Risk Scoring

How Prosopo Risk Scoring works

Every verification request is given a risk score between 0 and 1 — the closer to 1, the more likely it is the request came from a bot. The score is a composite signal drawn from the browser environment, interaction behaviour, network properties, and any policies you've layered on top.

You can use the score in two ways:

1. Hands-off. Prosopo uses the score itself to decide whether the visitor passes silently, gets a Proof of Work challenge, or has to solve an image CAPTCHA. Your only knob is the Safety Threshold — raise it to challenge more visitors during an attack, lower it to reduce friction when things are calm.
2. In your own decisions. On paid tiers, the score is also returned to your backend with every verification response. Use it to drive your own logic — flag high-score signups for manual review, require step-up authentication on borderline scores, or route the request through a slower fraud check.

The score isn't a black box

Prosopo's score isn't a single opaque number — it's the result of several measurable signals you can reason about:

• Headless-browser detection. Tells normal Chrome from Playwright, Selenium and headless Chrome.
• Behavioural signals. Mouse movements, touch gestures and keyboard cadence that distinguish a person from a script.
• Network reputation. Whether the request comes from a residential connection, a VPN, a hosting datacenter, or a network with a history of abuse.
• Browser-environment fingerprint. Hundreds of small browser quirks that are hard to forge in automation.
• Site policy adjustments. Penalties applied for things like unverified origins or in-app webviews when you've configured Context Awareness.

You set a single number — the Safety Threshold — and the platform takes care of the rest. Or you take the score and use it however you want.

Decision Machines: bring your own logic

For teams that need more than a threshold, Prosopo supports Decision Machines — custom scoring logic you author yourself and run inside the verification pipeline. Use it to:

• Combine Prosopo's score with your own first-party signals (account age, device history, purchase value).
• Apply different policies for different parts of your site (checkout vs. comments vs. login).
• Express business rules that don't fit a single number — "if score > 0.7 and the user is signing in from a new country, require email re-verification".

Decision Machines run on Prosopo's infrastructure with no code deployed on your servers, and you can change them live without an integration update.

Hard blocks for the obvious bots

For the most extreme scores there's no point in even issuing a challenge — a sufficiently bad signal means the request should just fail. The Autoban score threshold lets you set a cutoff above which Prosopo skips the challenge step entirely and rejects the request outright. Useful during sustained automated attacks, when you'd rather burn no compute on visitors that are unambiguously bots.

How Prosopo Risk Scoring compares

Common use cases

• Stop credential stuffing by flagging high-risk login attempts for step-up auth.
• Stop account takeover with risk-tiered policies per action.
• Defend ticket drops by auto-banning the most obvious automation.
• Block click-fraud and ad-fraud with score-based filtering.

Configuration reference

• Safety Threshold — set how strict the default decision is.
• Context Awareness — apply environment-sensitive score adjustments.
• Audit page — review individual scores and verification outcomes.