Automation
Automation is using software or machines to perform tasks without human input — the same trick that powers CI/CD pipelines and, at scale, malicious bots.
Stop Malicious Automation
Protect your platform from automated attacks
What is Automation?
Automation is having software perform a task without a person doing each step. It is the foundation of nearly everything useful on the internet — deployment pipelines, payment processing, search indexing, monitoring — and it is also how every attack at scale is delivered.
The technology is identical in both cases. There is no technical property that separates a deployment script from a credential-stuffing script, which is why "block automation" is not a coherent security goal.
Automation you depend on
Search crawlers that make you findable. Uptime monitors that page you before a customer complains. Payment webhooks. Your customers' own integrations against your API. CI pipelines. Accessibility checkers. Increasingly, AI assistants fetching a page because somebody asked a question.
Blocking automation indiscriminately breaks all of that, and the resulting incidents are rarely traced back to the blanket rule that caused them.
When automation becomes a security problem
It is not the automation, it is the volume applied to a flow that assumed a person:
| Flow built for a person | What automation turns it into |
|---|---|
| A login form | Credential stuffing against breached lists |
| A sign-up offer | Thousands of accounts claiming it |
| An add-to-basket button | Inventory held or bought before customers reach it |
| A product page | Wholesale scraping of your catalogue and prices |
| A contact form | Spam distribution |
| A checkout | Card testing against stolen numbers |
Every row is a working feature used as designed. There is nothing to patch, which is why this is a traffic problem rather than a software one.
How Procaptcha stops malicious automation
The approach is deliberately not to identify automation, because that question has no stable answer. It is to establish whether a person is present on the flows where it matters, using behavioural signals, browser coherence and proof of work, verified server-side.
Three consequences of framing it that way:
- Automation you want keeps working, because it is not being hunted
- An attacker cannot escape by changing addresses or editing a fingerprint, since neither answers the question being asked
- Proof of work charges per attempt, so the economics shift against bulk abuse regardless of who is behind it
The cases that remain genuinely hard are the ones where automation acts for a real customer, and the honest answer there is to require the evidence at the step that costs money rather than at the front door.