Cleafy Advanced Threat Detection & Protection

Modern cybersecurity in the “post-perimeter” era has become increasingly asymmetrical: online services face an expanding attack surface as audiences broaden beyond trusted partners, while attackers can succeed by exploiting a single unpatched weakness. This problem is especially acute for B2C services, where transactions originate from unmanaged, potentially compromised customer devices. Unlike enterprise environments, these services cannot feasibly mandate centrally managed endpoints, EDR tooling, or strict posture controls without prohibitive cost, operational burden, regulatory complications, and major customer attrition. Traditional server-side protections such as rules-based Web Application Firewalls are described as insufficiently flexible, hard to maintain, and blind to endpoint-side activity, limiting detection of credential hijacking, transaction tampering, and other client-side threats; banking has partially addressed this gap through fraud technologies driven by regulation, and other industries are pressured to follow.

Cleafy, founded in 2014 by engineers from Politecnico di Milano and part of the Moviri Group since 2017, positions itself as a unified threat detection and protection platform for financial and e-commerce institutions. It combines endpoint-style signals with online fraud detection, but avoids signature- or behavior-based anti-malware approaches in favor of patented, clientless, application-independent, passive transaction monitoring and risk assessment. Deployed out-of-band and integrated with common delivery infrastructure (e.g., Citrix, F5, Microsoft, NGINX, Kong), it transparently injects a small JavaScript block into pages to create an obfuscated polymorphic sandbox that dynamically encrypts content, detects page manipulation attempts, and sends evidence asynchronously for analysis. Multiple engines correlate indicators (including ML-based behavior analytics and threat intelligence) across sessions, maintain device profiles, generate detailed risk-scored tags for downstream fraud/auth systems, and integrate via APIs/webhooks into SIEM and incident workflows. The portfolio includes DETECT, PROTECT, MOBILE, ASK, and SaaS, with plans to repackage offerings by industry segment.

• Cleafy was founded in 2014 by engineers from Politecnico di Milano.
• Cleafy became part of the Moviri Group in 2017.
• Cleafy has offices in Milan and Boston, Massachusetts.
• Cleafy serves over forty large banks and payment service providers.
• Cleafy reports a 100% license renewal rate.
• Cleafy’s largest deployment protects 50 million users across 9 countries in the EMEA region.
• The platform can be deployed on-premises, in a cloud environment, or in a container platform.
• Integration support includes Citrix, F5 Networks, Microsoft, NGINX, and Kong.
• The web protection approach relies on transparently injecting a small block of JavaScript into each page.
• The portfolio listed includes Cleafy DETECT, Cleafy PROTECT, Cleafy MOBILE, Cleafy ASK, and Cleafy SaaS.

• “Hackers however only need to invest in a single unpatched exploit to achieve their goals.”
• “The traditional approach towards protecting web applications using rules-based Web Application Firewalls and similar solutions has already proven to be insufficiently flexible and difficult to maintain.”
• “The primary design goal for Cleafy’s application security platform was to offer a clientless, passive and transparent solution that does not require any modifications to existing applications nor relies on any software to be deployed to customer endpoints.”
• “In fact, it does not even need to operate inline in front of an application like traditional Web Application Firewalls or security gateways.”
• “This does not only make pages resilient to manipulations on the fly … but it also ensures that every attempt to modify the page code will be detected, identified and asynchronously (thus not impacting the user experience) sent back to the platform through a side channel for detailed analysis.”
• “Since the code does not look for any known malicious patterns in pages nor is it tailored to any specific page format, the technology is completely application-independent.”
• “Cleafy real-time risk engine analyzes all indicators of compromise, identifying known attack patterns and analyzing the unknown ones according to various threat models.”
• “By correlating data across different channels in parallel, Cleafy can detect advanced attacks that, for example, steal one-time passwords from users or rely on remote desktop sessions to avoid detection.”
• “Notably, the tags generated by Cleafy do not simply indicate general alerts … but in fact, provide details specific for a particular application or domain.”
• “A conscious design choice was made not to incorporate any built-in mitigation functionality … since most enterprise customers usually already have necessary procedures and capabilities in place…”