How This Briefing Works
This report opens with key findings, then maps the gaps between what Pocus discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Pre-Consent Activity
Pocus was observed loading and executing before user consent was obtained on 50% of sites where it was detected.
Claims vs. Observed Behavior
disclosure
“Pending claims extraction”
High Broker (65) and Counselor (80) scores indicate significant undisclosed identity sharing and consent violations. Privacy policy likely omits IP-to-company matching, session recording, and cross-site visitor tracking.
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
If You Use Pocus
- →Implement consent gate before Pocus identity resolution activates
- →Audit session recording scope to confirm product usage data handling compliance
- →Review Data Processing Agreement for identity graph sharing with third parties
- →Confirm privacy policy discloses IP-based company identification and session recording
If You're Evaluating Pocus
- →Defer Pocus scripts until post-consent confirmation
- →Require vendor attestation on GDPR Article 6 lawful basis for identity processing
- →Assess first-party product-led growth signals using authenticated user data instead of anonymous tracking
- →Implement visitor anonymization controls for non-consenting users
Negotiation Leverage
- →Pocus contract likely permits identity data sharing across customer base for signal quality improvement - demand explicit prohibition and customer data isolation
- →Identity graphs and session recordings may persist visitor records indefinitely - negotiate retention limits aligned to sales cycle length
- →Confirm Pocus honors GDPR deletion requests and purges visitor records from identity graphs and session databases
- →Request disclosure of all firmographic data sources and third-party enrichment partners used for visitor matching
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Full session replay
Ignoring CMP signals
PII deanonymization
IOC Manifest
Indicators of compromise across 5 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
22 detection signatures across scripts, domains, cookies, and network endpoints