TL;DR: Fraud teams can no longer rely on device fingerprints alone, because attackers spoof attributes, clear cookies, and rotate device profiles while behavioural analysis spots emulators, automation, and low-and-slow fraud patterns, according to Arkose Labs. The governance lesson is that static identification and real-time intelligence must be layered, not treated as substitutes.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Arkose Labs's blog post: Device identification and device intelligence solve different fraud problems and are strongest when used together.
Why it matters: IAM and fraud teams need both history-based device tracking and behavioural analysis because attackers can change device attributes faster than static fingerprints can keep up.
Context
Device identification and device intelligence are related but not interchangeable fraud controls. Identification tries to recognise a device from persistent attributes and cookies, while intelligence assesses behaviour, environment, and consistency signals in real time.
The governance gap is simple: a static fingerprint can tell you that a device has been seen before, but it cannot reliably explain whether the current session is legitimate. For fraud defence, that leaves a blind spot between known-device tracking and live risk assessment.
The article’s core point is that modern fraud operations exploit that gap by mixing spoofing, rotation, automation, and human-driven low-and-slow activity. Defenders need a layered model that treats identity history and behavioural context as complementary signals, not competing options.
Key questions
Q: Where does device identification fail in fraud defence?
A: Device identification fails when attackers can spoof attributes, clear cookies, or rotate configurations faster than the organisation can build reliable device history. It also struggles when legitimate software changes look similar to malicious masking. Teams should treat it as a continuity signal, not as proof of trust or user legitimacy.
Q: Why do behavioural signals reduce fraud risk when fingerprints are weak?
A: Behavioural signals reduce risk because they evaluate how a session acts in real time, not just whether the device looks familiar. Timing, navigation, input cadence, and environmental anomalies can expose automation, emulators, and fraud farms even when the fingerprint changes. That makes behaviour harder to fake at scale.
Q: What do security teams get wrong about fraud challenge controls?
A: Teams often assume that a harder challenge is automatically enough. In reality, a challenge only matters if it changes attacker unit economics at scale. If solver labour remains cheap or the attacker can route around the challenge, the control adds friction but does not make the operation unprofitable.
Q: How should fraud teams decide when to challenge a session?
A: Challenge a session when historical device reputation and live behavioural evidence disagree, or when one signal is too weak to support trust on its own. The goal is not maximum friction. It is to reserve stronger controls for sessions where the combined evidence does not support normal access.
Technical breakdown
Device identification: persistent fingerprints and their limits
Device identification builds a stable signature from browser version, operating system, screen resolution, hardware traits, and cookies. In fraud operations, that gives defenders a way to recognise a returning device, flag a previously suspicious endpoint, or block a known bad actor before a new session begins. The limitation is that the signature is only as durable as the attacker’s ability to preserve it. If an adversary spoofs attributes, clears cookies, or rotates configurations, the fingerprint loses much of its value. It also struggles to distinguish a normal software change from a deliberate attempt to obscure continuity.
Practical implication: Treat device identification as a continuity signal, not a stand-alone trust decision.
Device intelligence: behavioural analysis and contextual risk scoring
Device intelligence looks at how a session behaves rather than only what the device claims to be. It evaluates interaction patterns, typing cadence, mouse movement, navigation flow, emulator artefacts, virtual machine indicators, and inconsistencies between claimed attributes and observed context. That makes it better suited to detecting automation, fraud farms, and environments that imitate legitimate users while behaving unnaturally. The strength here is correlation: multiple weak signals are combined into a risk assessment that can adapt as attackers change tactics. This is a different control model from fingerprinting because it is rooted in live session behaviour, not static identity persistence.
Practical implication: Use behavioural scoring where attackers can rotate device profiles faster than you can maintain static trust.
Why layered fraud controls outperform single-signal detection
Volumetric bot attacks and low-and-slow human fraud are different problems, so they fail under different controls. Fast bot activity creates timing and consistency anomalies that behavioural analysis can catch quickly, while extended fraud campaigns create longer-term device reuse patterns that identification can connect across sessions. Either method alone leaves blind spots: identification misses fresh or spoofed sessions, and intelligence can miss a patient actor who behaves plausibly enough to avoid obvious anomaly thresholds. The real architectural insight is that fraud defence should combine historical device reputation with real-time behavioural context so each control compensates for the other’s weakness.
Practical implication: Correlate history and behaviour before making a block, challenge, or step-up decision.
Threat narrative
Attacker objective: The attacker aims to sustain fraudulent access while avoiding detection by defeating any single device-based control.
- Entry begins when an attacker reaches the fraud surface using a spoofed device profile, cleared cookies, or a rotating configuration that avoids simple fingerprint matching.
- Credential or session abuse follows when the same actor reuses access attempts across multiple sessions, changes device traits, or shifts between bots and human-operated activity to evade device history checks.
- Escalation occurs as the attacker moves from obvious automation into low-and-slow fraud patterns, fraud farms, or emulator-based activity that looks more like legitimate usage than scripted abuse.
- Impact is sustained fraud, account takeover, or repeated abuse that persists because either static device tracking or behavioural analysis was used in isolation.
Breaches seen in the wild
- Secrets in VS Code extensions 2025: Wiz found 550+ secrets in VS Code extensions, including publishing tokens able to push malicious updates to about 150,000 installs.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Device intelligence and device identification are separate governance controls, not competing products of the same category. One answers continuity questions about the device, while the other answers behaviour questions about the session. Fraud programmes that collapse those functions into one control end up over-trusting fingerprints or over-reacting to behavioural noise. The practitioner takeaway is to govern each signal for the job it can actually do.
Identity blast radius: Fraud teams need to think in terms of how far a single device trust decision can spread across sessions, channels, and account events. A static fingerprint can become a multiplier for abuse when it is treated as proof of legitimacy rather than one input to risk. That matters most where an attacker can reuse the same device history to move from one failed attempt to the next. The discipline shift is to limit how much trust any one signal can carry.
Low-and-slow fraud is a governance problem as much as a detection problem. It exploits the gap between real-time behavioural suspicion and delayed device reputation building, especially when teams tune controls for either bots or humans only. The result is a false choice between friction and visibility. Practitioners should treat fraud defence as a layered identity assurance problem across session, device, and behavioural context.
The strongest signal is not device intelligence or device identification alone, but the overlap between them. When both the device history and the live behaviour line up, confidence rises; when they diverge, that divergence becomes the review trigger. This is the model fraud teams should optimise toward because it reduces both false positives and blind spots. The practitioner conclusion is to design for corroboration, not replacement.
What this signals
Device intelligence changes the decision point. When teams move from static fingerprints to live behavioural assessment, the question is no longer only whether a device has been seen before. It becomes whether the current session behaves like a legitimate user or a fraud operation trying to blend in.
Fraud programmes should optimise for corroboration. A trusted device history without behavioural support creates blind spots, while behaviour without device context can overstate risk. The practical standard is to require both signals to support the same decision before lowering friction or granting confidence.
For practitioners
- Map device trust to risk, not access by default Use device identification as one input into challenge, step-up, or block decisions rather than as a direct grant of trust for repeat sessions.
- Correlate behaviour with device history Combine interaction timing, navigation flow, and environmental anomalies with prior device reputation before scoring a session.
- Tune controls for both bot and human fraud Validate that volumetric automation and low-and-slow manual abuse are both detected, because each defeats a different control pattern.
- Review false positives against software change patterns Separate legitimate browser or operating system changes from deliberate spoofing so the fraud stack does not punish normal user variation.
Key takeaways
- Device identification still matters, but it cannot carry fraud defence alone when attackers can spoof and rotate device traits.
- Behavioural intelligence adds value because it can detect automation, emulators, and suspicious session patterns that fingerprints miss.
- The operational answer is layered control, where device history and live behaviour reinforce each other before trust is extended.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API2 — Broken Authentication | Fraud sessions often hinge on weak authentication and reused access paths at the API boundary. |
| Recommendation — Use API2 to harden authentication checks that underwrite device-based trust decisions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Device trust decisions influence who gets access and at what confidence level. |
| Recommendation — Apply PR.AA-05 to ensure device reputation never substitutes for explicit authorization logic. | ||
| MITRE ATT&CK | TA0006;TA0007 — Credential Access; Discovery | Fraud campaigns use identity signals and reconnaissance to identify weak trust paths. |
| Recommendation — Map suspicious device activity to TA0006 and TA0007 to improve hunting and triage. | ||
Key terms
- Device identification: Device identification is the process of recognising a device through a stable set of technical characteristics. In identity governance, it gives a platform a device-level signal that can support access decisions, fraud detection, and policy enforcement when a single account credential is shared or reused.
- Device Intelligence: Device intelligence is the practice of interpreting signals from a device to assess whether a session or transaction is likely legitimate. It goes beyond fingerprinting by combining device context with behavioural, identity, and payment evidence to support a risk decision.
- Fraud Farm: A fraud farm is an organised group of human operators used to perform abuse that automated tools would block. In identity workflows, fraud farms generate authentic human signals that can bypass bot detection, making each session appear legitimate even when the operation is coordinated.
- Behavioural Risk Scoring: Behavioural risk scoring is the process of combining multiple runtime signals into a single assessment of suspiciousness. The score is not a verdict on identity by itself, but a structured way to turn interaction patterns, device consistency, and environment checks into actionable fraud decisions.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org