Spur Platform Update: AI Detection, Policy API & IP Intelligence

We’re pleased to announce several enhancements to the Spur solution, marking a major step forward in how customers observe anonymization infrastructure, enrich IPs, and act on risk. This update focused on three core outcomes:

• Improving visibility into AI infrastructure and geography.
• Enhancing control through actionable, real-time enforcement.
• Gaining stronger alignment between product experience and brand identity.

Building on recent company momentum, this update strengthens Spur’s position as the high-fidelity IP intelligence platform built for modern security and fraud teams.

AI Service Identification Improves Response to Automation Risks

As AI-driven automation becomes more prevalent across the web, understanding when traffic originates from infrastructure linked to AI providers – rather than traditional consumer or enterprise networks – is becoming increasingly important for security and risk teams. Accordingly, the Spur dataset now includes AI service identification, marking the start of our journey toward identifying infrastructure associated with AI service platforms.

AI service identification helps reduce ambiguity in investigations by adding context to traffic that may otherwise appear as generic cloud or datacenter activity. By labelling infrastructure associated with known AI providers, organizations can more clearly differentiate AI service-associated traffic from other forms of automation, informing decisions on how to respond to such traffic.

This initial phase focuses on self-declaring AI providers, including Anthropic, OpenAI, Mistral AI, and Perplexity AI, with expanded coverage of AI services coming in future updates.

This enhancement represents a strategic step forward in helping customers adapt to the IP-related risks inherent in the rapidly developing AI ecosystem.

AI service tagging in the Spur IP context object

Updated Geographic Presence Enhances Visibility into Exit Node Concentration

Geography is a significant influence for attackers in determining how a service could be strategically used. Different countries have different rules around data retention, hosting, and removal of content, leading attackers to choose certain jurisdictions due to weaker enforcement or oversight. Activity may be routed through regions where it can blend in with normal/expected user traffic.

To aid teams in distinguishing high-concentration geographies, Spur has enhanced the Geographic Presence map visual within Service profile pages. Countries are now weighted with shaded intensity, indicating where each service has the greatest exit node presence, and how a service’s associated IPs are distributed across countries.

Customers can use this new visualization to:

• Identify where exit traffic blends in geographically.
• Evaluate trends in IP sourcing, service presence, and ubiquity.
• Assist in compliance decisions and enforcement impacts.

Along with Spur’s recently announced geographic IP capabilities, this enhancement provides users with clearer visibility into where a service’s infrastructure is concentrated, adding important geographic context when assessing the reputation of a service and potential areas of risk that could be exposed by threat actors.

Spur geographic concentration map

New Policy API Enables Real-Time Action on User Sessions

The newest Monocle Session Assessments update enables security and fraud teams to go from simply identifying potentially risky user sessions to enforcing rules to block traffic based on several critical attributes.

Monocle Assessments Flag Important Attributes

Monocle passively gathers data about your users' connections in the form of a Monocle Assessment. Monocle Assessments return attributes on a user’s profile, including:

1. How the user connected – via VPN, proxy, anonymous, RDP, or DCH – including the actual service in use.
2. Country code of the source IP address.
3. IPv4 and IPv6 addresses.
4. Additional attributes that can be appended to the assessment.

Spur Monocle session assessment

New Policy API Enables Actions Based on Flags

Previously, Monocle customers added assessment data to other criteria to make website or application blocking decisions. However, the newest Monocle release adds a Policy API that provides built-in logic to enable blocking decisions in real-time.

Flexible blocking strategy

With the new Monocle Policy API, customers have flexible options to block website traffic, including:

• Blocking all traffic from anonymous services.
• Blocking all traffic from Spur identified anonymous services.
• Implementing custom blocking rules.

Custom rules add granularity to reduce unnecessary user friction

The Monocle Policy API can be configured to:

• Block all anonymous users and allow all other users.
• Block anonymous users but exclude unlabeled proxies.
• Block connections that come from VPNs, proxies, datacenters, or RDP.
• Block when there is a mismatch in IP information.
• Block or exempt specific services, ignoring all other rules.
• Block or allow assessments from specific countries.

Customers can also configure maximum time to live (TTL) in seconds to better control resource consumption.

With this level of granularity, security teams can flexibly apply user friction policies based on ground truth data, reducing the risk of blocking good user sessions.

How Customers Benefit from the New Policy API

Implementing these real-time actions based on the contents of a session assessment enables you to limit user friction while preventing suspicious traffic tied to fraudulent activity.

Eliminate fraudulent account creation

Anonymized IPs are a common vector for fraudsters to create accounts. With the new Policy API, you can not only flag masked IPs at signup, but also set rules to allow, deny, or add verification to challenge if a new account is being created using anonymizing infrastructure.

Reduce geo spoofing

Fraudsters spoof location to bypass regional restrictions (such as content streaming or gambling), pricing differences, or regulatory limits. The new Policy API enables you to reveal a user’s true network origin and apply policies to block or allow activity accordingly.

Suspicious logins

If users log in from anonymized IPs, it raises the likelihood of credential stuffing, unwanted bot activity, or cookie replay. Monocle enriches login events with IP intelligence, enabling you to flag risky authentications and require step up verification or outright deny access when traffic is anonymized.

Platform Announcements Improve Awareness of Key Updates

The latest update includes several enhancements to the Spur platform in line with our new brand identity introduced on February 11, 2026.

Customers will now see an announcements area in the bottom-left of the app. This feature enables Spur to proactively push communications directly within the platform and include helpful links to content, such as research findings and important platform functionality updates.

This enhancement creates a new engagement channel with our customers directly inside the product itself, helping to ensure continuous visibility into key updates.

Spur app announcements

New Usage Reporting Improves Transparency

The latest Spur update introduces new Usage Reporting to support new license limits for Users, Manual Lookups, and Monocle Sessions presented within the Billing page. Customers can now more easily understand how their usage aligns with their plan and gain clear visibility into usage Reset dates.

This enhancement improves transparency within the platform and helps to manage usage expectations.

Spur app usage reporting

Next Steps

The latest Spur capabilities increase transparency into infrastructure and enable customers to move from insight to enforcement in real time. From AI service attribution and weighted geographic visibility to real-time policy decisions, each enhancement is designed to reduce friction for legitimate users while raising the bar for threat actors.

As we continue rolling out additional functionality updates in the coming months, our focus remains the same: deliver trusted intelligence, actionable controls, and measurable value inside the workflows our customers rely on every day.

Spur customers, contact your customer success manager for more information.

Prospective Spur customers, sign up for a free Spur account to get immediate access to our high-fidelity IP intelligence.