Customer stories

Four of them, written with the uncomfortable parts left in, because the version without those is not useful to anyone deciding.

These companies are fictional, as is Kyklosec. Nothing on this page describes a real customer or a real incident.

A mid-market apparel retailer

RetailCheckout Monitor

First inventory found nineteen scripts on the checkout. The team had expected eight. Four were from vendors whose contracts had ended, and one of those was still receiving data.

The hard part was not the tool. It was that the tag manager had eleven people with edit rights, including two who had left the company, and nobody owned the list. Getting that down to three took longer than the deployment did.

A two-sided rental marketplace

MarketplaceAccount Defense

Seller-account takeover was the concern, and specifically the gap between an account being compromised and its payout details changing. Detection moved that window from days to the same afternoon.

The first month produced more alerts than the team wanted, most of them travelling sellers logging in from somewhere new. Tuning took six weeks and involved turning several things off. We would rather describe that honestly than describe a first week that nobody has.

A DTC supplements brand

RetailPCI

Arrived through the compliance door — a QSA asked how they would detect an unauthorized script and there was no answer. Deployed in October, locked the baseline before the freeze, and went through peak season with two third-party changes, both benign, both reviewed the day they happened.

The useful outcome was not the two changes. It was having an answer ready when the assessor asked the same question in March.

A payments-adjacent app

AppAccount Defense

Card testing through a documented API endpoint, by clients authenticating correctly every time. Visible in the data for eleven days before anyone read it as an attack, because in aggregate it looked like growth.

Where these do not apply

If your payment page is fully hosted by your processor, the script surface is theirs and Checkout Monitor has much less to tell you. If you have no customer accounts, Account Defense has nothing to defend. Both of those are common and both are fine.