Notifications
Clear all
Topic starter
02/08/2026 11:45 am
TL;DR: Denial of inventory, or inventory hoarding, lets bots hold carts, seats, and reservations without buying, creating business-layer loss that WAFs often miss because the attack looks like normal customer behaviour, according to Impart. The real control gap is application-layer visibility and enforcement across the full transaction lifecycle, not perimeter filtering.
NHIMG editorial — based on content published by Impart: What Your WAF Misses, Denial of Inventory
By the numbers:
- Bad bot traffic now accounts for at least 37% of all automated web traffic.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams stop denial of inventory without blocking real customers?
A: Use behavioural controls inside the application flow, not just edge filtering.
Q: Why do WAFs struggle with denial of inventory attacks?
A: Because the attack is a business-logic abuse pattern, not a malformed request.
Q: What breaks when reservation workflows have no behavioural controls?
A: Scarce resources can be held at machine speed without purchase, which distorts availability, frustrates customers, and corrupts demand signals used by merchandising and operations.
Practitioner guidance
- Instrument reservation-to-purchase ratios Track add-to-cart volume, checkout conversion, and reservation expiry by SKU so that abnormal hold patterns are visible before sell-through is distorted.
- Move enforcement into the transaction path Use controls that can challenge, throttle, or exclude suspicious sessions at the point where carts, seats, or appointments are reserved, rather than relying on perimeter rules.
- Segment scarce resources by risk Treat limited-stock products, booking slots, and queue positions as higher-risk workflows and apply tighter behavioural thresholds to those paths than to ordinary browsing.
What's in the full article
Impart's full blog post covers the operational detail this post intentionally leaves for the source:
- The request-path telemetry and behavioural thresholds used to distinguish inventory hoarding from normal cart abandonment
- The inline enforcement patterns for challenging or excluding suspicious sessions without waiting for WAF rule changes
- The shadow-mode workflow for validating false positives before turning on enforcement in revenue-critical flows
- The concrete examples of SKU-level and reservation-level signals that can be tuned by implementation teams
👉 Read Impart's analysis of OWASP OAT-021 Denial of Inventory →
Denial of inventory: what it means for application security teams?
Explore further
02/08/2026 12:56 pm
Denial of inventory is a governance problem, not just a bot problem. The attack succeeds because business workflows trust reservation behaviour without asking whether the session is acting in good faith. That makes the control gap broader than traffic filtering and closer to trust policy, telemetry, and enforcement design. For practitioners, the key question is whether scarce-resource workflows are governed as security-sensitive transactions or treated as ordinary commerce.
A question worth separating out:
Q: How do teams decide whether to tighten cart or booking controls?
A: Start with the workflows where scarcity and business impact are highest, such as limited-edition goods, seats, and appointment slots. If the control can be tuned by session behaviour and product sensitivity, it is usually safer than blanket friction. The right decision depends on whether the workflow can tolerate false positives without hurting revenue or access fairness.
👉 Read our full editorial: Denial of inventory exposes the gap between WAFs and app logic
