Notifications
Clear all
Topic starter
02/08/2026 11:53 am
TL;DR: Scalping is an automated business-logic attack that can clear limited inventory in seconds while passing standard WAF checks, according to Impart Security. The real problem is not detection at the edge but enforcement inside the application path, where session behavior reveals intent.
NHIMG editorial — based on content published by Impart: What Your WAF Misses: Scalping
Questions worth separating out
Q: What breaks when WAFs are used alone against scalping bots?
A: WAF-only controls usually fail because scalping traffic is valid at the request level.
Q: Why do scalping bots defeat normal request-based controls?
A: They defeat request-based controls because each step can look legitimate in isolation.
Q: What do security teams get wrong about bot detection for high-demand sales?
A: Teams often assume detection is the same as control.
Practitioner guidance
- Implement session-level scalping detection Correlate inventory polling, add-to-cart timing, checkout velocity, and account age before deciding whether a session is abusive.
- Run high-risk rules in shadow mode first Validate bot rules against live traffic before enabling blocks so you can review false positives, understand legitimate flash-sale behaviour, and tune thresholds with production evidence.
- Tie enforcement to business outcomes Define the control objective as protecting fair access and conversion quality, not just reducing suspicious traffic.
What's in the full article
Impart's full post covers the operational detail this post intentionally leaves for the source:
- Request-path detection examples showing how the application sees session behaviour that a WAF cannot.
- Shadow-mode workflow detail for validating block decisions against live traffic before enforcement.
- Practical behavioural signals such as inventory polling cadence, account age, and checkout compression.
- How to balance bot blocking against false positives during flash sales and high-demand drops.
👉 Read Impart's analysis of OWASP OAT-005 scalping and runtime enforcement →
Scalping bots and the enforcement gap teams are still missing?
Explore further
02/08/2026 1:01 pm
Scalping exposes an enforcement gap, not just a detection gap. The core failure is assuming that edge filtering can distinguish abuse from legitimate commerce when the request itself is valid. In practice, the decision only becomes clear across a full session, where speed, sequence, and intent reveal the bot. That makes runtime enforcement, not perimeter inspection, the real governance issue for high-demand applications.
A question worth separating out:
Q: How should teams stop scalping without blocking real customers?
A: Use shadow mode to validate behaviour-based rules against live traffic before enforcement begins. Then set policies around session patterns such as repeated inventory polling, compressed checkout timing, and improbable purchase cadence. That approach lets teams protect legitimate buyers while still stopping automation.
👉 Read our full editorial: Scalping bots expose the enforcement gap in application security
