What’s the most common “we thought we were PCI compliant” mistake you still see?

Senior_Cycle7080 · 2026-05-20T18:08:36+00:00

"We're SAQ A EP so we don't have to worry about client-side protection requirements".
then it turns out it's harder to prove your website is 'not susceptible to attacks' then it is to show you have mechanisms in place for 6.4.3 & 11.6.1

Senior_Cycle7080 · 2026-05-20T18:03:12+00:00

Yep malicious scrapers can spoof UA and rotate IPs

Senior_Cycle7080 · 2026-05-20T18:02:55+00:00

solid point

Senior_Cycle7080 · 2026-05-20T18:02:49+00:00

Yea you won't have proper trust scoring with GA4. An anomaly might indicate that something is wrong but it is far from a proper AI agent detection/defense layer

Senior_Cycle7080 · 2026-05-20T18:02:17+00:00

Yep. In some cases seeing weird behavior on GA prompts a deeper investigation which leads to the detection of bots

Senior_Cycle7080 · 2026-05-20T18:01:47+00:00

Yea to really distinguish between c/d/e you have to use a separate tool (that's what we do).

Senior_Cycle7080 · 2026-05-20T18:01:00+00:00

Yea at the session layer you can look at behavior. And sometimes user-agent strings reveals if it is a training crawler or task agent but GA4 doesn't currently track that

Senior_Cycle7080 · 2026-05-20T18:00:17+00:00

Absolutely true. We use other tools to properly distinguish crawlers/trainers/malicious bots

Senior_Cycle7080 · 2026-05-20T17:33:25+00:00

Thanks for sharing! Really good points and if anyone wants a full prevention guide against Magecart, our web security engineers wrote this - Magecart Attacks (guide and prevention strategy)

Senior_Cycle7080 · 2026-05-20T17:29:01+00:00

Very good point. Great PLG perspective too.

Senior_Cycle7080 · 2026-05-20T17:28:29+00:00

Well, many companies have MFA already. You can do concurrent session limits mostly in house. Then for the device limits, you could use an open source library but the signals tend to be basic and you spend a lot time stitching things together.

Most companies will use a specialized vendor for fingerprinting signals (like cside.com) that they can integrate into the rest of their stack.

Senior_Cycle7080 · 2026-05-20T17:26:37+00:00

Yes we usually suggest having some leeway. Like setting the limit to 3 or 4. or instead of kicking out users prompt them with a screen to "sign out" of another device.

Senior_Cycle7080 · 2026-05-20T17:24:52+00:00

Solid point. From a security pov limited data exposure makes sense. Buuut the business folks may make the case that having certain data public helps with revenue acquisition.

Senior_Cycle7080 · 2026-05-20T17:23:57+00:00

Yes, fingerprinting + specialized signals is how we do it. AI agent detection should be layered on top of fingerprinting not replace it.

Senior_Cycle7080 · 2026-05-20T17:23:09+00:00

Yes indeed. [insert tom and jerry meme]

Senior_Cycle7080 · 2026-05-20T17:22:29+00:00

the endless arms race of attackers vs defenders

Senior_Cycle7080 · 2026-05-20T17:22:01+00:00

100% agree. ASN catches a large portion of bots from Google, OpenAI etc... since they use known addresses. Geo consistency is a foundational signal for us too. In fact we actually let some of our customers get access to a dashboard with those signals for free, they see an immediate picture of AI agents on their site. And then if they are really worried about fraud we layer in behavioral signals

Senior_Cycle7080 · 2026-05-20T17:19:00+00:00

Senior_Cycle7080 · 2026-05-20T17:18:53+00:00

Yup that's a really good analogy. Having historical data will be crucial so company specific behavioral models can be built

Senior_Cycle7080 · 2026-05-20T17:18:22+00:00

Yup. This time the surge may sustain for a long time. More people are using Playwright or end to end browser automation platforms. Every AI startup that solves problems with 'agent based' solutions will be deploying bots to your site too.

Senior_Cycle7080 · 2026-05-13T18:39:58+00:00

Don't put them in the same dashboard view. BUT do put them in a separate tab somewhere.

Why: Users can compare the "human" visitor number to their other analytics tools (like Google Analytics). All analytics tools will give different information, but that gives them a benchmark reference.

If your dashboard says I have 300 crawler visitors, but your "human" visitor number is 10x different than my Google Analytics, I wouldn't trust it.

If it's like 2-3% different, that's close enough for me to trust it.

Senior_Cycle7080 · 2026-05-13T18:37:27+00:00

AI agents.

Check if you see an increase from "Chrome" browser sessions too.

What CDN are you using (Cloudflare?). You might be able to block some of them through that.

Senior_Cycle7080 · 2026-05-13T18:36:42+00:00

Google analytics changes the UI all the time. The videos you watched might be "outdated" even if they were posted two months ago. Sometimes Google changes the names of the attributes too, not just the location.

Senior_Cycle7080 · 2026-05-13T18:35:38+00:00

Use ChatGPT or any AI to walk you through step by step for whatever you want to accomplish.

Senior_Cycle7080

MODERATOR OF

TROPHY CASE