How Session Enrichment Helps Stop Bot and Automation Abuse​

Modern web applications face a new class of abuse. Unlike traditional cyberattacks that attempt to steal accounts or compromise systems, today's adversaries increasingly seek to manipulate digital experiences themselves. For example, automated traffic purchases concert tickets before fans can, scrapes proprietary content to train AI models, reserves inventory without intending to purchase it, inflates advertising metrics, and overwhelms APIs driving cloud infrastructure costs upward.

Many of these attacks no longer originate from obvious botnets. Instead, they blend in with normal looking traffic that leverages residential proxies, VPNs, browser automation frameworks, AI agents, and rapidly changing anonymized infrastructure that intentionally resembles legitimate users.

Organizations have invested heavily in solutions to combat this problem. These technologies remain valuable, but each answers only part of the question. What organizations increasingly need is confidence in the trustworthiness of the individual user session before making enforcement decisions.

This post examines the growing impact of automation and explains how session enrichment complements existing technologies.

The Growing Impact of Untrusted Sessions

Digital abuse is no longer defined solely by whether a request is generated by a human or a machine. Instead, it is defined by whether the session itself can be trusted. Sophisticated attackers now rely on residential proxies, commercial VPN services, browser automation frameworks, remote desktop services, AI agents, and rapidly changing cloud infrastructure specifically designed to resemble legitimate users. The result is a growing class of attacks that target digital experiences rather than just identities.

Scalping & Denial of Inventory

Scalpers purchase everything from concert tickets and gaming consoles to limited-edition merchandise before legitimate customers have an opportunity to buy them. Rather than relying on traditional botnets, many scalpers now distribute purchases across thousands of residential proxy IP addresses, enabling each purchase attempt to appear as though it originates from a different consumer household. During major ticket releases and product launches, these techniques have repeatedly overwhelmed online purchasing systems while frustrating legitimate customers.

The same techniques enable denial of inventory attacks. Automated systems reserve scarce resources – for example hotel rooms, airline seats, appointment slots, and retail inventory – not to purchase them, but to prevent legitimate customers from doing so. In many industries, simply making inventory temporarily unavailable can generate competitive advantage or create opportunities for resale.

Scraping

Scraping has undergone a similar evolution. Automated systems continuously harvest everything from proprietary pricing data and product catalogs to market intelligence and original content, often using residential proxy networks that rotate identities quickly enough to evade conventional rate limits. The rapid growth of generative AI has accelerated this trend, as organizations seek ever-larger datasets for model training.

Fake Interactions

Organizations increasingly face fake ad impressions, artificial clicks, fake reviews, fraudulent signups, engagement farming, and AI-generated browsing behavior. The result is poor decision making due to skewed analytics and increased operational costs.

These attacks share an important characteristic: they are intentionally designed to appear ordinary. Traditional indicators such as IP reputation or obvious bot signatures are often absent. Instead, attackers focus on blending into legitimate traffic while exploiting the trust that organizations naturally extend to every new session.

As cloud-native architectures continue to move toward usage-based pricing, every unnecessary request carries both security risk and financial cost. Organizations increasingly need a way to determine whether an individual session deserves trust before expensive application resources are consumed.

Why Existing Technologies Still Have Blind Spots

Attackers deliberately combine legitimate technologies with abusive intent. Residential proxy networks provide authentic consumer IP addresses. Legitimate customers widely use Commercial VPN services. Browser automation frameworks increasingly mimic human browsing behavior with remarkable fidelity. AI agents are capable of navigating websites in ways that closely resemble real users. As these technologies converge, traditional detection methods lose precision because the underlying infrastructure itself appears legitimate.

This creates a critical visibility gap. Organizations may know that a request came from a recognized browser, that it solved a CAPTCHA, or that it does not match a known attack signature yet still have little understanding of whether the network environment supporting that session should be trusted.

Organizations have assembled sophisticated security stacks that combine multiple technologies to address these challenges. Each addresses a specific aspect of online abuse and remains an important component of a modern defense strategy but has gaps in session insights.

Filling the Gaps with Session Enrichment

Session enrichment closes these technology gaps by enriching every interaction with explainable context about the network from which it originates. Rather than producing an opaque risk score, session enrichment returns an explainable, policy-ready decision object. Each assessment includes an enforcement recommendation, the reason behind that recommendation, the supporting session assessment, and a unique decision identifier. See an example at right.

Attributes include whether the connection originates from a VPN, residential proxy, datacenter, remote desktop environment, or other anonymizing infrastructure, as well as the specific service responsible whenever possible.

Security and fraud teams gain transparent evidence explaining why a session should or should not be trusted, enabling deterministic policies instead of relying solely on proprietary scores.

Example Session Assessment

{
  "allowed": false,
  "reason": "Anonymous connections blocked",
  "assessment": {
    "vpn": true,
    "proxied": false,
    "anon": true,
    "rdp": false,
    "dch": true,
    "cc": "US",
    "ip": "146.70.202.60",
    "ts": "2026-07-07T23:54:48Z",
    "complete": true,
    "id": "35ea59be-539d-4f65-b699-77ddc13c5df2",
    "sid": "test-app",
    "service": "PROTON_VPN",
    “cpd”: “test-cpd-value”,
    "ai_agentic": false,
    "ai_crawling": false
  },
  "decisionId": "1a08c38d-810e-4a90-8705-dd3d9a76c529"
}

Bot and Automation Abuse Use Cases

Consider how a security or fraud team can use the attributes observed in the session object above to inform actions in the following use cases.

Best Practices for Leveraging Session Enrichment to Protect Against Automation

Organizations see the greatest benefit when session enrichment complements existing controls.

Evaluate Every Session Independently

Evaluate every session independently rather than relying solely on historical account behavior or persistent device identifiers. Modern attacks frequently originate from first-time visitors, making real-time assessment essential for accurate decision making.

Detect First-Use Infrastructure

Comprehensive coverage of modern anonymization infrastructure is equally important. Identify not only traditional VPN services but also residential proxies, datacenter proxies, remote desktop services, and rapidly emerging proxy networks that increasingly power automated abuse campaigns. The ability to recognize newly observed infrastructure before reputation systems have classified it provides organizations with valuable time to respond to evolving threats.

Produce Explainable Trust Decisions

Rather than relying on proprietary risk scores, high-quality session enrichment should return an explainable assessment containing a policy recommendation, the reason behind that recommendation, and the supporting session attributes. This enables organizations to build deterministic enforcement policies while simplifying tuning, investigations, and audits.

Enforce Inline

Session assessments must complete quickly enough to support real-time decisions at the edge, within CDNs, WAFs, API gateways, checkout systems, and authentication workflows without introducing noticeable latency. At the same time, minimize privacy impact by avoiding persistent identifiers whenever possible while still providing meaningful insight into session trustworthiness.

Because session enrichment returns a complete policy decision object, edge platforms can immediately allow, challenge, rate-limit, or block traffic while retaining the supporting assessment for downstream fraud investigations and operational reporting.

Ultimately, the strongest session enrichment platforms are those that complement existing security investments rather than replace them.

How Spur Helps Mitigate the Risks of Bot and Automation Abuse

Bot management platforms are highly effective at detecting automation, but automation alone does not determine whether a session should be trusted. Spur Monocle complements existing bot management, fraud detection, device intelligence, and edge security platforms by evaluating the trustworthiness of every session and returning an explainable, policy-ready assessment. Each response includes an enforcement recommendation, the reason behind that recommendation, the supporting session assessment, and a unique decision identifier that can be correlated across Cloudflare, other edge enforcement platforms, SIEMs, fraud platforms, and customer investigations.

By identifying anonymization technologies, commercial VPNs, data center infrastructure, attributed network services, and AI-driven activity before expensive application resources are consumed, organizations can stop scraping, scalping, denial of inventory, and fraudulent interactions earlier in the request lifecycle.

Rather than replacing existing security investments, Spur makes them more effective by providing the missing layer that enables smarter, more transparent, and more consistent enforcement decisions.

Get 100,000 Session Assessments Every Month for Free

See how session enrichment can help you detect anonymized infrastructure, bots, AI-driven activity, and other signs of untrusted sessions. Sign up for Spur Community to get 100,000 session assessments per month at no cost, or get pricing for higher-volume and enterprise requirements.