Online retailers

You have one storefront and somewhere between fifteen and sixty pieces of code running on it that belong to somebody else.

The number surprises people every time. A first inventory on a mid-market store typically turns up eleven scripts nobody on the current team remembers adding — a legacy pixel, an A/B tool from a test that ended, a support widget replaced two vendors ago whose tag never came out.

Each of those was added deliberately by a competent person for a real reason. That is exactly what makes them hard to find later, and exactly what makes them the path a skimmer takes.

What usually goes wrong

A vendor ships an update. They do not tell you, because from their side it was a routine release. Their code now does something slightly different inside your customer's browser, on the page where the card number is.

Your perimeter tooling never fires. Nothing was breached on your side. The script loads at runtime from someone else's domain, so a dependency scanner that reads your repository never sees it.

The first real signal is a chargeback pattern, weeks later, from your payment processor rather than from your security stack.

What applies here

Checkout Monitor, primarily. Inventory of what actually executes on the payment page, a baseline so that "changed" means something specific, and an alert inside the session a change happens rather than on the next weekly crawl.

Account Defense, sometimes. If you have customer logins with stored cards, credential stuffing is a real second problem and this is the part that handles it. If your customers check out as guests, you do not need it, and we would rather say so than sell you both.

What it looks like in practice

• Week one is the inventory, and it is usually the uncomfortable part. See the eleven scripts nobody remembered adding.
• Then a baseline, agreed with whoever owns the tag manager — normally marketing, which is the conversation this actually starts.
• Then alerts that name the script, the vendor, and what changed. Not a severity score.

We do not block. That decision shapes more of the product than any other and we explain why in this post.

Related

PCI DSS 4.0 script requirements · Peak season · Integrations