Imagine a travel website celebrating a rush of visitors. Searches climb. Servers strain. Bookings barely move. The apparent audience includes machines that will never take a holiday. In a HUMAN case study, an unnamed online travel agency discovered that unwanted bots accounted for more than half its traffic, rising to 95% on login pages. Its dashboard had been describing a crowd that did not exist in quite the way the business assumed.
That is HUMAN’s territory: the gap between an interaction and what it appears to mean. An ad view can be counterfeit. A familiar account can be compromised. And now a machine browsing a shop might actually represent a paying customer. Sorting those cases requires more judgment than a simple human-versus-robot test.
- Follow the money: HUMAN’s roots are in advertising fraud and the economics behind it.
- Connect the journey: its defenses extend into applications, accounts, and transactions.
- Make room for agents: useful automation needs permissions, alongside detection.
A bookstore, then a balance sheet
HUMAN began in 2012 as White Ops, with Tamer Hassan, Michael Tiffany, Dan Kaminsky, and Ash Kalb working in the back of a Brooklyn science-fiction bookstore. The setting supplies a pleasing origin story. The business idea was more practical: attack the financial incentive that made large-scale online fraud worthwhile.
Advertising offered a revealing target. A compromised device could impersonate an audience, generating impressions that somebody else paid for. The company’s expertise grew around detecting those fabrications and investigating the operations behind them. Its Satori researchers work on the adversary as well as the individual request.
In 2018, White Ops participated in the coordinated response to 3ve, alongside industry partners and law enforcement. The Justice Department announced charges against eight people across two international advertising-fraud rings. This was security with a wider ambition than cleaning one customer’s traffic: make running the underlying operation less attractive.
“We did not aim to build a system that is undefeatable.”
Michael Tiffany, co-founder · 2018
Tiffany’s argument was economic. Raise an attacker’s costs, reduce the payoff, and make adaptation harder. A defense can be valuable without being permanent. What matters is whether defeating it remains a profitable use of the attacker’s time.
The customer journey became the product
The company adopted the HUMAN name in March 2021. In July 2022, it merged with PerimeterX, bringing advertising-fraud expertise together with application defenses against account abuse and automated attacks. The combined business announced more than $100 million in annual recurring revenue. That is a historical subscription metric, rather than a current revenue figure.
The resulting Human Defense Platform covers problems that businesses often distribute across departments. Advertising teams need genuine impressions and clicks. Security teams need to stop credential stuffing and account takeover. Retailers need to prevent scraping, fake accounts, and transaction abuse. Client-side protection addresses scripts running in a visitor’s browser.
HUMAN sells protection across these connected surfaces.
Customers include luggage maker Samsonite and entertainment business AEG Presents. HUMAN reported serving more than 500 global brands in October 2024. Its position crosses advertising verification and enterprise fraud defense; buyers comparing bot-management options may also consider DataDome, Kasada, Akamai, or Cloudflare. HUMAN’s particular pitch combines those connected surfaces with investigative research.
The robot might be bringing money
Then AI assistants complicated the assignment. A retailer wants to stop inventory abuse. It may also want an authorized assistant to discover a product and help someone buy it. Treating both visitors identically creates an obvious commercial problem.
Useful bots were already part of the problem. The travel agency depended on business partners using automation, so its deployment needed to discover and allow legitimate bot traffic. AI agents make that older distinction more consequential. The same business can have good reasons to welcome one automated interaction and refuse another, even when both arrive at the same page.
In July 2025, HUMAN introduced Sightline featuring AgenticTrust, extending its focus to visibility and control across humans, bots, and AI agents. The shift followed a changing traffic population: automation could now carry legitimate customer intent. Deciding whether something is automated no longer settles whether it belongs.
The distinction is clearest in HUMAN’s agent-trust documentation. It assigns high, medium, or low trust using evidence including identity and behavior. Cryptographic verification helps establish who sent a request. An agent can still lose trust after abusive behavior. A reliable name badge does not confer unlimited permission.
Identity → behavior → permission
Verify the sender. Watch the activity. Set the allowed actions.Developers can examine HUMAN’s open-source verified-agent demonstration, which signs requests using HTTP Message Signatures. In December 2025, HUMAN announced verification for Amazon Bedrock AgentCore browser traffic. These are concrete steps toward identifying automated visitors, while site owners still have to decide what access makes sense.
What the meter actually counts
HUMAN sells enterprise cloud security. Its Application Protection documentation licenses monthly requests, counting legitimate and blocked traffic, with specified exceptions for allowed known bots and IP services. Client-side tiers use payment-page views or monthly unique visitors. Buyers need traffic estimates and a scoped quote before calculating a budget.
Building the business has required capital, too: a $100 million growth investment closed in December 2021, followed by more than $50 million announced in October 2024. The 2022 merger also brought a $100 million Blackstone Credit debt facility. Borrowing capacity and equity investment belong in separate columns.
Fix the denominator first
The travel case offers a useful lesson. Before deployment, unwanted automation had been consuming resources and distorting analytics. HUMAN reported that mitigation reduced third-party API calls by more than 12% and server CPU utilization by 25%. Those are customer-specific results, but they suggest better purchasing questions than simply asking how many bots were blocked.
Measure wasted calls, account losses, customer friction, and genuine conversions. Decide which automation helps. Test permissions against actual behavior. This approach depends on usable traffic signals and policies that reflect the business; identity checks alone cannot deliver it.
The remit keeps expanding. In September 2026, HUMAN announced a partnership with Confused.com. In October, it introduced an Ad Integrity Suite for Platforms with OpenX as launch partner, combining invalid-traffic, brand-safety, and viewability signals. The recurring question is becoming more exacting: what happened here, who benefited, and should we let it happen again?