How This Briefing Works
This report opens with key findings, then maps the gaps between what PerimeterX discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Claims vs. Observed Behavior
pending
“Unknown”
Requires claims extraction via CDT
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use PerimeterX
- →Require data processing addendum with explicit fingerprinting technique disclosure
- →Demand false positive SLA and appeal process for blocked legitimate traffic
- →Implement bot score transparency dashboard to audit decision logic
- →Configure challenge workflows that minimize friction for low-risk interactions
- →Establish data retention limits for behavioral profiles and device fingerprints
If You're Evaluating PerimeterX
- →Test fingerprinting techniques to understand what signals are collected
- →Verify whether cross-customer threat intelligence influences risk scoring on your properties
- →Review session recording scope and data access controls for high-risk captures
- →Assess geographic data processing for GDPR compliance in EU deployments
- →Request disclosure of behavioral biometric retention and secondary use policies
Negotiation Leverage
- →PerimeterX deploys aggressive fingerprinting and cross-domain tracking for fraud detection—demand contractual liability protection for GDPR/CCPA violations and explicit DPA terms covering biometric data processing
- →Shared threat intelligence means visitor risk scores are influenced by behavior on unrelated properties—negotiate transparency into scoring logic and appeal rights for false positives
- →Bot detection false positives directly impact conversion but security teams lack visibility into blocked traffic—require SLA on false positive rates and detailed blocking analytics
- →Session recording for fraud analysis captures high-value user interactions—establish data access controls and retention limits to minimize breach exposure
- →Legal tail risk of 75% reflects fingerprinting necessity for fraud detection—evaluate whether security value justifies regulatory exposure or consider privacy-preserving alternatives like Cloudflare Turnstile
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Evasion infrastructure, auditor bypass
Impact: PerimeterX can detect security testing tools and alter bot detection behavior during assessments, masking production fingerprinting techniques.
Keystroke/mouse tracking
Impact: Mouse movement, keystroke dynamics, and interaction patterns create detailed behavioral profiles for fraud scoring.
Full session replay
Impact: Full session capture for high-risk interactions records user behavior during authentication and transaction flows.
Identity stitching
Impact: Threat intelligence sharing across customer deployments enables visitor tracking and risk scoring across unrelated properties.
Device identification
Impact: Aggressive device fingerprinting using canvas, WebGL, and hardware signals creates persistent identifiers that survive cookie deletion.
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
8 detection signatures across scripts, domains, cookies, and network endpoints