Every business has a contact form, and almost nobody thinks about it until it goes wrong: the inbox fills with spam, a bot floods the sales team with fake leads, or a real customer gives up because a puzzle asked them to pick out traffic lights.
We protect our own forms with our own product, and it is live today. Every enquiry that reaches Senua AI through cyber.senuaai.com goes through it, whether someone wants access to our products or a datasheet. Nobody is asked to solve a puzzle. Every visitor gets a reply in about a quarter of a second. Before an enquiry reaches our team, Senua AI Cyber, running on our own systems, has checked it.
That same Cyber deployment watches every visit to cyber.senuaai.com and design.senuaai.com. Here is how it all works, what it costs to run, and how it could protect your forms too.
What is the problem?
A web form is the most exposed thing a business puts online. Anyone can reach it, it accepts whatever is typed into it, and what it accepts lands somewhere trusted: an inbox, a CRM, a database. The peer reviewed research on what actually reaches websites is blunt.
- Every site is found, however small. Xigao Li, Babak Amin Azad, Amir Rahmati and Nick Nikiforakis of Stony Brook University ran 100 websites that existed only to watch who came, and reported what arrived at the IEEE Symposium on Security and Privacy in 2021 [1]. Over seven months those sites received 26.4 million requests from about 287,000 internet addresses: more than 37,000 requests a month for an average site that no person had any reason to visit. Over half of those requests were trying to break into logins, map the site's software or exploit a weakness. More than 86% of the bots claimed to be an ordinary Chrome or Firefox browser.
- Stolen passwords are tried everywhere. Kurt Thomas and colleagues at Google and the University of California, Berkeley counted 1.9 billion usernames and passwords from data breaches being traded by criminals in a single year (ACM Conference on Computer and Communications Security, 2017) [2]. In a separate study, Thomas and colleagues at Google and Stanford University measured 21 million real logins and found that about 1 in 67, or 1.5%, used a username and password that had already been exposed in a breach (USENIX Security Symposium, 2019) [3]. Sign up and sign in forms are where those credentials are tried.
- Puzzles are cheap to beat. The CAPTCHA, the "prove you are human" puzzle, has an industry built to defeat it. Marti Motoyama and colleagues at the University of California, San Diego found services that solve CAPTCHAs for criminals at retail prices as low as $1 per thousand (USENIX Security Symposium, 2010) [4]. Real people, meanwhile, pay in time and patience: Andrew Searles and colleagues had 1,400 people solve 14,000 CAPTCHAs from popular websites and measured that cost (USENIX Security Symposium, 2023) [5].
- Commercial bot protection can be walked around. Babak Amin Azad, Oleksii Starov, Pierre Laperdrix and Nick Nikiforakis tested commercial bot protection services (DIMVA, 2020) [6]. The services stopped simple scripted bots on more than 75% of the websites they protected. But attackers who simply used less common browsers got past the protection on up to 82% of protected websites. The authors' conclusion: the existing services "cannot substantially limit the ability of determined attackers".
The usual answers each cost something. Puzzles push the cost onto real customers and barely slow a determined attacker. Hosted form services keep your enquiries, with names, emails and what each person needs, on someone else's servers, often in another country. Building it yourself usually means stacking up other people's software, every piece of which must be kept up to date and is another way in. And once a request is in, almost nobody checks it again. The email is just a pipe.
What is the solution?
The request forms on cyber.senuaai.com are protected at every step, from the visitor's first keystroke to our team's inbox:
- A key on first touch. When a visitor starts filling in the form, the page quietly gets a single use key from us. It is signed and it expires. A bot that never really visits the page never gets one. There is no puzzle for the visitor to solve.
- One small, trusted program. The form is sent through our website's front door to a single Senua AI program, which refuses anything that did not come through that door.
- Each key works once. The program uses up the key and stores the request safely in the same moment, so a copied or forged key gets nothing. The visitor then has their answer, in about a quarter of a second.
- Checked by Senua AI Cyber. After the visitor has their answer, the request is checked by Senua AI Cyber's Shield against what normal traffic looks like.
- Delivered with its check. The request reaches our team's inbox with Shield's view written into it.
- A confirmation. The visitor gets an email confirming we have their request. It deliberately repeats nothing they typed, so nobody can use our form to send someone else a message.
Nothing is lost along the way. If a request cannot be delivered straight away, it stays safely stored and is retried every fifteen minutes, and our team is alerted. Everything, including where a request is kept while it waits, is in Sydney.
For now, Shield reports and does not block. It will start blocking only when our own tests on real form traffic show it should. A system that decides its own normal, rather than being told it, drifts toward its own mistakes, and we would rather show you a measured result than a guess.
We run it on ourselves first
We did not build this for a blog post. It is how enquiries reach us every day. The checks are made by our own Senua AI Cyber deployment in Sydney. We installed it with the same installer our customers get, and it runs the same products they buy. Beyond the form, it watches all the traffic to cyber.senuaai.com and design.senuaai.com.
For now it watches and records rather than blocks. We will switch blocking on for our own visitors when our own measurements say it is right. That is the same rule we would give any customer.
Using it on ourselves first means the rough edges turn up on our sites, with our enquiries, long before they could reach a customer's. And when we say "talk to us", the form you use to do it is the product.
How did Senua AI help to solve this?
The whole thing is one small program, written entirely in Senua AI's own language, with no third party software inside it. That matters for two reasons.
There is nothing borrowed to go wrong. Most web software is built from hundreds of packages written by other people. Each one has to be kept up to date, and each one can be compromised before it ever reaches you. Ours has none. The secure connections, the email sending and the checks are the same building blocks Senua AI Cyber itself runs on, all written and tested by us.
It is small, so it is fast and cheap. The whole program is 424 KB, smaller than most photos on a web page. It starts in about a fortieth of a second and needs about 20 MB of memory to run.
It also shows how we work. The first version was correct but slow: visitors waited up to eight seconds for a reply. In one day we made three measured changes, and the wait fell to about a quarter of a second:
- Answer first. Store the request safely, reply to the visitor, then do the rest.
- Faster security maths. We sped up the calculations behind every secure connection, five times over. Each change had to give exactly the same answers as the industry's published security test cases before it went live.
- Move it closer. We moved the service from the United States to Sydney, next to the people using it.
Rules, or your own normal?
Almost every form protection on the market runs on rules someone wrote in advance: puzzle scores, firewall signatures, limits on how often someone can submit, lists of banned words, or a bot detector trained on other companies' traffic. Rules catch what someone anticipated, and everything else gets through. They also have to be written, tuned and maintained. Published industry estimates put that upkeep at about $27,000 to $39,000 a year for a managed web firewall [7], plus 30 to 90 minutes of an analyst's time for every false alarm [8].
Senua AI works the other way round. You tell it what normal looks like: a period of your own, real traffic. Shield learns the patterns in it. It sets its own alarm level from normal traffic it has not seen before, rather than having a threshold set by hand. Then it judges each visitor against your normal, not against someone else's list of past attacks. There are no rules to write. When your business changes, with a new form, a new campaign or a new market, you show it the new normal. On a public test set of real web traffic (CSIC 2010), Shield blocks 91.69% of attackers by their third request while wrongly blocking none of 6,000 genuine visitors. The method is published on our benchmarking page [9].
Does it slow anything down?
- For a visitor sending our form: no. The check happens after they have their reply. The whole reply, from Sydney, takes about a quarter of a second.
- When Shield protects a whole website: not noticeably. Each check takes a fraction of a millisecond.
- A puzzle, by contrast, adds an extra download, a call to the puzzle company before the form can be trusted and, when it asks a question, however long a person takes to answer it.
What does it cost to run?
The service itself costs almost nothing to run. We measured what each request actually uses and priced it at Amazon Web Services' published rates for Sydney [10]:
| form requests a month | running cost a month (US dollars) |
|---|---|
| 100 | about $0.66 |
| 1,000 | about $0.99 |
| 10,000 | about $4.33 |
| 1,000,000 | about $372 |
About 62 cents of that is fixed each month, for alerts and housekeeping. Each request adds about four hundredths of a cent, almost all of it spent sending the two emails after the visitor already has their reply. The emails go through the email service the business already pays for.
Unlimited forms, unlimited checks, one fixed price
The protection is the part that usually costs real money, and it is the part that stays flat. Senua AI Cyber's Shield is a fixed monthly price, A$1,799 including GST, for up to 10 websites [11]. Your traffic is never metered. Every form on those sites, every request and every check costs the same: nothing extra. The bill does not jump during an attack, which is exactly when protection priced by traffic costs most. We never charge per email either; only your own email provider's sending limits apply.
How does it compare at enterprise scale?
Take a large organisation with ten public websites, a million form requests a month and, for protecting the whole of each site, 200 million page and API requests a day. Published and reported prices for 2026:
| option | how it is priced | at that scale |
|---|---|---|
| Google reCAPTCHA | per check: 10,000 a month free, $8 flat to 100,000, then $1 per 1,000 [12] | about US$908 a month for the forms alone, and it rises with every bot attempt |
| AWS WAF with Bot Control | per website, per rule and per request [13] | about US$6,000 a month in request fees alone, plus upkeep |
| DataDome | plans priced by traffic volume [15] | Essentials about US$3,830 a month, Advanced about US$8,670 (reported) |
| Cloudflare Bot Management | enterprise extra, quote only [14] | estimated US$60,000 to US$120,000 a year with the enterprise plan (our model from published ranges) |
| Akamai Bot Manager | quote only, bundled with their network [14] [16] | reported US$50,000 to US$250,000 a year |
| Senua AI Cyber Shield | flat, runs on your own servers, traffic never metered [11] | A$1,799 a month including GST, up to 10 sites, plus the small running cost above |
Most of these vendors do not publish prices, so their figures are ranges reported by pricing trackers and buyers [13] to [16]: a guide, not a quote. None of them measures how well any product works. Most also come with the cost of rules: writing them, tuning them and handling their false alarms. With Shield there are none to write.
Can I use it with my existing Cyber subscription?
Yes, if your plan includes Shield. The checking service our form uses is a standard part of Shield, not something built specially for us. Our form simply asks it about each request. The form handler itself is the part we run for our own site. If you want the same in front of yours, talk to us. One honest note: until your own form traffic has been shown to Shield as normal, read its view rather than acting on it, which is exactly how we run ours.
What else can it protect?
Anything that receives requests from the internet can ask the same question before it trusts what arrived. Shield checks web requests today, so these work now:
- Sign in and sign up pages: attacks with stolen passwords, and fake accounts.
- Password resets and single use codes: people probing for accounts or guessing codes.
- APIs: abuse, scraping, and AI agents that behave unlike your normal customers.
- Checkout and payment forms: criminals testing stolen cards.
- Data feeds from partners: a feed that suddenly behaves unlike itself.
Two more we are building towards:
- Incoming email: the same check on a message before it reaches an inbox.
- Data moving between your systems: every record checked as it flows.
Senua AI does all of this with no AI models, no LLMs or SLMs, no GPU, no data centre and no AI token costs, on ordinary computers. Here, that means one small program and one Shield at a flat price.
References
Peer reviewed research
- X. Li, B. Amin Azad, A. Rahmati and N. Nikiforakis, Good bot, bad bot: characterizing automated browsing activity, IEEE Symposium on Security and Privacy (2021).
- K. Thomas et al., Data breaches, phishing, or malware? Understanding the risks of stolen credentials, ACM Conference on Computer and Communications Security (2017).
- K. Thomas et al., Protecting accounts from credential stuffing with password breach alerting, 28th USENIX Security Symposium (2019).
- M. Motoyama, K. Levchenko, C. Kanich, D. McCoy, G. M. Voelker and S. Savage, Re: CAPTCHAs: understanding CAPTCHA solving services in an economic context, 19th USENIX Security Symposium (2010).
- A. Searles, Y. Nakatsuka, E. Ozturk, A. Paverd, G. Tsudik and A. Enkoji, An empirical study and evaluation of modern CAPTCHAs, 32nd USENIX Security Symposium (2023).
- B. Amin Azad, O. Starov, P. Laperdrix and N. Nikiforakis, Web Runner 2049: evaluating third party anti bot services, Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), LNCS 12223 (2020) 135 to 159.
Industry estimates, prices and our own records
- Indusface, managed web firewall operations, blog, as recorded in 2026: the yearly cost of running a managed web firewall.
- Indusface, handling false positives, blog, as recorded in 2026: analyst time per false alarm.
- Senua AI, Cyber benchmarking: Shield on CSIC 2010, with its method.
- Amazon Web Services price list for Asia Pacific (Sydney): Lambda, DynamoDB, CloudWatch and Secrets Manager, read 17 October 2026.
- Senua AI, Cyber pricing.
- Google Cloud, reCAPTCHA billing information, read 17 October 2026.
- WAF Pricing, AWS WAF pricing, as recorded in 2026.
- WAF Pricing, bot management costs, as recorded in 2026.
- Vendr, DataDome pricing, as recorded in 2026.
- Prosopo, enterprise bot protection pricing, as recorded in 2026.