Coverage by layer
Each row is a layer of your store, from the shopper's browser to your server. Shaded cells show coverage.
-
Shopper's browser
Skimmer scripts on the payment page (PCI DSS 6.4.3 and 11.6.1).
-
CDN and edge
Bots: card testing, credential stuffing, scraping, scalping.
-
Magento application
Exploits for Magento and extension vulnerabilities.
-
Server files and database
Backdoors, malicious extensions and hidden skimmers.
Netacea customers and research
Netacea sells "bot and agent trust management" to four industries: retail, media and streaming, telecoms, and travel. Half of its 16 case studies are retailers. The rest cover streaming, publishing, telecom, gaming, fintech and betting. All 16 are about bots: scraping, credential stuffing, account takeover and scalping.
Its research covers bots and fraud. It has published nothing on Magento, Shopware or WooCommerce vulnerabilities.
Sansec has worked only on online stores since 2015. Our recent research includes SessionReaper, PolyShell and StyleSmuggler, three critical Magento vulnerabilities exploited against live stores.
Attacks outside bot management
Netacea's ecommerce guide separates the two:
Unlike typical security concerns like Magecart attacks, cross-site scripting or malware, bots don't exploit your codebase.
The same guide calls your payment page "the perfect place for criminals to test out batches of stolen" cards. Netacea blocks those tests. It does not detect the skimmer that steals your own customers' cards.
In a typical breach, an attacker exploits a vulnerability in Magento or an extension, uploads a backdoor and adds a skimmer to the checkout code or database. Netacea has no WAF, does not scan files or databases, and runs no code in the browser, where PCI DSS 6.4.3 and 11.6.1 need script monitoring (source).
Sansec covers each step. Shield blocks exploits inside Magento. eComscan finds backdoors and skimmers on the server. Watch monitors checkout scripts. Shield protected stores against SessionReaper 21 days before Adobe's patch, PolyShell four months before and StyleSmuggler two days before (timelines).
Use cases for Netacea
Forrester rated Netacea a Strong Performer in its Bot and Agent Trust Management Wave, Q2 2026. If bots cost your store money, Netacea blocks scalpers, scrapers, credential stuffing and card testing, plus bots that hoard stock in carts, enter raffles with fake accounts or guess gift card codes.
Sansec does not sell bot management. Against card testing on Magento, add a CAPTCHA to the final payment step.
Deployment on Magento
Netacea runs at the edge: Cloudflare, Akamai, AWS CloudFront, Fastly, F5 or its own proxy (integrations). Netacea calls this server-side, though it never reads your Magento server. Its only Magento connector is a Fastly module for Adobe Commerce Cloud. Installing it needs a support ticket to enable two Fastly settings that "cannot be added manually". Its documentation lists no Shopware or WooCommerce connector.
Sansec runs inside the store: eComscan on the server, Shield as a Composer module in Magento, Watch through Magento's CSP module. Shield and eComscan also run on Adobe Commerce Cloud.
Price and contract
Netacea does not publish prices. Its AWS Marketplace listing sells 12 to 36 month contracts, sized per customer. Sansec publishes its prices, from €249 per month for eComscan and Shield. Watch is free.
Running both products
Netacea and Sansec protect different layers, so a store can run both. If you start with one, compare the damage. Bots cost stock, server capacity and chargebacks. A skimmer copies the card of every paying customer until someone removes it. The breach usually ends in a PCI forensic investigation.
Side by side
| Feature | Sansec | Netacea |
|---|---|---|
| Focus | Sansec Online stores only, since 2015 | Netacea Bots and AI agents, for retail, media, telecom and travel |
| Products | Sansec eComscan, Shield, Watch | Netacea Bot Protection, Threat Intel Center, Threat Intel Feeds |
| Where it runs | Sansec Your server, Magento and checkout | Netacea Your CDN or Netacea's proxy |
| Vulnerability research | Sansec Magento, Shopware, WooCommerce and others | Netacea None published |
| Store platforms | Sansec Magento, Adobe Commerce, Shopware, WooCommerce, Sylius, PrestaShop, OpenCart | Netacea Any site behind a supported CDN |
| Incident cleanup | Sansec Included with annual Advanced and Enterprise plans | Netacea No |
| Pricing | Sansec Published, from €249 per month | Netacea Not published, 12 to 36 month contracts |
| Headquarters | Sansec Utrecht, Netherlands | Netacea Manchester, United Kingdom |
Questions
Does Netacea protect against Magecart?
No. Netacea detects bots. It does not scan for skimmers or monitor checkout scripts, and its own ecommerce guide puts Magecart outside bot protection.
Is Netacea a WAF?
No. Netacea adds bot detection to your existing CDN or WAF and has no rules for Magento vulnerabilities. Sansec Shield is a WAF for Magento.
Does Sansec block bots?
Sansec does not sell bot management. Shield blocks Magento exploits, whether a bot or a person sends them. Against card testing, add a CAPTCHA to the payment step.
Does Netacea help with PCI DSS 6.4.3 and 11.6.1?
No. Both need script monitoring in the shopper's browser, and Netacea runs no code there. Sansec Watch covers both for free.
Netacea calls itself server-side. Does it scan my server?
No. Server-side means Netacea analyses requests at your CDN instead of in the browser. It does not read your files, database or processes. eComscan does.
Can I run Netacea and Sansec together?
Yes. Netacea runs at your CDN. Sansec runs in Magento, on your server and in your checkout.
Scan your store for known malware or vulnerabilities (Linux & Mac)
$ curl https://ecomscan.com | sh
eComscan is free to use. We are obsessive about data privacy.
Paid plans include detailed reporting and troubleshooting guides.
Or prefer manual instructions?
