Forrester Wave Bot and Agent Trust Management Q2 2026: How Prosopo Compares

Forrester has just published The Forrester Wave™: Bot And Agent Trust Management Software, Q2 2026. We spent a few days reading through it because the category Forrester just renamed is the category we have been building for, and we wanted to see how the eight named vendors line up against what we're building at Prosopo.

The named vendors:

• Leaders: DataDome, HUMAN, Kasada
• Strong Performers: Arkose Labs, CHEQ, Netacea
• Contenders: hCaptcha, Google (reCAPTCHA Enterprise / Google Cloud Fraud Defense)

This post walks through what each vendor does well, where Forrester marked them down, and how Prosopo Procaptcha fits alongside them as a smaller, EU-based alternative. If you're comparing DataDome competitors, Arkose Labs competitors or Kasada competitors in one place, this is meant to be that page. We build a CAPTCHA and bot protection platform ourselves, so we test against most of these competitors every week. Where we rate our own product, we say so openly and show our reasoning.

What Is Bot and Agent Trust Management?

Bot and agent trust management is the software category Forrester defines as identifying and analysing the intent of every automated request — bot, AI agent or human — and establishing ongoing trust decisions instead of binary block/allow rules. It is what used to be called bot management until Forrester renamed the category in late 2025 to reflect the explosion of AI agents acting on behalf of real users.

The headline finding in the Wave is structural: "The rise of AI agents moves the market from security first to trust first." AI agents are now a third category of traffic alongside humans and traditional bots — created and delegated by humans to perform tasks like shopping, research and customer service. That breaks the historic playbook of binary block/allow bot mitigation:

• A scraper hitting your product pages could be a malicious price-harvester, an LLM training crawler, or your own customer's purchase agent.
• A site that blocks all agent traffic loses access to real human buyers who delegate the journey to an agent.
• An agent allowed in too freely can be hijacked, prompt-injected, or run up cost-of-goods abuse.

Forrester argues that organisations now need a clear understanding of every bot's and agent's intent and behaviour so they can establish trusted relationships with good agents and fight automated traffic that destroys business value.

The Eight Named Vendors

The Wave splits the eight vendors into three tiers — Leaders, Strong Performers and Contenders. For each, we summarise Forrester's findings and then add a short note on where Prosopo fits as an alternative.

DataDome (Leader)

Cyberfraud Protection Platform (Bot Protect with Agent Trust 26.03). Headquartered in New York and Paris. Forrester rates DataDome highest among the Leaders for innovation, adoption support and a deep co-selling relationship with AWS. Standout features are Priority Protect (balancing human and agent priorities for transactions), granular agent permissions, and the strongest customer adoption programme in the evaluation. Trade-offs: weaker accessibility and management-console internationalisation. DataDome's public Essentials tier starts at around $3,830/month.

Prosopo as a DataDome alternative. We run in the EU by default with published pricing — Procaptcha for form-level CAPTCHA, Protect for full-site bot and agent trust. Same ML detection and Decision Machine rule engine, without quote-only contracts or AWS co-sell lock-in.

HUMAN (Leader)

Human Defense Platform (Sightline, AgenticTrust). A New York-based platform best known for threat research and a recent agentic-trust push. Forrester credits HUMAN's attack profiles feature for rich attack analytics, a thorough out-of-the-box AI agent library, and a thoughtful trust-governance vision. Customers reported the management UI is "mixed" and easier data access is a wish-list item. HUMAN is also missing cost-savings reporting in its transaction-assurance dashboards.

Prosopo as a HUMAN Security alternative. Same ML behavioural scoring and explainable detections without US-only hosting. Procaptcha is GDPR-compliant by design and ships drop-in to forms today; Protect extends the same engine to every endpoint with a self-serve portal that shows the exact signals that fired on each request.

Kasada (Leader)

Bot Defense and AI Agent Trust. Headquartered in Australia with major New York operations. Kasada Bot Defense is the product Forrester calls out for transparent roadmap communication, a Vercel OEM partnership, and the Graph Explorer — a visual mapping of users, devices, IPs and sessions that ties account abuse together. Kasada is the choice for customers who want to offload bot defense day-to-day to the vendor; the trade-off is limited UI customisation and relatively few out-of-the-box marketing and e-commerce integrations.

Prosopo as a Kasada alternative. Where Kasada is fully vendor-managed, Prosopo Protect gives you the same in-flight bot defense with a self-serve portal and published pricing. You can see the exact rules and signals that fired on every request without waiting for a vendor SOC ticket.

Arkose Labs (Strong Performer)

Arkose Titan (March 2026). California-based, identity-fraud-focused, and famous for its visual Funcaptcha challenges. The unified Titan platform now bundles Bot Manager, Email Intelligence, Device Identity, Server-Side Edge, Agent Trust Manager and Scraping Protection. Forrester praises Arkose's "telltales" — AI-generated explanations of which detection signals fired — and bundled pricing with SOC included. Marketing-analytics and transaction-assurance dashboards lag the Leaders.

Prosopo as an Arkose Labs alternative. If you like Arkose's invisible proof-of-work but want it without quote-only enterprise contracts, Procaptcha ships PoW with a read-puzzle CAPTCHA fallback for humans who need a second check, and image CAPTCHAs reserved for traffic our models think is a bot. Free tier of 10,000 verifications per month, EU-hosted, GDPR-compliant, drop-in on the front end.

CHEQ (Strong Performer)

CHEQ Platform. New York / Tel Aviv. CHEQ grew up in marketing and ad fraud prevention, acquired identity specialist Deduce in early 2025, and is now extending into full bot and agent trust. Strongest of any vendor for marketing and e-commerce integrations, with a Gold-level Adobe partnership. Detection explainability is a weakness — the UI surfaces numeric reason codes that customers find hard to interpret — and pricing requires buying products separately.

Prosopo as a CHEQ alternative. CHEQ is strongest where we're youngest — marketing-stack integrations. Where we win is detection explainability (rule-level breakdowns, not numeric reason codes) and bundled pricing rather than per-product line items.

Netacea (Strong Performer)

Netacea Bot Protection. England-based, with a deliberate server-side-only detection model. Forrester rates Netacea superior for web-scraping defence and transaction assurance, with a unique feature to simulate the detection model in operation before deployment. The flip side: pricing is among the most intricate in the market (onboarding + platform

• support + usage bands), and report customisation is limited because Netacea prefers to handle it on the customer's behalf.

Prosopo as a Netacea alternative. Netacea is server-side-only and vendor-managed. Being server-side-only is a fundamental restriction: the clever bots are the ones that look fine in TLS, headers and request patterns alone, and only give themselves away in client-side behaviour — cursor dynamics, scroll cadence, typing rhythm, CPU and device signals. We give you both client-side behavioural signals (Catcher) and server-side scoring (Decision Machines), with self-serve rule management and published pricing instead of onboarding + platform + usage bands.

hCaptcha (Contender)

hCaptcha Enterprise. A service of Intuition Machines. Forrester highlights private learning (customers can see how data enrichments affect detection performance) and deployment architectures that limit what data leaves the customer. Adoption resources and out-of-the-box integrations are thin; customers describe the management UI as "clunky and engineering-focused."

Prosopo as an hCaptcha alternative. Procaptcha is a drop-in replacement for hCaptcha — same widget integration pattern, full GDPR compliance, EU hosting and a portal that explains every challenge in plain English. We've written more on this in our Procaptcha vs hCaptcha comparison and our analysis of hCaptcha's GDPR posture.

Google reCAPTCHA Enterprise (Contender)

reCAPTCHA Enterprise / Google Cloud Fraud Defense. The only public company in the report, and the one most customers have already deployed somewhere. Forrester's verdict is blunt: vision is undifferentiated, the roadmap has catch-up items, AI agent trust management is missing an agent library, and intent analytics break out only the top four AI agents. reCAPTCHA wins on accessibility (dashboards in hundreds of languages) and is the safe default for teams already inside the Google Cloud ecosystem.

Prosopo as a Google reCAPTCHA alternative. Where reCAPTCHA Enterprise recently cut its free tier by 99% and lacks an out-of-the-box agent library, Procaptcha keeps a 10,000-verification free tier and ships agent whitelist rules out of the box. Plus EU hosting and no Google Cloud lock-in.

Where Prosopo Fits

When we started Prosopo, Procaptcha was a privacy-first CAPTCHA that verified humans on forms — signup, login, contact, checkout. That was the obvious place to start because that is where most bot abuse occurs. But attackers don't stop at forms. AI scrapers harvest product catalogues. Inventory bots hammer SKU endpoints. Account checkers replay credentials against login APIs. Agentic shoppers race human buyers to limited-stock items. None of that traffic ever sees a CAPTCHA widget.

Over the last two years we've extended into a full bot protection platform that covers every endpoint, not just the form. The same advanced machine-learning models that power Procaptcha now score and gate every request. Which vendors are best for detecting and verifying AI agents now depends as much on how those agents are classified and authorised as on how they're spotted — so we treat agent identity as a first-class signal, not a bolt-on. Behind the widget sits:

• Decision Machines — a rules and ML engine that scores every request in real time using behavioural signals, device characteristics, JA4 TLS fingerprints, header hashes, IP reputation and residential-proxy detection.
• Catcher — an in-browser SDK that captures cursor dynamics, scroll cadence, typing rhythm and SIMD-CPU signatures, processed on-device in a privacy-first way.
• DNS-path edge protection — site-wide gating that intercepts and scores traffic before it reaches origin, so scrapers and credential stuffers never touch the application.
• Dynamic access rules — AI-suggested rules that filter on IP, geo, User-Agent, device fingerprints, JA4 and custom criteria, updated automatically as new attack patterns emerge.
• Multi-mode challenges — invisible challenges for low-risk traffic, automatic computational proof-of-work for medium-risk, and puzzle or image CAPTCHAs escalated only when behaviour is genuinely suspicious.

In Forrester's language, this is the trust-first model: prove human (or trusted-agent) behaviour, and let the rest of the site stay frictionless.

Feature Comparison

The table below maps the capabilities Forrester evaluates — invisible or low-friction challenge options, ML behavioural detection, AI agent trust management, JA4 fingerprinting, dynamic access rules — across the eight named vendors and Prosopo. We've used Forrester's published findings for the named vendors and our own product capabilities for Prosopo. Cells marked "—" indicate the vendor doesn't surface the feature in the evaluation, or it was called out by Forrester as a relative weakness.

Where the Leaders beat us

To keep the table honest, three areas where the named Leaders are stronger than Prosopo today:

• Dedicated threat-research teams and public takedowns. HUMAN is the standout here; DataDome, Kasada (KasadaIQ) and Netacea also operate research functions whose intelligence flows back into the product. We block residential proxy networks ourselves — we just haven't written about it publicly yet — and we publish research on our blog, but we don't yet run a formal takedown function.
• Bundled SOC / fully-managed service. Kasada and Arkose explicitly bundle SOC, support and tuning into a single price; DataDome has the strongest enterprise adoption programme in the Wave. We offer standard support and enterprise tiers, not a fully outsourced SOC.
• Out-of-the-box marketing and e-commerce integration breadth. CHEQ has the most robust prebuilt set per Forrester, with DataDome and HUMAN close behind. We ship APIs, webhooks and 16 WordPress plugins; deeper Adobe, Salesforce and ad-platform integrations are still on the roadmap.

If you weight any of those three heavily, the Leaders are the right shortlist.

What's next?

The Wave confirms three things that we think matter for everyone watching this space:

1. Bot management is now bot and agent trust management. Binary block/allow is over; intent and behaviour are the new currency.
2. Detection explainability is a buying criterion. The Leaders all invested in it, and the Contenders were marked down for opaque reason codes and limited drill-downs. Our portal shows the exact rules and signals that fired on every challenge or block, so security and product teams can audit decisions without opening a support ticket. The same data is available over our API, so you can pull it directly into your own customer support system instead of bouncing between dashboards.
3. Privacy default still matters. Most evaluated vendors host in the US and price by quote. That's a structural mismatch for European buyers and for any organisation that doesn't want its customers' interaction data feeding a third party's models.

We're going to keep building toward the trust-first model — sharper agent classification, deeper behavioural signals in Catcher, and a wider out-of-the-box integration set so we close the gap with the Leaders on the marketing-and-identity surface. If you'd like to chat about any of it, get in touch.

Source: Forrester Research, Inc., "The Forrester Wave™: Bot And Agent Trust Management Software, Q2 2026." Forrester does not endorse any vendor, product, or service depicted in its research publications. All third-party vendor names, product names and ratings remain the property of their respective owners.