At a Topps card launch, the collectors had a speed problem. Limited editions could vanish in seconds, and software shoppers were quicker than people with pulse rates and opinions. Some scalper bots arrived as polished browser extensions: add a card, payment details and a product URL, then let the machine pounce. The bots bought inventory, hammered servers and left actual fans complaining online. Topps responded the normal way - more server capacity, more log watching, more people preparing for the next rush. The bots happily consumed the extra capacity too.
That small tragedy of modern commerce explains DataDome better than a wall of cybersecurity language. The company sits in front of websites, mobile apps and APIs, examining each request before it reaches the expensive machinery behind the screen. It tries to decide whether the visitor is a person, a useful crawler, a malicious bot or, increasingly, an AI agent whose intent may change mid-journey. The answer can be allow, block, rate-limit or challenge. DataDome says the verdict arrives in under two milliseconds.
01 / The wedge
First, show the customer what is already eating the store
Topps had a content delivery network and basic user-agent and IP tracking. Those controls were not useless. They were simply looking through a keyhole. Other providers proposed month-long engagements, proofs of concept and coding work. Then a systems integrator suggested DataDome's free trial. Topps says its team installed the Fastly module using online documentation in half an hour.
The first thing that changed was not blocking. It was seeing. The dashboard surfaced credential stuffing, distributed denial-of-service activity, scrapers and troublesome addresses that the retailer had not classified before. That evidence mattered because the pandemic had frozen discretionary spending. Topps could now connect unwanted traffic to temporary server expansion and staff time. The security discussion became a cost discussion.
“When you're firefighting, you're not doing your day job.”Sayed Gaffar, then Director of E-Commerce at Topps
Before DataDome, the Topps group said launch preparation, log monitoring and customer complaints could absorb up to 50 work-hours in a day. Adding servers delayed the slowdown without removing its cause. After deployment, Topps said it no longer needed to scale infrastructure for two-hour launch spikes, and bot conversations disappeared from the weekly work. The company did not disclose its subscription price. Its argument was more useful anyway: avoided compute and recovered engineering time made the subscription pay for itself.
02 / The machine
A security guard assembled from behavior, fingerprints and shared memory
DataDome was founded in Paris in 2015 by Benjamin Fabre, Fabien Grenier, Benjamin Barrier and Olivier Trabucato. Fabre, the current chief executive, wrote the first code and designed the early architecture. The original proposition was bot protection delivered as SaaS. The current platform sprawls across Bot Protect, Account Protect, API Protection, Ad Protect, Layer 7 DDoS defense, a virtual waiting room called Priority Protect, and services from a round-the-clock security operations center.
Underneath those labels is a repeated sequence. DataDome integrates at the edge or server through more than 80 pre-built connectors. It evaluates client and server signals, including behavior, device and TLS fingerprints, IP reputation and the request's relationship to earlier actions. More than 1,000 general and customer-specific models contribute to a decision. High-risk traffic can be stopped automatically; ambiguous traffic can receive an invisible device check or, rarely, a CAPTCHA.
One request, five moves
This is where DataDome differs from a basic block list or a CAPTCHA pasted onto login. It watches the journey rather than one checkpoint, and it sells a specialist detection layer that works with Cloudflare, Fastly, Akamai, AWS and other infrastructure. Competitors include HUMAN Security, Cloudflare Bot Management, Akamai Bot Manager, Imperva, Kasada, Arkose Labs and F5 Shape. Some bundle protection into a wider edge platform. DataDome's pitch is specialization, fast deployment, low latency and human supervision from its SOC.
03 / The economics
The bill is visible. The waste usually is not.
Public pricing makes the trade unusually concrete. Bot Protect's Essentials plan starts at $3,830 a month for fewer than 100 million monthly requests. Advanced costs $8,670, Premium $10,160, and Enterprise starts at $13,270. Higher tiers add mobile and machine-to-machine APIs, endpoint-specific models, AI-agent monetization, dedicated support, custom detection and deeper SOC services. Account, DDoS, ad and queue products are priced by event or request volume.
That is enterprise money, but the buyer is not comparing it with zero. Bots consume cloud compute, pollute analytics, buy scarce inventory, test stolen cards, take over accounts, trigger SMS verification fees and keep fraud and DevOps teams busy. Etsy offers a second version of the Topps story. It tested DataDome against its Google Cloud infrastructure, watched one important cluster's computing workload fall after scrapers stopped reaching popular product pages, and checked that conversion and user experience did not suffer. The trial, not a promise, changed its confidence.
DataDome has raised roughly $80 million in disclosed rounds: €1 million in 2016, €2.5 million in 2018, $35 million led by Elephant in 2021 and $42 million led by InfraVia Growth in 2023. That money funded international sales and R&D as the company expanded from Paris to global headquarters in New York, Paris and Singapore. It reported reaching 200 employees in 2025. More than 300 customers now include publicly named companies such as PayPal, Etsy, Reddit, Foot Locker, Tripadvisor and SoundCloud.
04 / The pivot
The bot at the door might be carrying a customer's wallet
Bot management once had a tidy moral map: people good, automation suspicious. Generative AI ruined the map. A publisher may want to block a scraper copying every article, license another crawler, and welcome an assistant fetching one page for a reader. A retailer may want a customer's verified shopping agent to compare products and buy, while stopping a fake agent hoarding inventory. Identical plumbing can carry very different intent.
DataDome has responded by renaming the problem. Agent Trust identifies and classifies AI agents, assigns trust signals and lets customers write policies around access. It supports cryptographic verification where available, official source lists and reverse-DNS checks. Publishers can set crawler terms, from usage limits to paid access. Priority Protect tries to keep scalpers out of a queue without excluding authorized shopping agents. In 2026, DataDome added a native FastMCP integration and its own hosted MCP server for querying trend reports.
The product is moving from “spot the machine” to “decide what this machine may do.”
This is a credible extension, not a solved category. Agent identity standards are young. Attackers can spoof labels, borrow residential networks and combine human labor with automation. Intent can also change after a session earns trust. DataDome's advantage is the same feedback loop it built for bots: observe behavior across many customers, adapt models and enforce a verdict close to the request. The danger is also familiar. A false positive at security speed is still a lost customer at checkout speed.
What a reader can copy
- Instrument before blocking. Run a trial in observation mode and name the traffic your existing stack cannot see.
- Price the invisible mess. Add wasted compute, fraud losses, SMS fees, support tickets and engineering hours.
- Test the customer journey. Measure conversion, latency and false positives on the endpoints that make money.
- Integrate where traffic already flows. An edge, CDN or server module beats a security project that requires rebuilding the storefront.
- Separate identity from permission. A known crawler still needs an explicit policy for what it may access, how often and on what terms.
05 / The boundary
When the bouncer is the wrong hire
DataDome works best when automated traffic is already expensive: a popular shop, a marketplace with account abuse, a publisher being scraped, a ticket release or an API that attracts fraud. It also requires a team able to integrate critical endpoints, monitor outcomes and make policy decisions about useful automation. The customer needs enough traffic for collective detection and enough loss for enterprise pricing to make sense.
A low-traffic site with little abuse may spend more on the base plan than it can recover in cloud savings or prevented fraud.
Layer 7 application defense does not replace every network DDoS, firewall, identity, payment-fraud or application-security control.
If a company cannot measure conversion and false positives on real journeys, automated blocking can protect the site from its customers.
Agent trust needs commercial choices. Security software cannot decide whether an AI crawler should be licensed, limited or welcomed.
The clever part of DataDome's story is not that it declares war on bots. The internet has plenty of war language already. It is that the company turns weird traffic into a line item an operator can examine: requests blocked, compute avoided, accounts preserved, launches calmed. Now it is attempting the harder sequel - turning AI traffic from a binary threat into governed economic activity. The dashboard will look neat. The web outside it will not.