VGuard Cyber · AI Security

AI Agent Identity & Edge Access Program

Let trusted AI agents in, keep abusive scrapers out. We put verifiable agent identity in front of your site so every agent session is identified, scoped and logged, instead of being blanket-blocked or blindly allowed.

$4,997 one-time

Start the Program — $4,997

Secure checkout by Stripe · We email you after checkout to schedule the kickoff

The problem: your defenses only have two settings

AI agents are now browsing websites on behalf of real people. Some are shopping assistants comparing prices for a buyer who is ready to purchase. Some are research agents pulling documentation for a developer evaluating your product. And some are aggressive scrapers harvesting your content, inventory and pricing at a volume no human ever would.

Most bot defenses were built for a simpler world. They can only make one of two choices: block everything that looks automated, or let it all through. Block everything and you turn away legitimate customer agents — and the buyers behind them — without ever knowing it happened. Let everything through and you absorb the scraping, the credential stuffing and the load spikes that come with it. Neither option is a security policy. Both are guesses.

The root cause is that, to your edge, every agent looks the same. User-agent strings are trivially faked, and IP reputation cannot tell a well-behaved agent from a malicious one on the same network. Without identity, there is nothing to base a decision on.

The solution: agent identity, verified at the edge

The fix is to make agents prove who they are. Under the Web Bot Auth open standard, an agent signs its requests with a cryptographic key and publishes the matching public key, so the site it visits can verify the signature. A valid signature is evidence that the request really came from the agent operator it claims to come from — something a spoofed header can never provide.

Once agents can be identified, your edge security layer can treat them individually: allow the trusted ones, scope what each one can reach, rate-limit the rest, and keep stopping abusive scrapers exactly as it does today. Every decision is logged, so every agent session is attributable to a known identity.

We deliver this with two partner technologies:

Browserbase — the agent identity layer. Verified browsers, cryptographic Web Bot Auth signatures, and identity-governed agent access using scoped, revocable tokens instead of static API keys that leak and never expire.
Your edge security platform — enforcement. Bot and agent management rules, WAF, rate limiting and Zero Trust access policies, configured to check agent identity on every request and act on it.

What’s included

Agent traffic audit — what agent traffic is already hitting your properties, where it is going, and what legitimate traffic your current rules are wrongly blocking
Agent identity policy design — which agents get access to what: public content, product and pricing pages, account areas, checkout, APIs
Web Bot Auth signature verification at the edge — set up so signed agent requests are cryptographically verified before any rule is applied
Allow / deny / scoped rule set — built, staged and tested against real traffic before it goes live, with WAF and rate-limit rules aligned to it
Logging and audit trail — every agent session attributable to an identity, with decisions recorded for your security and compliance teams
Written agent access policy document — a clear policy your security team owns, covering how agents are verified, scoped, reviewed and revoked
30-day tuning window — after go-live we monitor the rules and adjust them as real agent behavior shows up

How it works

Checkout
Pay securely through Stripe.

Kickoff & access
We agree scope and get read access to your edge configuration and logs.

Audit & design
Agent traffic audit, then the identity policy and rule set.

Build, test, go live
Signature verification and rules deployed, then 30 days of tuning.

Who it’s for

Ecommerce, SaaS, travel, financial services and publishing teams that are seeing agent traffic they can neither identify nor safely allow. If you have ever had to choose between blocking an AI shopping or research agent and letting a scraper run, this program is built for you.

Keep it running after the build

New agent platforms appear every month. Managed Agent Identity & Edge Defense ($1,497/month) is the natural continuation of this Program: continuous rule tuning, monthly agent traffic and identity reporting, incident response and quarterly policy review.

Questions

What is Web Bot Auth?

An open standard that lets an automated agent cryptographically sign its HTTP requests so the receiving site can verify which operator sent them. It replaces trust in easily-spoofed headers with a verifiable signature.

Do we need to change edge vendors?

No. We work with the edge security platform you already run and configure its bot and agent management, WAF, rate limiting and Zero Trust features. If your current platform cannot verify agent signatures, the audit will tell you plainly.

What happens to agents that do not sign their requests?

They are handled by your policy: typically rate-limited, challenged or restricted to public content, while known abusive patterns continue to be blocked.

How long does it take?

Most programs run four to six weeks from kickoff to go-live, followed by the 30-day tuning window. Timing depends on the number of properties in scope and access to your edge configuration.