Verspieren Ends Credential Stuffing Attacks With DataDome

The solution: Proven, effective, and easy to implement.

To choose the right anti-bot solution, the team relied on the experience of its SOC, which had already implemented DataDome at other companies.

“DataDome quickly became the front-runner for our ideal software solution,” says Steve. “Feedback from our SOC and a fellow CISO about their experiences helped us understand exactly what we would be getting. Since its effectiveness had already been tested by our partners, we felt confident that we were making the right choice.”

Another criteria for selection: ease of implementation.

“Implementation couldn’t have been easier, nothing but a few lines of code to add to various pages,” says Steve. “Our traffic streams go through reverse proxies on which we installed the corresponding module to send the streams to DataDome. To activate it you have to know the authentication sequences, the specific paths, and the IPs to allow, but it’s very intuitive. Protection was activated on our first few websites within 48 hours. The DataDome team helped us with the first two or three sites. After that, we handled it on our own.”

Transparency and the human user experience were also very important criteria.

“If for one reason or other there’s a false positive in our legitimate traffic, it can’t have a blocking effect, we need to protect the customer experience,” explains Steve. “DataDome had a set of answers for all of these types of issues, which made it fairly easy for us to approve the solution.”

The results: Enhanced data security and renewed performance

Compared to the most intense period of attacks, Verspieren’s overall website traffic dropped by a factor of 10. The websites returned to normal activity levels, with clean, smooth traffic.

“Even though we only detected the presence of bots fairly recently, it’s very likely that we’d already been targeted by certain bots in the past without realizing it,” says Steve. “Overall, we’ve reduced traffic on our website environments by at least 20–30%, and response times are very good. We’re now seeing application behavior and resource usage that matches our customers’ profiles and time zones.”

An unexpected benefit was the IT team regaining control of business projects that can draw on infrastructure resources without the team’s being informed.

“Some partners and suppliers were accessing our APIs, or using bots to look for data in our information systems without informing us,” explains Steve. “Now we detect them, and they have to go through IT to be allow-listed, which allows us to control their access. The next step is to work with our partners to give them a better experience with our tools, without penalizing our customers or creating unnecessary additional costs.”

The team also plans to remove the static captchas currently in place throughout their websites. Instead, they will rely solely on DataDome, letting the algorithm select the appropriate moment to place a CAPTCHA when needed. This will simplify development and improve the user experience. Customers will now only see CAPTCHAs if their browsing behavior is suspicious.

But the most important benefit may just be peace of mind.

“We don’t have to worry about bots anymore. As soon as an activity falls outside the set framework, it’s automatically blocked,” Steve explains. “We read the daily reports to make sure that everything’s okay, but overall, we can relax.”