Cleafy

Cleafy is a Milan-based web and mobile application security vendor founded in 2014 by engineers from Politecnico di Milano, focused on security and fraud prevention for banks and other financial institutions. Its technology is used by major corporate and retail banks and protects over 10 million users. In 2017, Cleafy joined the Moviri Group, which—together with Cleafy’s expanding partner network across Europe, Asia-Pacific, and Latin America—is expected to accelerate global market reach. The company has also formed partnerships with vendors such as Microsoft, Citrix, Splunk, and RSA, including plans for a Microsoft Azure–based SaaS offering aimed at small and medium businesses.

Cleafy positions its platform as a unified threat detection and protection solution that blends endpoint detection concepts with traditional online fraud detection, while targeting regulatory and compliance demands in finance and e-commerce. Driven by digital transformation, online services have become high-value targets, and regulations like PSD2 require not only detecting signs of malware affecting transactions but also feeding that risk into adaptive authentication for step-up controls. Cleafy addresses this by providing passive, application-independent transaction monitoring and risk scoring that integrates into existing infrastructure without backend changes and with only minimal mobile app changes.

For web apps, Cleafy injects a small obfuscated JavaScript into monitored pages to validate DOM integrity and detect manipulation of dynamic API calls. For mobile, it provides a passive SDK enabling device/app integrity checks and transaction integrity, with broader capability on Android due to iOS restrictions. The on-prem engine runs on Linux with clustering and retention-based storage, analyzes real-time transaction telemetry, correlates across channels, maintains stateful device profiles, and feeds risk scores into anti-fraud, adaptive authentication, SIEM, and incident workflows. Key challenges include a narrow financial focus, limited out-of-the-box integrations, and historically limited SMB readiness pending SaaS.

• Cleafy is headquartered in Milan, Italy.
• The company was founded in 2014 by engineers from Politecnico di Milano.
• Cleafy technology protects over 10 million users.
• In 2017, Cleafy became part of the Moviri Group.
• Cleafy has technology partnerships including Microsoft, Citrix, Splunk, and RSA.
• PSD2 mandates that service providers check financial transactions for signs of malware infection and report them to adaptive authentication systems for strong authentication on risky transactions.
• Web monitoring uses an obfuscated JavaScript fragment injected into monitored pages to perform integrity validation of the DOM and detect manipulation of dynamic API calls.
• Mobile protection uses a passive SDK requiring minimal integration to enable device and application integrity checks and transaction integrity functionality.
• The Cleafy Engine is typically deployed on-premises in a customer data center as a Linux software package and supports clustering.
• Cleafy DETECT is the passive detection module, while Cleafy PROTECT provides active protection for web applications using a browser-based JavaScript execution container with server-side encryption and in-container decryption.

• “Cleafy offers a single integrated solution to address all these challenges.”
• “Perhaps the biggest challenge for Cleafy is its narrow focus on financial customers.”
• “A traditional approach towards malware detection on endpoints is to deploy centrally-managed antivirus agents on each user’s device.”
• “Therefore, the initial goal of Cleafy’s founders was to develop a solution that was fully agentless and thus has no impact on device performance or user experience.”
• “For web applications, a small obfuscated JavaScript code fragment is automatically injected into all monitored pages sent to clients.”
• “Cleafy real-time risk engine analyzes all indicators of compromise, identifying known attack patterns and analyzing the unknown ones according to various threat models.”
• “By correlating data across different channels in parallel, Cleafy can detect advanced attacks…”
• “For each transaction, a risk score is calculated using all available context information.”
• “A conscious design choice was made not to incorporate any built-in mitigation functionality…”
• “Cleafy introduces a quite unique and unorthodox approach towards threat detection and anti-fraud protection for financial service providers.”