One AI agent wants to buy on your site. Another claims to be ChatGPT and isn’t. Can your WAF tell the difference?

We configure your edge (Cloudflare, Akamai, AWS WAF, F5) to let through the agents acting for your customers and stop the bots disguised as them. By someone who spent years configuring bot management for the world’s most demanding companies.

Book the callfrom USD 600

The problem

Until recently the rule was simple: humans get in, bots get stopped. Now part of your traffic is AI assistants that read, compare prices and even buy on behalf of a real person. Block them all and you lose customers and visibility in AI answers. Let them all in and any scraping or credential-testing bot only has to say it’s an agent: a user-agent is one line to fake.

Four kinds of automated traffic, four different decisions

Training crawlers

They read your content to train AI models. You decide whether they get it.

AI search crawlers

They index your site so it gets cited in AI answers. Blocking them can take you out of those answers.

Agents and fetchers

They come in real time because a person asked: summarize a page, compare products, complete a purchase.

Impostors

Scraping, credential-testing or fraud bots using the name of any of the three above.

What's included

  • Classification of your site’s automated traffic from edge logs: who comes in, how much, to which paths and under what claimed identity
  • Identity verification: provider-published IP ranges, reverse DNS and cryptographic request signatures (Web Bot Auth, built on HTTP Message Signatures, RFC 9421) where your platform supports it
  • Impostor detection: traffic presenting itself as a known agent or crawler that fails verification
  • Per-zone policy: what is allowed, challenged, rate-limited or blocked on content, search, login, checkout and API
  • Review of your robots.txt against what your edge actually enforces: robots.txt is a request, not a control

How we work

  1. 30-minute call: platform, sites in scope and written authorization
  2. Read-only access to the console and logs, or an export of 14 to 30 days of logs
  3. Classification, verification and policy proposal
  4. Technical session with your team or your partner to apply the rules

How it works

  1. 01

    Everyone claims to be someone

    An agent buying for a customer, a crawler indexing your site and a bot testing passwords. All three come in through the same door.

  2. 02

    A name proves nothing

    The bot only has to say it’s ChatGPT. A user-agent is one line to fake, and if your edge only looks at the name, it lets it through.

  3. 03

    Verification

    We check what can’t be made up: the request signature, the provider’s published IPs, reverse DNS. The impostor stays at the edge.

  4. 04

    One rule per zone

    The verified agent reaches checkout. The crawler reads your content, rate-limited. The fake one doesn’t get in.

How fast you see value

  1. Day 1Scope, authorization and read-only access. We change nothing.
  2. Week 1A map of your automated traffic. If an impostor is testing passwords, you hear it the same day.
  3. Week 2Per-zone policy, rules ready for your platform and an implementation session.

What you get

  • Automated traffic map: what kind, how much and to which paths
  • Impostors detected, with evidence
  • Per-zone policy and rules ready to apply on your platform
  • Executive summary: which AI traffic is worth receiving and which isn’t

Pricing

from USD 600

two ways to start · final price confirmed in the quote

Agents vs. Bots Check

USD 600

One site. Classification of the last 14 days of automated traffic, verification of the main agents and crawlers, impostors detected, a one-page report and a 30-minute session. 5 business days.

Full assessment

from USD 1,500

Up to 3 sites or APIs, with everything on this page: per-zone policy, rules ready for your platform and a technical implementation session. 10 business days. Also available as a module of the WAF / CDN Security Review.

What this service is NOT

  • We don’t sell or resell detection tools: we work with the platform you already pay for
  • Not ongoing rule administration. That’s what monthly advisory is for
  • Not a promise of zero bots. No control delivers that: you get visibility and a policy you can sustain

Frequently asked questions

Do I need a paid bot management product?

Not to start. Edge logs and WAF rules go a long way. If your plan falls short of what your risk calls for, we show you the evidence, without selling any brand.

Should I block ChatGPT and the rest?

Depends on what you want. Blocking training crawlers protects your content; blocking search crawlers can take you out of AI answers; blocking agents can shut out customers who shop through an assistant. We decide by type and by path, not wholesale.

How do you know an agent is who it claims to be?

The name in the user-agent proves nothing. We verify against what the provider publishes: its IP ranges, its reverse DNS or, increasingly, a cryptographic signature on every request.

Why Torvex?

Because we spent years on the edge-provider side configuring bot management for large companies, and because we audit AI agents from the inside. We know the problem from both ends.

Want to talk about your case?

A free, no-strings 20-minute intro call. Tell us your context and we’ll tell you honestly whether this service makes sense for you.

Book the calleduardo@torvexsecurity.com