Bot and agent trust management vendors compared

There are around a dozen serious vendors in this market, and very few of them publish enough for a buyer to build a shortlist without first booking a round of sales calls. These pages close that gap: one vendor at a time, the same questions in the same order, drawn from the Forrester Wave, published vendor documentation and our own testing against each product.

Prosopo competes in this market, so these pages also set out how it compares on each dimension a buyer evaluates: deployment model, detection depth, how a block is explained, who authors the rules, where data is processed and what it costs. Where a vendor leads on a capability, we say so and explain which buyers that suits.

The twelve vendors

Standalone platforms with a managed service: DataDome, HUMAN Security, Kasada, Arkose Labs, CHEQ and Netacea.

Verification products deployed against a form, and via WAF integrations as a full-page challenge: hCaptcha Enterprise and Google reCAPTCHA Enterprise.

Bundled into a CDN or WAF contract you may already hold: Cloudflare Bot Management, Akamai Bot Manager and Imperva Advanced Bot Protection. These are worth measuring first, because you are already paying for them.

Scoring users and account events rather than requests: Castle.

For analyst rankings, who Forrester placed where and what each vendor was marked down for, read the Forrester Wave Q2 2026 breakdown. This section is the evaluation detail behind those rankings.

How to read the vendor pages

Every page in this section answers the same eight questions in the same order, so you can put two of them side by side and get a real comparison rather than two differently-shaped marketing pages.

1. What the product is, in one sentence.
2. Where it leads.
3. Where Forrester or its own customers identified gaps.
4. What it costs, and whether that number is published or quoted.
5. Where data is processed.
6. How a block gets explained to your team.
7. Who authors the rules, you or the vendor.
8. Which buyers it suits, and how Prosopo compares.

Four questions worth asking

Four questions worth putting to every vendor on this list, Prosopo included. They tend to decide how the deployment goes six months in, and they rarely appear on a feature matrix.

When this blocks a real customer, what does your team see? A numeric score tells you a block happened. A detector name tells you what matched. Forrester marked CHEQ down for numeric reason codes that are difficult to interpret and reCAPTCHA Enterprise for lack of detail and limited drill-down. That gap shows up as support tickets.

Who writes the rule when the default misses something? Kasada and Arkose run this inside a managed service, a real advantage if you do not want to staff it and a real constraint if you do. Ask whether your own team can write and ship a rule without opening a ticket.

Where does the raw event data live, and can you get it out? Most vendors give you an integration endpoint that returns a verdict. Fewer give you the requests, fingerprints and timing signals in a form your own analysts can query. The export path to your own SIEM should be confirmed in writing.

What happens to the price at renewal? Only DataDome publishes an entry number. Everything else in this market is quoted, so the second-year number is a negotiation you have not had yet.

How Prosopo compares

We ship one platform in two delivery modes: a drop-in widget where you have a form to protect, and enforcement at the edge where you want every request scored before it reaches your origin. Same detection library, same Access Rules, same portal.

Every block comes with a reason your team can act on: Solver service detected, Inconsistent hardware readings for device, Automation driver present, Datacentre DNS resolver behind a residential IP. Not a risk band and not a policy label. Every response carries an X-Prosopo-Request-Id header, so any decision can be retrieved and reviewed by ID. The widget stack is open source, so the client code can be reviewed before deployment.

Prosopo scales horizontally across points of presence in the US, LATAM, APAC and the EU. Verification stays fast wherever your users are, and the service keeps running if one node fails. Data processing can be restricted entirely to the EU on our Enterprise plan.

On certifications: ISO 27001 certification is in progress, and SOC 2 is on the roadmap behind it. If your procurement process requires a completed attestation before signature, tell us your date and we will tell you whether we can meet it.