Why Even the Best Edge Security Misses High-Risk User Sessions

Security teams have more edge security controls than ever, including request inspection, credential validation, device fingerprinting, bot detection, and automated risk signals. Each plays an important role in protecting applications. However, attackers can still hide behind traffic that closely resembles legitimate user activity.

One reason is that each security control examines a different part of the user session.

When an attacker uses a residential IP address or commercial VPN, the session can pass through multiple security layers without triggering an alert. The connection may appear to come from a normal consumer device, use valid credentials, and behave like a legitimate user.

This exposes a fundamental gap in traditional edge security tools: a lack of context about the infrastructure behind the connection.

What Existing Edge Security Controls Detect—and What They Miss

Application security depends on multiple defense layers, with each layer designed to answer a specific question about incoming traffic.

Content delivery networks (CDNs) and web application firewalls (WAFs) are highly effective at inspecting requests, enforcing policies, filtering known threats, and protecting applications at the edge. However, an individual request may not reveal that the connection is being routed through infrastructure designed to conceal its true origin.

Bot management tools help identify automation and distinguish between bots and human users. However, not every malicious session is automated. Attackers are increasingly combining automation with infrastructure that imitates legitimate consumer traffic.

Identity and authentication systems determine whether a user can prove ownership of an account or access credentials. However, valid credentials do not guarantee that the person presenting them is the legitimate account holder.

Device and browser intelligence adds another layer of trust by describing the endpoint. Yet it may not reveal the network infrastructure connecting that endpoint to the application.

Individually, these signals provide valuable insights. Attackers, however, are increasingly exploiting the gaps between them to create sessions that appear legitimate while concealing important infrastructure details.

From Individual Security Signals to Session Trust

Organizations need another layer of context: real-time intelligence about the infrastructure behind each active session. Built-in Spur Monocle session enrichment provides that additional layer.

Monocle enriches user sessions with real-time trust signals, including anonymization status, proxy service attribution, residential infrastructure, data center connections, and emerging attacker networks. This extends the intelligence of existing edge security systems, helping security and fraud teams make more precise enforcement decisions while reducing unnecessary authentication friction for legitimate users.

Monocle combines Spur’s visibility into internet infrastructure with live session telemetry to generate real-time session trust assessments. Instead of simply labeling an IP address as good or bad, it provides detailed attributes that enforcement systems can use to determine how a session should be handled.

A session trust evaluation may look like this:

{
  "allowed": false,
  "reason": "Anonymous connections blocked",
  "assessment": {
    "vpn": true,
    "proxied": false,
    "anon": true,
    "rdp": false,
    "dch": true,
    "cc": "US",
    "ip": "146.70.202.60",
    "ts": "2026-07-07T23:54:48Z",
    "complete": true,
    "id": "35ea59be-539d-4f65-b699-77ddc13c5df2",
    "sid": "test-app",
    "service": "PROTON_VPN",
    "cpd": "test-cpd-value",
    "ai_agentic": false,
    "ai_crawling": false
  },
  "decisionId": "1a08c38d-810e-4a90-8705-dd3d9a76c529"
}

The assessment provides three types of context: signals describing what Monocle observes about a session, decisions based on an organization’s configured policies, and governance data that makes every evaluation traceable.

Session Signals

Attributes such as “vpn”, “proxied”, “anon”, “rdp”, and “dch” describe the infrastructure and connection characteristics observed by Monocle. The “service” field identifies the specific service associated with the connection.

Additional signals, including “ai_agentic” and “ai_crawling”, provide context about emerging AI-driven traffic and help organizations distinguish new forms of automated activity.

Policy Decisions

Rather than requiring an application to interpret every signal independently, the “allowed” field provides the resulting policy recommendation, while “reason” explains why the decision was made. In this example, the session is denied because the configured policy blocks anonymous connections.

Governance and Traceability

Fields such as “decisionId”, “id”, “sid”, and “ts” provide identifiers and timestamps that help security teams trace decisions to specific evaluations, applications, and session contexts.

The goal of session enrichment is to expose attributes of the infrastructure behind a connection. Organizations can then determine what those signals mean for their users, applications, and risk tolerance before applying the appropriate security policy.

Apply Session Enrichment to Improve Edge Security Decisions

Consider a financial institution that confirms a successful login from a US-based IP address. On its own, that information is not particularly significant.

Session enrichment may reveal that the connection is anonymous, originates from data center infrastructure, and is associated with a commercial VPN service. That additional context gives the enforcement layer a more complete view of the session and supports more informed authentication decisions.

For example, known customers may be allowed to continue using their regular devices through a VPN. However, the organization could trigger multifactor authentication when the session involves new credentials, an unfamiliar device, or anonymization infrastructure. High-value transactions from the same session could require additional verification.

The same approach applies to use cases beyond account takeover prevention:

• During account creation, infrastructure intelligence can help identify users who are concealing their network identity or repeatedly changing it.
• For automated fraud detection, session enrichment complements bot management by revealing the infrastructure used to distribute malicious activity.
• For geographic enforcement, organizations can identify VPN and proxy infrastructure that obscures the connection’s true origin and distinguish an IP address’s apparent location from the session’s underlying characteristics.
• For AI-generated traffic, organizations can add agentic and crawling signals to the policies they already use for human and automated traffic.

Enforce Session Security Decisions at the Edge

Session enrichment is most effective when organizations evaluate signals where traffic is already being controlled: at the application edge.

Monocle is designed to complement, rather than replace, existing edge security infrastructure. Organizations using platforms such as Cloudflare can incorporate session enrichment into their current enforcement workflows and determine how to respond to different combinations of risk signals.

Depending on the session context and policy requirements, organizations can allow the connection, challenge the user, require stronger authentication, restrict sensitive actions, send the session for additional analysis, or block it entirely.

Why Edge Security Needs Better Session Context

Session enrichment adds a critical layer of intelligence about the infrastructure behind user sessions. By complementing existing edge security controls with real-time context, it helps security and fraud teams make more accurate decisions, reduce account takeover risk, and protect legitimate users from unnecessary friction.

See how Spur can help uncover threats hiding behind VPNs, proxies, and other anonymizing infrastructure. Get started for free.

Sponsored and written by super intelligence.