DataDome's Segura calls its 8.9% Muse endpoint figure a measure of exposure

A request log records that a URL was fetched. According to Let's Data Science (LDS), a request by itself can't show a retailer whether the agent loaded a page, tried a transaction, finished a purchase or caused harm ^[9]. DataDome's VP of Threat Research, Jérôme Segura, gave written answers to LDS on exactly this point ^[13]. "On its own, a request to a sensitive endpoint shows that an agent reached it, not what it did. Our 8.9% figure measures that exposure, not confirmed abuse," Segura said ^[1].

The 8.9% bucket is defined by where a request landed: forms, login, payment, account-creation or cart ^[2]. Abuse needs more. As LDS summarizes his answer, evidence of abuse takes additional signals, such as repeated submissions or high failure rates, set against the business's own definition of acceptable behavior ^[8]. In our view, a rule that fires on "agent plus checkout URL" acts on exposure alone. LDS adds that the endpoint mix does not show whether a session was authenticated, and that it could not use the percentages to estimate how many agents submitted forms, bought products or attempted fraud ^[10].

The growth figures have the same transfer problem. The report's rounded 4.7-fold rise holds up: 58.2 divided by 12.5 is 4.66 ^[14]. But these are request counts, not counts of people, successful tasks or purchases ^[12]. Segura said the customer base stayed generally unchanged, with most industries represented and some more heavily than others ^[6]. LDS notes that DataDome has published no comparison of the same sites measured by the same detection method, and that an individual business cannot assume its own traffic grew at the same rate ^[7].

For DataDome's quarterly rise to describe your traffic, your industry mix would have to resemble DataDome's customer mix. The detector would also have to have behaved the same way in both quarters. Neither condition is documented.

Attribution is the other open input. DataDome identifies Muse by fingerprinting, on the client side, artifacts tied to the cloud browser it uses; it does not go by the network addresses those requests share ^[19]. Its answers gave no error rate for that attribution and no independent data set to check it against ^[20]. DataDome also corrected its release to describe nine days of September availability, not eight ^[18]. The sample denominator and selection method were not supplied in the answers ^[17].