RESOURCES / THE EVOLUTION BLOG
How Intent Intelligence at the edge drives better security, fraud and growth outcomes
Alisdair Faulkner
How Intent Intelligence at the edge drives better security, fraud and growth outcomes
Better security drives better fraud and growth outcomes when security, fraud and growth teams work from the same signals. A single Darwinium deployment inside a company's own CDN sees every human, bot and AI agent across web pages, mobile apps, APIs and AI agent tool calls, and scores the intent of each session at every step. The CISO gets control before requests reach the application. Fraud teams catch abuse that passes identity checks and decline fewer good customers. Growth teams get less friction, cleaner funnel data and a safe way to accept AI shopping agents.
Why do security, fraud and growth teams see different pictures of the same customer?
Most digital businesses judge the same session three times, with three teams using three sets of tools.
| TEAM | WHAT IT SEES TODAY | WHAT IT MISSES |
| Security | Bots, proxies and attack tools at the edge, through a WAF or bot manager | What the session goes on to do with an account, a payment or a promotion |
| Fraud | Logins, orders, payments and chargebacks, from tags and APIs at a few high-value touchpoints | Everything that happened before the checkpoint, and abuse that never touches the UI |
| Growth | Conversion, traffic and campaign performance | Which of that traffic was bots or agents, and which friction was needed |
As a result, the CISO's edge signals rarely reach the system that approves an order. Fraud rules fire late and fall back on blunt declines that hit good customers. Growth sees conversion fall and blames security for the friction, while bots and agents inflate its own funnel data.
Attacks increasingly cross those team boundaries. Card testing runs through headless browsers and APIs. Promotions are farmed through accounts created minutes before the offer is redeemed. AI agents now browse and buy for real customers, so a business that blocks all automation also blocks sales.
What is intent intelligence, and how can one deployment provide it?
Intent intelligence is a judgment of what a user, bot or agent is trying to do, based on the sequence and timing of its actions across a whole journey. Darwinium produces it from one deployment inside the company's CDN, where every request already passes. That deployment observes web pages, mobile apps, APIs and AI agent tool calls, and combines every signal family into one decision at each step of the journey.
One Darwinium deployment: four surfaces in, three teams served
Every team gets the same signals because they come from the same place. Device identification combines deterministic IDs with a probabilistic device signature. Network analysis uses multiple IP inference paths and TCP packet inspection to expose residential proxies and other obfuscation. Behavioral biometrics run on every field, and behavioral identity links sessions by the same actor. Journey intent scores the sequence and timing of steps against the user's own history and against all users. Together, these signals classify each session as human, bot or agent.
The view covers each session from first request to final action on every surface, and every team reads the same verdict from the same data. A security signal and a fraud decision therefore can't contradict each other.
What does the CISO gain from a single edge deployment?
The CISO gets visibility and enforcement across the whole estate from infrastructure the company already owns. Darwinium's integration runs inside the company's Cloudflare, AWS CloudFront or Akamai account. There are no DNS redirects, and the integration fails open, so a Darwinium error never blocks a customer.
Web pages, mobile apps, APIs and AI agent tool calls over MCP and JSON-RPC all pass through that one layer. Security sees off-screen attacks, such as API abuse, credential automation and card testing through headless browsers, in the same journey as the web session. Request-time actions stop a restricted operation before the origin performs it, and new pages and endpoints are covered by configuration instead of another tag or SDK release.
| SECURITY USE CASE | WHAT'S HAPPENING | HOW DARWINIUM HANDLES IT |
| Account takeover | Credential stuffing, brute force, phishing, keyloggers and SIM swaps, often with valid credentials | Recognizes the real user by device, network and behavioral identity, then blocks, steps up or alerts |
| AI agent and MCP traffic | Declared and undeclared agents act on accounts, carts and tool calls | Classifies each agent, checks authorization, and permits, verifies, challenges or prevents each action at the edge |
| Advanced bots | Automation that rotates residential proxies and mimics people | Combines JA3 and TCP fingerprints, IP inference and behavioral biometrics to expose scripted input |
| Business logic and API abuse | Attacks on endpoints with no UI, outside the fraud stack's view | Inspects and acts on API and JSON-RPC requests in the same journey as web traffic |
| Hijacked or prompt-injected agents | A trusted agent follows hidden instructions on a page | Flags intent drift, such as an address change straight after a page read, and holds the action |
The same signals separate declared agents, undeclared agents, scripted bots and crawlers, so security can admit useful automation and still control what it does.
Security also gets credit for business results. When the CISO's threat, device, network and agent identity signals feed the fraud decision directly, security can report fraud losses avoided and good customers approved. Darwinium holds SOC 2 Type 2 and ISO 27001, encrypts PII, and handles sensitive data inside the customer's CDN perimeter.
How does Darwinium help fraud teams catch fraud that passes identity checks?
Fraud teams see the whole journey that leads to checkout. Many of today's costliest frauds happen in sessions where every individual check passes: a genuine customer coached through a scam payment to a new payee, a verified shopping agent checking out with a stolen card, or fresh accounts from one actor farming the same sign-up bonus.
| FRAUD USE CASE | WHAT'S HAPPENING | HOW DARWINIUM HANDLES IT |
| Payment fraud | New card and new address on the account, high-resale basket, no browsing before checkout | Scores the path to checkout, then triggers issuer step-up or a shipment hold |
| Scams and social engineering (APP fraud) | The genuine customer is coached to add a new payee and transfer at once | Flags improbable routes and timing against that user's own history and their cohort |
| Promotion and bonus abuse | Many accounts from one actor or agent template redeem one offer | Links accounts by device, behavior and shared payment or address fragments; limits offers per linked identity |
| Refund and returns abuse | Claims well above peers, "not received" on tracked parcels, repeated wording | Connects claims to the same actor across accounts and routes them to review |
| Onboarding and synthetic accounts | Mules and repeat bad actors reopen accounts on new devices | Behavioral identity and probabilistic device matching recognize returning actors |
| Agentic account takeover and agent misuse | A trusted agent is steered to act against its user | Combines agent classification with journey intent and confirms with the human |
Darwinium scores intent across the sequence. Transition probabilities, path probability, step duration and repeated steps are compared with the user's own history and with all users, so an improbable route stands out without a pre-written rule. A new card, a new shipping address, a high-resale basket and no browsing before checkout carry more weight together than any one of them alone.
Behavior also works as an identifier. Behavioral biometrics on every field and the Behavioral Identity Graph link payments, accounts and mules to the same actor, even across devices. Probabilistic device matching recognizes more returning customers than a binary device ID, which cuts false declines. For promotion, refund and returns abuse, limits can apply per linked identity instead of per account.
Rules, bring-your-own models in PMML, investigations, labels, lookbacks and incident management sit in one decision platform, with 12+ months of behavioral and risk data. Edge signals arrive before the order is placed, while there is still time to act. Teams can start in shadow mode and send enriched signals to the decision systems they already run.
How does better security improve conversion and growth?
Whole-journey risk scoring lets a business apply friction only where risk rises. Customers recognized by their behavior and device history skip extra checks, even on a new device, and trusted sessions can be approved or rewarded with tailored offers - giving growth and marketing teams better customer experiences.
| GROWTH USE CASE | WHAT'S HAPPENING | HOW DARWINIUM HANDLES IT |
| Welcoming AI shopping agents | Agents bring real buyers, but most retailers can only allow all or block all | Sets boundaries per action: allow discovery, assess checkout like a human, protect restricted actions |
| Frictionless good customers | Step-ups and declines hit legitimate customers on new devices | Recognizes returning customers by behavior and device, so trusted sessions skip extra checks |
| Promotion and offer protection | Sign-up bonuses and coupons are farmed by one actor across many accounts | Limits offers per linked identity, so budgets reach genuine new customers |
During launches and limited drops, carts can fill the moment stock goes live, with many held and few paid. Queues, purchase caps and releasing held stock keep inventory for real buyers.
Every session is labelled human, bot or agent, so conversion and attribution data reflect real demand. New pages, campaigns and journeys are protected through CDN configuration without waiting for a security release cycle, and customers are typically live within days.
How should businesses handle AI shopping agents?
AI shopping agents reach a business through the browser, through MCP tools and through commerce APIs with signed payment mandates. Each team needs an answer: security decides which agents may act, fraud judges what a verified agent is doing, and growth wants agents to bring customers, since blocking them turns buyers away.
Darwinium doesn't block agents by default. It classifies them as declared, identified or inferred, using a test farm that keeps learning the fingerprints of new and changing agents. Each business then sets boundaries per action:
| POLICY | EXAMPLE ACTIONS | WHAT HAPPENS |
| Allow | Product search, price comparison | Useful agents bring customers in |
| Watch | Login, checkout, booking | The agent is assessed continuously, like a human, and verified when risk rises |
| Block | Sensitive account changes, bulk booking | The action is stopped before it reaches the application |
One verdict covers all three teams. Security controls what agents can do, fraud catches the stolen card or hijacked agent that passed the identity check, and growth gains a sales channel it can accept.
To see how your own traffic splits into humans, bots and agents, and where intent signals would change the decision, book a shadow-mode assessment with Darwinium.
Frequently asked questions
Do security and fraud teams need separate Darwinium deployments?
No. One deployment in the company's CDN serves security, fraud and growth teams, and each team reads the same verdict from the same data.
Which CDNs does Darwinium run on?
Darwinium's integration runs inside Cloudflare, AWS CloudFront or Akamai, in the customer's own account.
Does Darwinium block AI agents?
Not by default. Each business decides which actions agents can take on their own, which are assessed and verified, and which are blocked.
Can Darwinium work alongside existing fraud tools?
Yes. Teams can start in shadow mode and send enriched signals to the decision systems they already run.
How long does it take to deploy?
Darwinium connects through the company's existing CDN, and customers are typically live within days.
What does one deployment deliver for each team?
Security, fraud and growth teams have been buying separate answers to the same question: who is acting, and what are they trying to do? One Darwinium deployment at the edge answers it once for all three. Security gets earlier and broader control. Fraud gets the context to catch what identity checks miss and to decline fewer good customers. Growth gets less friction, cleaner data and a safe way to accept AI agents.