How This Briefing Works
This report opens with key findings, then maps the gaps between what Glassbox discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Analysis pending. Findings will appear here once intelligence collection is complete.
Disclosure Gaps
Claims vs. Observed Behavior
1 gaps
pending
MEDIUM
They Claim
“Requires scanner verification of runtime behavior”
Observed Behavior
Analysis based on Glassbox public documentation, AWS Marketplace listing, and privacy policy
Customer Impact
What This Means For You
Organizations deploying Glassbox accept a maximalist data collection model by design. The automatic capture approach means sensitive data may be recorded before masking rules are applied or discovered, creating retroactive PII exposure risk. Session Vault long-term retention amplifies breach impact because historical recordings contain behavioral data spanning months or years. For regulated industries (finance, insurance, healthcare), the compliance record-keeping use case creates tension with data minimization requirements under GDPR and similar frameworks. If Glassbox's JavaScript is compromised, the tagless capture approach means attackers gain access to all user interactions without needing to configure additional collection.
Recommended Actions
What To Do About It
Role-specific actions based on observed behavior
Recommended Actions for Glassbox
- →- Conduct a thorough review of Glassbox's default data capture scope to understand exactly what is being recorded before masking is applied. - Configure data masking rules proactively for all sensitive fields, recognizing that automatic capture will record everything until masking is explicitly configured. - Establish Session Vault retention limits aligned with actual compliance requirements rather than accepting default long-term storage. - Review all integration connections to understand where session replay data flows beyond the Glassbox platform. - Implement consent mechanisms that accurately describe the scope of automatic session capture to end users.
Negotiation Leverage
- →Leverage: Glassbox's ISO 27701 certification and privacy-by-design positioning creates an expectation of strong data governance. Hold them to this standard contractually. The tension between automatic capture and data minimization provides negotiation leverage for restrictive data processing terms. Key questions: What is the default data capture scope before any masking is configured? How is masking applied -- client-side before transmission or server-side after capture? What is the retention policy for Session Vault recordings and can it be customer-configured? Does Glassbox access session recordings for product improvement or benchmarking? Protections to require: Contractual commitment that masking is applied before data leaves the client browser. Maximum retention limits for Session Vault. Right to audit the scope of automatic capture. Data portability and deletion guarantees. Indemnification for PII exposure resulting from gaps between automatic capture and masking configuration.
IOC Manifest
IOC Manifest
129 INDICATORS
Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
TRACK
*www.glassbox.com/_nuxt/BQ0LCv7I.js*
Tracking script
TRACK
*www.glassbox.com/_payload.json*
Tracking script
TRACK
*www.glassbox.com/_nuxt/iybhsOtD.js*
Tracking script
TRACK
*www.glassbox.com/_nuxt/builds/meta/*-724a-44d4-afcf-*.json*
Tracking script
TRACK
*www.glassbox.com/platform/customer-journey-analytics/_payload.json*
Tracking script
TRACK
*www.glassbox.com/leadership/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/session-replay/_payload.json*
Tracking script
TRACK
*www.glassbox.com/solutions/financial-services/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/_payload.json*
Tracking script
EXFIL
*www.glassbox.com/platform/tagless-data-capture/_payload.json*
Data collection endpoint
EXFIL
*www.glassbox.com/platform/data-privacy-security/_payload.json*
Data collection endpoint
TRACK
*www.glassbox.com/events/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/interaction-and-heatmaps/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/accessibility/_payload.json*
Tracking script
TRACK
*www.glassbox.com/why-glassbox/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/integrations/_payload.json*
Tracking script
TRACK
*www.glassbox.com/website-performance-benchmarks/_payload.json*
Tracking script
TRACK
*www.glassbox.com/contact-us/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/mobile-app-analytics/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/performance-analytics/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/struggle-error-analysis/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/voice-of-the-silent/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/product-analytics/_payload.json*
Tracking script
TRACK
*www.glassbox.com/website-performance-test/_payload.json*
Tracking script
TRACK
*www.glassbox.com/solutions/customer-experience/_payload.json*
Tracking script
TRACK
*www.glassbox.com/case-studies/_payload.json*
Tracking script
TRACK
*www.glassbox.com/why-glassbox/g2-report/_payload.json*
Tracking script
TRACK
*www.glassbox.com/blog/_payload.json*
Tracking script
TRACK
*www.glassbox.com/solutions/engineering-devops/_payload.json*
Tracking script
TRACK
*www.glassbox.com/why-glassbox/reviews/_payload.json*
Tracking script
TRACK
*www.glassbox.com/about-us/_payload.json*
Tracking script
TRACK
*www.glassbox.com/why-glassbox/services-and-customer-success/_payload.json*
Tracking script
TRACK
*www.glassbox.com/solutions/compliance/_payload.json*
Tracking script
TRACK
*www.glassbox.com/solutions/marketing-ecommerce/_payload.json*
Tracking script
TRACK
*www.glassbox.com/contact-sales/_payload.json*
Tracking script
TRACK
*www.glassbox.com/resource-center/_payload.json*
Tracking script
TRACK
*www.glassbox.com/careers/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/glassbox-insights-assistant/_payload.json*
Tracking script
EXFIL
*www.glassbox.com/platform/rapid-response/_payload.json*
Data collection endpoint
TRACK
*www.glassbox.com/solutions/product-management-ux/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/artificial-intelligence/_payload.json*
Tracking script
TRACK
*www.glassbox.com/solutions/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/funnel-analysis/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/plans-pricing/_payload.json*
Tracking script
TRACK
*www.glassbox.com/guides/_payload.json*
Tracking script
EXFIL
*www.glassbox.com/solutions/data-analytics/_payload.json*
Data collection endpoint
TRACK
*www.glassbox.com/glossary/_payload.json*
Tracking script
TRACK
*www.glassbox.com/get-a-demo/_payload.json*
Tracking script
TRACK
*www.glassbox.com/platform/digital-record-keeping/_payload.json*
Tracking script
TRACK
*www.glassbox.com/why-glassbox/enterprise/_payload.json*
Tracking script
TRACK
*www.glassbox.com/solutions/insurance/_payload.json*
Tracking script
TRACK
*www.glassbox.com/partners/_payload.json*
Tracking script
TRACK
*www.glassbox.com/news/_payload.json*
Tracking script
TRACK
*www.glassbox.com/solutions/secure-cx/_payload.json*
Tracking script
TRACK
*www.glassbox.com/solutions/preventive-cx/_payload.json*
Tracking script
TRACK
*www.glassbox.com/solutions/proactive-cx/_payload.json*
Tracking script
TRACK
*www.glassbox.com/case-studies/sofi/_payload.json*
Tracking script
TRACK
www.glassbox.com/_nuxt/iybhsOtD.js
Auto-extracted from scan
TRACK
www.glassbox.com/_nuxt/BQ0LCv7I.js
Auto-extracted from scan
Ecosystem
Ecosystem & Supply Chain
Glassbox integrates with enterprise CRM platforms, analytics tools, A/B testing solutions, and customer feedback systems. Available on AWS Marketplace for streamlined procurement. The platform connects with voice of customer tools, digital adoption platforms, and business intelligence systems. Glassbox's API enables export of session data and behavioral metrics to data warehouses. The platform is typically accessed by digital experience, product, marketing, compliance, and customer service teams. Financial services and insurance organizations use Session Vault for regulatory record-keeping, which means session recordings may be retained and accessed by compliance and legal teams.
Evidence
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
HAR Capture
Complete network capture with all requests and responses
IOC Manifest
129 detection signatures across scripts, domains, cookies, and network endpoints