What the verdicts mean
Allow, challenge, investigate and block; what was done to each request; Monitor and Enforce; the risk score; the kinds of threat.
The risk score#
Every request gets a risk score from 0 to 100 %, made from what five checks found: where it came from, what kind of client sent it, how it behaves, what it is trying to do, and your organisation's own rules. Two lines turn the score into a verdict (by default 60 % and 85 %).
The four verdicts#
| Verdict | Means |
|---|---|
| ALLOW | Nothing suspicious enough to act on |
| CHALLENGE | Probably hostile: check it before letting it through |
| INVESTIGATE | A browser visit the AI is double-checking; the visitor sees a short "being checked" page |
| BLOCK | Clearly hostile: stopped |
What was done#
The event list also says what happened:
| Shown as | Meaning |
|---|---|
| allowed | Sent to the website |
| blocked | Stopped; the visitor saw a "Request blocked" page with a reference number |
| challenged | A browser had to pass an invisible check (it solves a small puzzle by itself; people notice nothing) |
| passed the browser check | The visitor passed the check earlier and was let through |
| slowed down | A script or API call was delayed a little, then let through |
| let through (signed-in staff) | A signed-in staff member was let through despite a borderline score |
| monitor mode — not stopped | The shield is in Monitor mode: this would have been stopped, but was only recorded |
| would block / would challenge | The same, for drills and Monitor mode |
Monitor and Enforce#
- MONITOR — the shield checks and records everything but stops nothing. New websites run like this for a few days.
- ENFORCE — the shield stops attacks.
The mode is shown at the top of every page.
Kinds of threat#
| Kind | In plain words |
|---|---|
| Exploit attempt | Trying to break into the website with malicious input (SQL injection, scripts, path tricks) |
| Vulnerability scanner | An automated tool looking for weaknesses |
| Path probing | Looking for hidden files such as backups and configuration |
| Credential stuffing | Trying many stolen usernames and passwords |
| AI crawler | A bot collecting content for AI training |
| Autonomous AI agent | An automated agent working through your site |
| Headless / automation | A program pretending to be a browser |
| Spoofed browser | A client lying about which browser it is |
| Script client | A program (not a browser) asking for pages |
| Rate flood | Far too many requests from one address |
| Blocked network | An address that is banned, on a block list, or from a blocked country or network |
| Prompt injection / Hidden instructions | Text trying to manipulate an AI feature on your site |
| Data exfiltration | Reading large amounts of data, especially sensitive areas |
| Policy violation | Breaking one of your organisation's own rules |