Every API call to the bank, inspected in under a millisecond.

This is a mock retail bank running behind Cloudflare. Below, watch five real attacks — account takeover, data theft, fraud — succeed against an unprotected API, then get stopped cold at the edge. Nothing is simulated: the scores and blocks are Cloudflare's.

Before a single line of bank code runs, the edge has already fingerprinted this request. A bank uses exactly these signals to tell a customer from a bot.

Each maps to a named banking risk. In monitor mode the attack succeeds; in enforce mode the edge blocks it. Same traffic, one switch.

Native features stop the commodity attacks with zero code. For bank-specific decisions, one small Worker fuses three signals into a real-time allow / step-up / block. Move the dials — the decision is computed live by the deployed Worker.

Why this matters to the bank