The fingerprint
they can't fake.
Snared fingerprints every request at the network and application layer before your code runs. 199 signals. One verdict. Under 50ms.
199 signals across every layer of the stack.
Four collection planes — each independently scoring, each cross-validating the others.
Network & Transport
Transport-layer and connection stack analysis that identifies the true operating environment — even across proxies, VPNs, and spoofed headers.
Runtime Integrity
Deep environment validation that distinguishes real browsers from automated tools, tampered configurations, and orchestrated headless environments.
Hardware Identity
Hardware-level signals build a stable device fingerprint that persists across sessions, browsers, and network changes — independent of cookies or storage.
Behavioral Analysis
Real-time interaction patterns that reveal the difference between human intent and programmatic execution — impossible to fake at scale.
Set once. Runs everywhere.
A 12kb client script. An encrypted payload. A verdict from the edge. No servers to manage, no latency added to your stack.
Collect
A 12kb snippet silently gathers 199 hardware, runtime, and behavioral signals without blocking the main thread.
Obfuscate
Signals are encrypted into a tamper-proof, opaque payload before leaving the device. The telemetry is unreadable in transit.
Decide
Decrypted at the Cloudflare edge. Three scoring layers run in parallel. A deterministic verdict fires in under 50ms.
Three layers. One verdict.
Each layer scores independently. The strictest action wins.
Device Identity
Layer 1Builds a stable, durable device identity from multi-layer environmental signals. Survives IP rotation, proxy chains, and browser attribute spoofing.
Environment Integrity
Layer 2Runs a comprehensive battery of integrity checks across every layer of the browser and connection stack. Automation tools and tampered environments cannot pass.
ATO Session Risk
Layer 3Scores account-takeover risk using historical session patterns, challenge outcomes, and identity continuity signals correlated across the operator graph.
{
"device_id": "sne_9aX7b2cZk...89A",
"nsp_id": "nsp_8f9a2b3c4d5e6f7a",
"omni_risk": 72.4,
"env_action": "challenge",
"ato_action": "allow",
"effective": "challenge",
"flags": [
"headless_env_detected",
"datacenter_ip_range"
],
"latency_ms": 34
} One operator.
Every session they've ever run.
Clear cookies, rotate proxies, randomize user agents. Bridge v3 sees through all of it. Transport-layer fingerprints survive every evasion technique we've seen. We cluster cross-session signals into a single root actor identity.
One line of code.
Complete threat intelligence.
Drop the snippet. Fetch the payload. POST to our edge. You get a deterministic verdict, a durable device ID, anomaly flags, and network intelligence — all in one response.
{ "request_id": "req_88f92z", "verdict": "challenge", "score": 73.5, "action_recommended": "require_mfa", "device": { "id": "sne_99BxL...89A", "confidence": 0.99, "is_new": false }, "flags": [ "env_integrity_fail", "datacenter_ip_range", "runtime_anomaly_detected" ], "network": { "ip": "185.220.101.5", "location": { "city": "Frankfurt", "country": "DE", "is_proxy_or_vpn": true } } }