Resources
Field notes from inside the automated economy.
Research and case studies from staying close to the real adversary: how bot operators actually work, the events they target, and what the evidence shows when we follow it end to end.
Earlier field notes.
Research, case studies, and explainers, collected here and written from inside the communities we study. Each was first published on LinkedIn, where you can read and comment.
ResearchBots stuffed FIFA’s World Cup ticket draw
Our campaign assessment of the FIFA World Cup 26 ticketing attack: 1.37 million automated accounts, at least 710,521 successful entries, and FIFA’s own emails confirming operators won draws and received tickets.
Read the story
Tech stackThe Bot Operator’s Tech Stack: a deep dive
The opening piece in our Bot Operator’s Tech Stack series: why modern retail bots are built by small, agile dev teams, and the eight components of the toolchain we set out to document.
Read the story
Tech stackThe Bot Operator’s Tech Stack: Cook Groups
Recipes, chefs, and secret sauce: inside the subscription communities where bot operators organize, share tactics, and coordinate for the next drop, and why the security community should be studying them.
Read the story
Tech stackThe Bot Operator’s Tech Stack: Proxies
In the bot operator’s tech stack, proxies are king. How residential, ISP, and mobile proxies anonymize traffic, rotate on blocks, and defeat IP-based defenses, and what actually works against them.
Read the story
Case studyAliens vs Bots: the Reebok Stomper drop
A flaw in the checkout flow let cook groups and bot operators push orders through before the midnight launch, taking most of the limited Alien: Romulus inventory. Parameter tampering, pre-release checkout, and why customer-experience security belongs on the security team.
Read the story
Case studyThe sold-out pink Stanleys
When the limited pink Stanley x Starbucks Quencher hit Target, cook groups were ready. Automated checkout took thousands of tumblers before real customers had a chance. A blameless post-mortem of how the controls were beaten.
Read on LinkedIn
Case studyTaylor Swift’s got a bot problem, again
A signed-CD exclusive sold out in minutes, and the resale listings appeared before fans even finished the queue. How automation keeps turning artist-to-fan drops into a secondary market.
Read the story
Case studyThe sneaker drop of the summer
Nina Chanel Abney’s Air Jordan 3 was billed as the sneaker drop of the summer, until a last-minute bot module flooded the raffle with thousands of entries per second and locked real fans out with a denial-of-service against the raffle endpoint.
Read on LinkedIn
Case studyFujiFilm’s 1934 anniversary: the camera battle begins
Limited-run cameras are the newest target. As FujiFilm’s anniversary edition drew collectors, the same automated playbook honed on sneakers and tumblers moved into premium hardware, and the resale spread followed.
Read the story
Tech stackThe Bot Operator’s Tech Stack: Botting Software
The engine of the operation. All-in-one bots, site-specific modules, task queues, and the release-day arms race between retailers and the software built to beat them.
Read the story
PerspectiveGame Over: how bots continue to prevail
Sony’s 30th-anniversary PlayStation 5 sold out in seconds to automated checkout. A look at how the drop played out, and why “game over” keeps repeating for the fans who actually wanted one.
Read the story
PerspectiveAI-powered bots are transforming shopping — and polluting company data
Our founder Scott Schwan on the 2021 GPU shortage that started it all, and why AI-powered bots that pollute customer data are bad for shoppers and terrible for business. The inaugural Vesal post.
Read the storyProve your controls hold.
Bring us a live promotion. We'll show you how it stands up to the real adversary. No deck. No discovery call.