Attacks are easy to implement, and their potential value is astronomical. As digital transformation and the use of apps and APIs to facilitate online commerce continues to skyrocket, attackers will embrace automation and AI to overcome the security countermeasures that stand in their way.

Commonly used mitigations such as CAPTCHA and multi-factor authentication (MFA) are designed to deter bots, but they often frustrate customers while failing to provide the security they’re meant to deliver, in some cases even causing transaction and brand abandonment. Motivated attackers can bypass these defenses; they merely provide a false sense of security, which can create a wide range of costly problems for organizations that rely on them.

Want proof? One in three customers will leave a brand they love after just one bad experience.

Adapting to attacker economics

Automated attacks continue to evolve, enabling bad actors to adapt and bypass basic security defenses with very little investment. These attackers typically leverage readily available infrastructure, such as bots and toolkits, for pennies on the dollar.

The proliferation of architectures, cloud, and complex software supply chains has expanded the risk surface for attackers. Application vulnerabilities such as injection and cross-site scripting continue to exist, even after 20 years with established security best practices. It’s no surprise that attackers leverage bots and automation to scan for these vulnerabilities and exploit them—creating potentially disastrous outcomes, including data breach. 

Increasingly, attackers are turning their attention to critical business logic that underpins organizations’ digital footprints—from customer shopping carts to the API fabrics that connect B2B commerce. Endpoints such as logon, create account, and add to cart are inundated with automated attacks, leading to account takeover, fraud, and lost customer trust. These attacks can happen both on web apps and back-end API infrastructure. Attackers perform reconnaissance and retool to identify their targets and evade detection.

Your customers demand simplicity. Your applications are complex. Your attackers are motivated.

Security must adapt to attacker retooling that attempts to bypass countermeasures—regardless of the attackers’ tools, techniques, or intent—without frustrating users with login prompts, CAPTCHA, and MFA. This includes omnichannel protection for web applications, mobile applications and API interfaces, real-time threat intelligence, and retrospective analysis driven by AI.

Visibility across clouds and architectures, durable and obfuscated telemetry, coupled with a collective defense network and highly trained machine learning models provides unparalleled accuracy to detect and unwavering resilience to deter bots, automated attacks, and fraud. This allows mitigations to maintain full efficacy as attackers retool and adapt to countermeasures—stopping even the most advanced cybercriminals and state actors without frustrating your real customers.

This ability to maintain effectiveness dramatically improves key business outcomes:

• Less fraud, less friction, less effort
• Improved conversion, retention, and loyalty
• Increased top-line revenue
• Decreased bottom-line losses
• Reduced complexity
• Increased operational efficiencies

Security vendors must operate under the assumption that skilled attackers already have or soon will bypass all defenses. Attacker frameworks are known to leverage trained AI models to bypass security. The only viable defense is deterrence, disrupting attacker economics by making successful attacks too costly and unfeasible.

F5 solutions connect into any application architecture and protect all critical business logic, maintaining persistent, long-standing efficacy no matter how attackers retool in their efforts to evade detection. F5 solutions also reduce or remove high-friction security controls, including CAPTCHA and MFA, thereby improving the customer experience and overall solution effectiveness.