Netacea: server-side only, and why that is half the picture

Netacea is the other UK vendor in this market, so the two come up together more often than relative size would suggest. Netacea is the larger company and takes a different technical approach, one worth explaining properly rather than dismissing.

What Netacea is

Netacea Bot Protection, based in England, built on a server-side-only detection model. There is no JavaScript running in the visitor's browser. Detection happens from request data and behavioural patterns observed at the server.

Where it leads

Forrester rates Netacea superior for web-scraping defence and transaction assurance. The standout feature is the ability to simulate the detection model in operation before deployment, which lets you see what would have been blocked against real historical traffic. Nobody else in the Wave has that, and if false positives on checkout are the thing keeping your team awake, it is the single most useful thing on this page.

Server-side-only also has a genuine architectural advantage. It reaches API endpoints, mobile clients and anything else a browser widget never touches.

Where Forrester identified gaps

Pricing is among the most intricate of any vendor in the evaluation: onboarding, platform, support and usage bands as separate components. Report customisation is limited, because Netacea prefers to handle reporting for you.

If you evaluate Netacea, model the three-year total rather than the year-one number.

The server-side question

The substantive technical difference between the two products sits here, and it is worth setting out in full.

Netacea's CTO, Andy Still, has said that 18% of LLM scraping traffic now mimics human click patterns to slip past client-side JavaScript and CAPTCHA checks. That is a fair observation, and it is why Prosopo runs server-side scoring in Decision Machines as well.

The disagreement is over the conclusion. A bot that has learned to fake clicks is a reason to look harder at the clicks, rather than to stop looking. Faked interaction falls apart under close inspection: cursor micro-jitter, scroll cadence, typing rhythm, and CPU timing signatures. Several of Prosopo's most reliable detectors work on exactly that, for example Inconsistent hardware readings for device and Synthetic interaction timings. Neither can fire without a client-side signal.

So Prosopo runs both layers: client-side behavioural collection through Catcher, server-side scoring through Decision Machines, and one verdict from the combination.

What it costs

Quoted, in several components.

Where data is processed

United Kingdom. Netacea and Prosopo are the two UK-based vendors on this list, so neither carries the US-hosting question. Prosopo can additionally restrict processing entirely to the EU on Protect, and on the Custom plan a dedicated database keeps visitors' data apart from every other site's.

How a block gets explained

Through Netacea's reporting, which they largely run for you. Forrester flagged report customisation as limited.

Who authors the rules

Netacea, on the customer's behalf.

Which buyers Netacea suits

Netacea is the stronger fit if pre-deployment model simulation is what you need to get sign-off, if you want a UK vendor with SOC 2 and ISO 27001 already attested, if you would rather somebody else ran the reporting, or if everything you protect is server-side and a browser layer would add nothing.

How Prosopo compares

Where Prosopo is the stronger choice:

You want both detection layers rather than one, particularly against solver services and real-device farms where the client-side signal is what breaks the disguise.

If you want to author your own Access Rules and customise your own reporting rather than requesting it.

If you want simple, published pricing you can model without a call.

Side by side

More in the Forrester Wave breakdown.