HUMAN Security sells “trust.”
We looked at what the code actually does.
HUMAN Security (formerly PerimeterX) processes 20 trillion interactions per week across 500+ customers. They call themselves “The Trust Layer for Digital Customer Experiences.” Their code — deployed on linkedin.com and thousands of other sites — runs a 48-feature device fingerprinting system inside hidden zero-pixel iframes, probes for 6,153 browser extensions, and transmits RSA-encrypted payloads to undisclosed infrastructure.
Security is the costume. The data is the business.
What we found on linkedin.com. In one session.
Every number above was independently verified by BLACKOUT on April 2, 2026. LinkedIn’s own Senior Engineering Manager confirmed the extension scanning system under oath in German court proceedings. The full investigation is published at /investigations/browsergate.
What “bot detection” actually deploys on your visitors.
These are the techniques we observed in HUMAN Security’s PerimeterX sensor running live on linkedin.com. All execute without visitor consent. All run inside hidden infrastructure designed to avoid detection.
6,153 Chrome extensions probed by ID on every page load
Hidden canvas elements rendered with Unicode, output hashed
GPU renderer, vendor, 65+ parameters extracted
Mouse movements (200ms), keystrokes, scroll, touch patterns
Zero-pixel, position: -9999px, aria-hidden="true"
Off-thread execution invisible to DevTools
Bot detection requires answering one question: is this a human or a bot? That does not require scanning 6,153 browser extensions. It does not require probing GPU hardware. It does not require hidden iframes, encrypted payloads, or off-thread Web Workers invisible to DevTools. The technology exceeds the stated purpose by orders of magnitude.
What HUMAN Security says. What BLACKOUT observed.
Every claim is from HUMAN Security’s own Data Security & Privacy FAQ, last updated March 2026.
We scanned humansecurity.com.
- "Privacy is on by default"
- "We minimize the collection of identifying information"
- "We are clear about our privacy commitments"
- SOC 2 Type 2 and ISO 27001 compliant
- ZoomInfo — registered California data broker, base64-encodes visitor IP
- ContentSquare — full session recording (mouse, scroll, clicks, forms)
- HockeyStack — scans DOM to detect other vendors on the page
- LiveRamp — cookie sync to cross-device identity graph
- LinkedIn — li/track as the FIRST network request on page load
- PerimeterX — their own product fingerprinting their own visitors
- 36 third-party domains total
These are deliberate choices. On their own website, where they control every decision, the company that sells “privacy by default” deployed a registered data broker, session recording, identity resolution, and their own fingerprinting product. If this is how they treat their own visitors, what does the technology do on someone else’s site?
~$300M raised. $1.5B+ valuation. 500+ customers.
HUMAN Security was formed from the merger of White Ops and PerimeterX in 2022. ~500 employees. $100M+ ARR. Backed by Goldman Sachs, NightDragon, WestCap, ClearSky, and Vertex Ventures.
White Ops co-founder. Fast Company #1 Most Creative Person 2019. Led the 3ve/Methbot botnet takedowns with the FBI.
Former President of Recorded Future ($2.65B Mastercard acquisition). Former exec at iSIGHT Partners (acquired by FireEye) and Optiv.
PerimeterX co-founder. Led R&D and product strategy for the sensor technology deployed on linkedin.com.
The technology is sophisticated. Layered concealment architecture (hidden iframes inside hidden iframes). Encrypted exfiltration with automatic fallback. Off-thread execution to avoid observation. 200KB of obfuscated code with a custom bytecode interpreter. This is not proportionate to answering “is this a bot?”
Bot detection is the product. What’s the data for?
The question is not whether HUMAN Security detects bots. They probably do. The question is what else happens with the most comprehensive cross-site fingerprint database ever assembled — 20 trillion interactions per week across 3 billion unique devices. Bot detection requires a yes/no answer. The data collection far exceeds what that answer requires.
When the technology is disproportionate to the stated purpose, the stated purpose isn’t the real business. Security is the costume. The surplus data is the product.
They sell script monitoring. They are the script that needs monitoring.
HUMAN Security’s Client-Side Defense product promises to “get full visibility and control over client-side scripts” and protect against “client-side supply chain attacks.” Meanwhile, their own PerimeterX sensor is the undisclosed third-party script operating via hidden iframes and setting tracking cookies without consent on LinkedIn and other properties.
Client-Side Defense
“See all client-side 1st- and Nth-party script behavior in the browser during real visitor sessions. Automate zero-trust policies to block risky script behavior.”
The Undisclosed Script
A 226KB obfuscated sensor deployed inside a hidden zero-pixel iframe, fingerprinting visitors across 500+ customer sites, with no disclosure in LinkedIn’s privacy policy or subprocessor list. The EFF’s Privacy Badger blocks PerimeterX because they explicitly refuse to honor Do Not Track signals.
They charge enterprises $105K-$1.5M/year for the privilege of deploying the same surveillance technology that BLACKOUT would flag as hostile. If you ran HUMAN Security’s Client-Side Defense product on a site that also runs HUMAN Security’s PerimeterX sensor, the product would need to flag itself.
HUMAN Security doesn’t protect against GTM collapse. It accelerates all four vectors at once.
BLACKOUT classifies GTM risk across four collapse vectors. Vendors that trigger one are a problem. HUMAN Security triggers all four simultaneously.
Your measurement is contaminated.
The fingerprinting system creates a parallel truth about your visitors that you can’t see, can’t audit, and didn’t consent to. 48 features collected, results encrypted before transmission. You’re making decisions based on data flowing through infrastructure you don’t control and can’t inspect.
Your visitors’ fingerprints are pooled across 500+ sites.
20 trillion interactions per week across 3 billion devices. Your visitors’ device signatures, extension lists, and behavioral patterns flow through HUMAN Security’s infrastructure alongside data from your competitors’ sites. Your demand signals aren’t just leaking — they’re being aggregated into a dataset you don’t own.
226KB of code you haven’t audited, running on your site.
Hidden iframes. Blob Web Workers. Encrypted payloads. A 200KB auditor script with a custom bytecode interpreter. Each one is an attack surface you own but don’t control. If HUMAN Security gets breached, every site running their sensor is compromised.
Your consent banner doesn’t cover what you don’t know about.
LinkedIn’s privacy policy doesn’t mention extension scanning. HUMAN Security isn’t listed as a subprocessor. Your consent mechanism covers the vendors you know about — not the hidden iframes and encrypted payloads your “security” vendor deployed without telling you. When the regulator comes, they fine you. Not the script.
The “security” label is what keeps anyone from noticing. Nobody audits the security vendor. That’s why the costume works — until someone looks at the code.
BLACKOUT.
We observe every vendor’s code executing in your environment. Every network request, every cookie, every hidden iframe, every blob Worker. Not a questionnaire. Direct observation.
600+ vendor dossiers. Claims vs. reality analysis. BTI threat classification. We don’t take vendors at their word. We compare what they say against what we observe.
Court-ready evidence packs. HAR captures. Full network traffic analysis. The kind of evidence that holds up when a regulator asks “what did you know and when did you know it?”
BLACKOUT does not fingerprint your visitors. We don’t deploy hidden iframes. We don’t run blob Web Workers. We don’t probe for browser extensions. We run Plausible analytics on our own site. That’s it. Scan us. We’re clean. That’s the point.
HUMAN Security is a cross-site fingerprint database in a security costume.
BLACKOUT exists because companies like HUMAN Security proved the category needs to exist.
When the technology is disproportionate to the stated purpose, the stated purpose isn’t the real business.