Darwinium helps you understand and act on fraud and abuse across customer and agent journeys. It combines data from interactions with historical context, rules and models, then makes the resulting assessment available to your application or to a configured action at the edge.
Start with the outcome you need below. Each path connects collection, configuration, verification and action. A capability becomes useful when those parts are connected for your own traffic and business policy.
Start at the edge
For websites and HTTP services, prefer a CDN integration where it fits your architecture. It lets you map multiple touchpoints at the request layer and deploy changes to journey configuration without waiting for each application release.
- Deploy on Cloudflare, CloudFront or Akamai.
- Use Journey Recorder to map website interactions by browsing your site, or create steps manually.
- Build, deploy and verify one successful event before extending coverage.
- Add the required assessment and connect it to an action.
For mobile applications or services that need a direct assessment call, use the installation selector and API overview. See Architecture & data flow for how these paths fit together.
Protect account creation and login
Goal: recognize suspicious account activity while giving legitimate customers an appropriate experience.
Map registration, login attempts and their outcomes into steps. Capture the account identifiers and session context your application can supply; add browser or mobile profiling where available. Use features for relevant history, such as recent attempts associated with an account or device, then combine that context in rules and signals and a decision strategy.
Connect the result to your application's allow, step-up or reject path. For identity-provider flows, follow the integration guides under APIs & integrations → Account takeover protection. Those integrations protect authentication flows; Portal single sign-on controls your team's access to Darwinium itself.
Verify: find the test login, its mapped identity, evaluated signals and final result in Investigations, then confirm that the intended action actually occurs in the application. Feed confirmed outcomes back using labels or the Update API, as appropriate.
Observe and protect AI-agent and MCP activity
Goal: understand what an agent is doing across a sequence of operations, including sensitive cart and checkout actions.
Put the HTTP endpoint behind the protected CDN path. Create JSON-RPC steps that distinguish methods and tool names, map selected arguments and results, and configure a stable journey tie where related calls should be connected. Follow Monitor MCP and JSON-RPC traffic for the worked example.
Use authenticated identity, the operation being requested and the available journey context to inform policy. A declared agent name or signature-key URL is not sufficient proof of authenticity. A machine client may legitimately have no browser profiling.
Verify: distinguish search, cart and checkout tool calls in Investigations; check response correlation and error mappings. Apply enforcement to the actual tool call, not only to tool discovery.
Reduce automated abuse across business flows
Goal: detect and respond to behavior such as repeated account creation, scraping or misuse of a valuable operation.
Map the operations that carry business meaning, rather than collecting only the login page. Combine connection signals, available profiling, identifiers and historical features. Use rules and models to express the policy for your traffic.
Choose an action that fits the client and operation: application handling, an edge proxy action, or Digital Speedbump where appropriate. Browser-oriented challenges are not automatically suitable for API or MCP clients.
Verify: exercise representative legitimate and unwanted activity. Review the resulting signals, action rate and business impact before expanding enforcement.
Assess sensitive transactions in journey context
Goal: evaluate a payment, account change or other sensitive action using more than the final request alone.
Map the preceding steps and the transaction attributes your policy needs. Add behavioral biometrics where your client integration supports them, alongside account, device and historical context. Build a decision whose inputs are available before the action must be taken.
Verify: trace a test interaction through Investigations and check which inputs were available at decision time. A response-time outcome can inform follow-up work; it cannot stop an operation that the origin has already performed. Treat a risk indication as evidence for your policy, not proof of a specific fraud or scam.
Enrich decisions and coordinate downstream systems
Goal: combine Darwinium context with an external provider or trigger a follow-up process.
Start with Darwinium Marketplace. Install a packaged integration, supply its configuration and credentials, then add its snippet to the appropriate journey step. Map the provider response and make dependent rules wait for it. Configure timeout and failure behavior for your application.
If no package fits, use Making your own integrations to call an internal API or reuse a part of your journey. Keep credentials in the supported secret-management configuration rather than in snippet files.
Verify: inspect the mapped result for a successful, failed and timed-out provider call. Confirm that downstream actions, such as case creation, occur only under the intended conditions.
Investigate outcomes and improve policy
Use Investigations to examine individual events and journeys, dashboards to monitor trends, and incidents to coordinate operational work. Widgets can be used in dashboards and investigations.
Record confirmed outcomes through labels and the relevant feedback APIs. Review the evidence, adjust your rules or models, and deploy the revised configuration. Feedback must be connected to the features, models or processes that consume it; adding a label does not automatically change every decision.
Plan data access and retention
Choose what to collect, where it is stored, and who can see it as part of the integration. See customer S3 storage, PII encryption and browser decryption, and storage lifecycle and retention. Apply your organization's retention and access policies to the actual configured stores and roles.