs and residential infrastructure to evade rate limits and reputation systems.

In the following example, the session trust assessment returned a decision to block an anonymous session in a signup (account creation) workflow based on these attributes:

• Commercial VPN originating from anonymous infrastructure.
• Identifying the specific provider.

{
  "allowed": false,
  "reason": "Anonymous connections blocked",
  "assessment": {
    "vpn": true,
    "anon": true,
    "service": "PROTON_VPN",
    "sid": "signup"
  }
}

Because the response already contains an enforcement recommendation, organizations can immediately reject, challenge, or require step-up authentication without writing custom detection logic in their CDN.

Example #3: Applying Explainable Authentication Decisions

Consider the session trust assessment below, which contains the following attributes:

• allowed is the policy decision.
• reason is the reason behind the decision in human-readable language.
• vpn + anon + dch explain why the session exceeded policy.
• service is useful for tuning or investigating recurring abuse from a provider.
• decisionId enables auditability and correlation with Cloudflare logs, SIEM events, or fraud investigations.

{
  "allowed": false,
  "reason": "Anonymous connections blocked",
  "assessment": {
    "vpn": true,
    "anon": true,
    "dch": true,
    "service": "PROTON_VPN"
  },
  "decisionId": "1a08c38d-810e-4a90-8705-dd3d9a76c529"
}

Rather than receiving an opaque risk score, session enrichment ensures that analysts can see that the decision was driven by a combination of VPN usage, anonymization, and datacenter infrastructure. This transparency improves policy tuning and reduces unnecessary investigations.

Example #4: Escalating High-Risk Login Attempts

Authentication attempts originating simultaneously from anonymized infrastructure and data center hosting represent significantly higher risk than typical consumer VPN usage. These characteristics are commonly associated with automated credential attacks and malicious infrastructure and can identify sessions that deserve immediate intervention.

Consider the session trust assessment below, which contains the following attributes:

• allowed indicates the session exceeded the organization's trust policy and should be blocked or immediately escalated.
• reason explains why the enforcement action occurred, improving transparency for analysts and administrators.
• vpn identifies anonymization through a commercial VPN.
• anon signals that the user is intentionally masking their network identity.
• dch indicates the session originates from datacenter infrastructure, which is more commonly associated with automated attacks and credential abuse than typical consumer traffic.
• decisionId creates a durable audit trail that can be correlated with Cloudflare logs, SIEM events, fraud investigations, and customer support cases.

{
  "allowed": false,
  "reason": "Anonymous connections blocked",
  "assessment": {
    "vpn": true,
    "anon": true,
    "dch": true
  },
  "decisionId": "1a08c38d-810e-4a90-8705-dd3d9a76c529"
}

The underlying assessment explains precisely why the session exceeded policy, making enforcement easier to validate and audit.

Example #5: Protecting Password Resets

Password reset is an especially sensitive workflow because it can immediately lead to account takeover. Therefore, a password reset request originating from anonymized infrastructure carries a different risk profile than a routine login because successful completion immediately grants control of the account.

In the following example, the session trust assessment returned the follow attributes:

• allowed indicates that the password reset is denied or challenged.
• reason explains why the decision was made.
• vpn + anon represent a high-risk recovery request.
• service is useful for investigation and reporting.
• sid shows the policy is specific to the password reset workflow rather than all authentication events.
• decisionId enables downstream correlation with SIEM events if the user contacts support or if analysts investigate the event.

{
  "allowed": false,
  "reason": "Anonymous connections blocked",
  "assessment": {
    "vpn": true,
    "anon": true,
    "service": "PROTON_VPN",
    "sid": "password-reset"
  },
  "decisionId": "1a08c38d-810e-4a90-8705-dd3d9a76c529"
}

Complementing CDNs with Session Enrichment

The benefits of delivering session enrichment in your CDN even extend beyond authentication use cases.

Security Architecture Remains Unchanged

Perhaps the most important aspect of leveraging more comprehensive session enrichment in edge security is that it does not require organizations to rethink their security architecture. The CDN continues performing the functions it already performs exceptionally well – traffic inspection, policy enforcement, edge execution, and request handling – while session enrichment adds an additional layer – at the infrastructure level – that the CDN can consume during those policy decisions.

The important distinction is that the CDN remains the enforcement engine. Session enrichment simply gives it better information. The result is more precise enforcement rather than simply more enforcement.

The Future of Edge Security Is Better Session Enrichment

As attackers increasingly combine residential proxies, commercial VPNs, datacenter infrastructure, and agentic AI, session enrichment provides the context needed to distinguish trusted users from higher-risk sessions.

Edge security platforms will remain central to application protection because they provide the ideal location to make enforcement decisions – in real time before traffic reaches the application.

By combining CDN enforcement capabilities with real-time session enrichment, organizations gain deeper visibility into who is really behind a session, enabling them to reduce fraud, stop abuse earlier, and deliver stronger protection without introducing unnecessary friction for legitimate users.

How Spur Monocle Helps

Spur Monocle integrates directly with Cloudflare Workers and other programmable edge platforms so that organizations can immediately enrich existing authentication and security policies without redesigning their architecture. With Monocle, security and fraud teams can introduce progressive authentication, strengthen account creation defenses, protect password recovery workflows, reduce false positives, and apply consistent trust policies across every edge interaction.

For more information on how Spur Monocle complements Cloudflare and other CDN deployments with advanced session enrichment, check out the solution brief or try our zero-friction Cloudflare integration today.