Integrity products fail when they optimize for demo accuracy instead of analyst trust. We publish the “why” behind a flag alongside the score.
Signal layers
Network
ASN reputation, hosting fingerprints, geo plausibility, and TLS quirks. Fast, cheap, easy to game alone — still useful as priors.
Behavioral
Pointer entropy, scroll depth, interaction cadence. Bots can mimic moments; sustaining believable distributions across thousands of sessions is harder.
Cross-session
We look for devices hopping between unrelated campaigns with identical timing templates — classic farm tells.
ML placement
Gradient boosted models rank suspicion, but humans can override with notes. If a model cannot be explained to a marketer, it does not ship.
Adversarial reality
Every shipped rule becomes training data for attackers. We expect regression — the product is the update cadence, not a single clever filter.
