Why Even the Best Edge Security Still Misses High-Risk Sessions

Summary

Attackers are increasingly bypassing existing edge security controls by using residential proxies, VPNs, and other anonymizing infrastructure. These methods make malicious sessions appear legitimate, as current tools often focus on individual aspects of a session rather than the underlying network context. Spur's Monocle platform aims to address this by enriching sessions with real-time infrastructure data, enabling better detection of risky connections.

Full text

Why Even the Best Edge Security Still Misses High-Risk Sessions Sponsored by Spur Intelligence September 1, 2026 10:01 AM 0 Security teams have more edge controls at their disposal than ever, and each plays an important role. Yet, despite the best request inspection, credential validation, device fingerprinting, and automation signals available, attackers still successfully hide inside traffic that looks remarkably similar to legitimate user activity. One reason for this is that each security control focuses on a different piece of a user session. If an attacker that otherwise looks legitimate uses a residential IP or a commercial VPN, they may pass through several layers without triggering an alert or action. This is the fundamental problem with existing edge security tooling: a lack of context around the underlying infrastructure. What existing controls see, and what they can miss Application security relies on multiple layers of defense, each designed to answer a different question about incoming traffic. CDNs and WAFs are highly effective at inspecting requests, enforcing policies, filtering known threats, and protecting applications at the edge. But the request itself may not reveal that a seemingly ordinary connection is being routed through infrastructure intended to disguise its origin. Bot management helps identify automation and distinguish bots from human users. But not every malicious session is automated, and attackers increasingly combine automation with infrastructure designed to resemble legitimate consumer traffic. Identity and authentication systems attempt to determine whether users can prove who they claim to be. But valid credentials don't necessarily mean the person presenting them is the legitimate account holder. Device and browser intelligence provides a layer of trust by describing the endpoint. However, it doesn't reveal the network infrastructure connecting that endpoint to the application. Individually, these signals provide valuable and essential insights. But attackers increasingly exploit the gaps between them, creating sessions that appear legitimate to any one control while hiding important context about the infrastructure behind the connection. What Is Your Edge Security Missing? See how Spur's Monocle Session Enrichment platform adds real-time infrastructure context to your existing controls. Make smarter enforcement decisions by revealing when sessions hide behind VPNs, proxies, anonymization, data center traffic, and AI activity. Try Monocle Free From individual signals to session trust This creates a need for another layer of context: intelligence about the infrastructure behind the live session. Spur built Monocle Session Enrichment to provide that layer. Monocle enriches every user session with real-time trust signals – including anonymization status, proxy service attribution, residential infrastructure, and emerging attacker networks – that extend the intelligence of your existing edge security stack and enable your security and fraud teams to make smarter edge enforcement decisions that reduce authentication risks and friction for legitimate users. Monocle combines Spur's visibility into Internet infrastructure with live session telemetry to create a real-time Session Trust Assessment. Instead of simply labeling an IP as good or bad, it provides attributes that the enforcement layer can use when deciding how to handle the session. A Session Trust Assessment might look like this: { "allowed": false, "reason": "Anonymous connections blocked", "assessment": { "vpn": true, "proxied": false, "anon": true, "rdp": false, "dch": true, "cc": "US", "ip": "146.70.202.60", "ts": "2026-07-07T23:54:48Z", "complete": true, "id": "35ea59be-539d-4f65-b699-77ddc13c5df2", "sid": "test-app", "service": "PROTON_VPN", "cpd": "test-cpd-value", "ai_agentic": false, "ai_crawling": false }, "decisionId": "1a08c38d-810e-4a90-8705-dd3d9a76c529" } The assessment provides three types of context: signals describing what Monocle observes about the session; a decision based on the organization’s configured policy; and governance data that makes the assessment traceable. Signals Attributes such as ‘vpn’, ‘proxied’, ‘anon’, ‘rdp’, and ‘dch’ describe the infrastructure and connection characteristics Monocle observes, while ‘service’ identifies the specific service involved. Additional signals such as ‘ai_agentic’ and ‘ai_crawling’ provide context about emerging AI-driven traffic. Decision Rather than leaving the application to interpret the signals on its own, ‘allowed’ provides the resulting policy recommendation, while ‘reason’ explains why that decision was made. In this example, the session is not allowed because the configured policy blocks anonymous connections. Governance & traceability Fields including ‘decisionId’, ‘id’, ‘sid’, and ‘ts’ provide identifiers and timing information that can help teams trace a decision back to a particular assessment and application context. The goal of session enrichment is to expose the underlying infrastructure attributes so the organization can decide what those signals mean in the context of its own users, applications, and risk tolerance – and then enforce the appropriate policy. Applying session enrichment: Context makes existing controls more useful Suppose a financial institution sees a successful login from a U.S. IP address. On its own, that isn't particularly interesting. However, session enrichment might reveal that the connection is anonymous, originates from data center infrastructure, and is attributed to a commercial VPN service. This gives the enforcement layer critical context that enables more informed authentication decisions. In practice, a known customer using their normal device through a VPN might be allowed to continue, but a login using new credentials, an unfamiliar device, and anonymization infrastructure might trigger MFA. A high-value transaction from that same session could require additional verification. The same principle applies to use cases beyond suspected account takeover attempts: During account creation, infrastructure context can help identify users attempting to conceal or repeatedly change their network identity. For automated abuse, session enrichment can complement bot detection by showing the infrastructure being used to distribute activity. For geographic enforcement, organizations can distinguish the apparent location of an IP from sessions using VPN or proxy infrastructure to obscure their origin. For AI-generated traffic, organizations can add emerging agentic and crawling signals to the policies they already use for human and automated traffic. Spur Monocle continuously monitors sessions for infrastructure signals that indicate risky events such as ATOs and credential stuffing. Enforce where the decision matters Session enrichment is most effective when its signals can be evaluated where traffic is already being controlled: at the edge. Monocle is designed to complement existing edge infrastructure rather than replace it. Organizations using platforms such as Cloudflare can incorporate session enrichment into their existing enforcement workflows and determine how different combinations of signals should be handled. That might mean allowing a session, challenging it, requiring stronger authentication, restricting a sensitive action, sending it for additional analysis, or blocking it altogether. Edge security needs better context Session enrichment provides a missing layer of intelligence into the infrastructure behind sessions, complementing existing edge security controls and enabling stronger decisions. See how Spur can help uncover threats hiding behind VPNs, proxies, and other anonymization infrastructure. Get started for free. Sponsored and written by Spur Intelligence.

Indicators of Compromise

• ip — 146.70.202.60

Entities