Castle: developer-first account abuse, and where the overlap ends

Castle is a developer-first account abuse and fraud platform, absent from the Q2 2026 Forrester Wave. Where it overlaps with bot and agent trust management, and where the two problems diverge.

Chris Taylor

Sep 1, 2026 Updated Oct 23, 2026 5 min read

Castle comes up in evaluations more often than its size suggests because it is the one product in the adjacent space that engineers enjoy using. Its design philosophy is also the closest to Prosopo's, so the difference between the two is worth describing precisely rather than overstating.

What Castle is

A developer-first account abuse and fraud platform. API-driven, aimed at engineering teams, focused on registration, login and in-app user actions. Castle was not evaluated in the Q2 2026 Forrester Wave.

Where it leads

Developer experience, and the account itself. If the problem is fake signups, credential stuffing against your login, or abuse of in-app actions by accounts you can identify, Castle is built exactly around that model and the integration is pleasant.

Castle also promotes a no-code Cloudflare connection, so the deployment story next to an existing CDN is straightforward.

Where the two products diverge

The distinction is what gets scored.

Castle scores users and account events. That works well when there is an account to attach risk to and when the abuse you care about is expressed through user behaviour over time.

Prosopo scores requests, including requests where no account exists and never will. A scraper pulling your product catalogue has no account. An inventory bot hitting a SKU endpoint has no account. An LLM crawler harvesting a face-search free tier has no account. That traffic never reaches a user-risk model because it never becomes a user.

If your abuse is concentrated on login and registration, the overlap is large and Castle is a fair choice. If it is concentrated on catalogue, checkout, search or an unauthenticated API, the overlap is small.

What it costs

Castle has been more open about pricing than the enterprise bot vendors and has offered self-serve entry tiers. Check the current page, since this moves.

Where data is processed

US-based. Prosopo can hold processing to the EU for Protect customers, and, on the Custom plan, provision a separate database where a customer needs their visitors kept apart from every other site's.

How a block gets explained

Through Castle's API and console, structured around user risk. That works well for accounts. It is not built to explain why an unauthenticated request to a JSON endpoint was refused.

Who authors the rules

You do. Castle is built for engineers to configure. Prosopo follows the same philosophy.

Which buyers Castle suits

Castle is the stronger fit if account takeover, fake registration and in-app abuse are the whole problem, if the buying team is engineering rather than security, or if you want user-level risk history as a first-class object.

How Prosopo compares

If unauthenticated traffic is the problem: scraping, catalogue harvesting, inventory hoarding, API abuse.

If you need enforcement at the edge in front of your origin rather than a decision your application makes after the request has already cost you a round trip.

If you want a reason on every block.

Running both is reasonable. They work at different points in the request path.

Side by side

	Prosopo	Castle
Forrester Q2 2026 tier	Not evaluated	Not evaluated
Primary unit scored	Request	User and account event
Unauthenticated traffic	Covered	Outside the model
Enforcement point	Widget on a form, or edge before origin	Application, via API
Block explanation	Plain-language reason	User risk signal
Rule authoring	Customer, self-serve	Customer, self-serve
Client stack	Open source	Proprietary
Data processing	EU-only available on Enterprise. Points of presence in US, LATAM, APAC, EU	US
Data isolation	Dedicated database on the Custom plan	Not published
Published pricing	All tiers on pricing	Partially published

Weighing Castle against a bot platform?

A Bot Exposure Assessment is a 30-minute call with an engineer. We look at your traffic, show where your current setup leaves gaps, and agree how a trial would be judged. Nothing to install first.

Book an assessment Read the case studies

Questions

Something else? Ask an engineer.

What is Castle?

Castle is a developer-first platform for account abuse and fraud, focused on registration, login and in-app user actions. It is API-driven and aimed at engineering teams rather than security operations centres. Castle was not evaluated in Forrester's Q2 2026 Bot and Agent Trust Management Wave.

Is Castle a bot management product?

Partly. Castle covers registration, login and in-app actions, where a large share of bot abuse happens. It is built around user and account risk rather than scoring every request to a site or API. If your problem is scraping product catalogues or hoarding inventory, Castle is not built for it.

What is the difference between Castle and Prosopo?

Castle scores users and account events. Prosopo scores requests, whether or not there is an account behind them, and enforces at the form or at the edge. The two overlap on registration and login abuse and diverge on scraping, inventory abuse and API traffic where no account exists.

Does Castle publish pricing?

Castle has historically been more transparent than the enterprise bot vendors and has offered self-serve entry tiers. Check the current pricing page directly, since this changes.

CAPTCHA · Jun 25, 2026 Forrester Wave Bot and Agent Trust Management Q2 2026: How Prosopo Compares Forrester's Q2 2026 Wave named 8 Bot and Agent Trust Management vendors. What each got dinged for, and how Prosopo — the specialist entry — compares.