Akamai • Application security
Akamai Client-side Protection and Compliance addresses PCI-DSS v4.0 requirements 6.4.3 and 11.6.1, monitors third-party JavaScript behavior in the browser, and detects Magecart and skimmer activity that origin-side controls cannot see. The JavaScript sensor injects at the Akamai edge so customers do not ship security tags inside the application.
Merito sells Client-side Protection and Compliance and configures the script inventory, justification workflow, alert routing, and PCI-DSS evidence dashboard that satisfy auditors and protect customers.
What it is
Client-side Protection and Compliance (formerly Page Integrity Manager) monitors third-party JavaScript behavior in the end-user browser. Akamai injects a JavaScript sensor at the edge into pages the customer is already serving through Akamai, so there is no agent on origin and no SDK to ship inside the application. The sensor watches script behavior in real time, runs machine-learning risk assessment on behavioral changes, and emits alerts when scripts behave in ways consistent with skimming, data exfiltration, or unauthorized callouts.
PCI-DSS v4.0 requirements 6.4.3 (script inventory and authorization) and 11.6.1 (script integrity monitoring) became mandatory in March 2025 for in-scope merchants. Akamai built a dedicated compliance dashboard against the requirement language. The dashboard maps directly to the audit evidence the customer's QSA expects. Programs that wait until the audit cycle to address client-side controls find themselves rebuilding script governance under deadline pressure. Merito's standard rollout is compliance-led when the customer has a payment surface and posture-led when the customer does not.
The compliance angle drives the budget. The third-party-script visibility angle drives the long-term value. Customers run analytics, marketing, personalization, A/B testing, chat widgets, and tag-management scripts that are out of PCI scope but capable of exfiltrating data or being compromised by upstream supply-chain attacks. Programs that adopt the product only for PCI miss the chance to monitor the rest of the third-party-script footprint where the next incident is more likely to originate.
Ideal use cases
What it is best at
Akamai injects the JavaScript sensor at the edge for pages the customer is already serving through Akamai. No agent on origin, no SDK to ship inside the application, no security tags developers have to maintain across releases. The deployment is an Akamai property change, not an application change.
The dashboard maps directly to the language of requirements 6.4.3 (script inventory and authorization) and 11.6.1 (script integrity monitoring). Auditors get evidence they recognize without the customer translating between security telemetry and compliance language.
Machine-learning risk scoring on script behavior changes catches Magecart and skimmer activity through behavioral signals (unusual data callouts, fingerprinting, payment-form interception) rather than IOC matching. The detection works against new skimmer variants before signature-based tools update.
The product monitors every script running on protected pages, not only payment-scoped scripts. Analytics, marketing, personalization, A/B testing, chat widgets, and tag-management scripts get the same behavioral monitoring. Customers see the full third-party-script footprint, not only the PCI subset.
Core capabilities
Continuous identification of every script running on protected pages.
Script inventory
Continuous list of every script the protected pages load and execute, including third-party scripts loaded by other third-party scripts (deep dependency chains).
Authorization tracking
Per-script authorization state covering whether the script is approved, who approved it, and whether the approval is current. Drives the PCI 6.4.3 evidence path.
Justification workflow
Customers record written justifications for each script as the requirement language calls for. The justification ties to the script identity, the page scope, and the approval audit trail.
Real-time analysis of script behavior in the end-user browser.
Real-time behavior monitoring
The sensor observes script execution in the browser and reports behavior changes as they happen. Catches script tampering and behavioral drift that origin-side controls cannot see.
Machine-learning risk scoring
Behavioral changes get risk scored against the script's baseline. Anomalies above the threshold produce alerts for security analysts.
Skimmer and Magecart detection
Behavioral signals consistent with skimmer activity (unusual data callouts, fingerprinting, payment-form interception) trigger high-severity alerts. Detection works against new skimmer variants without signature updates.
Evidence and reporting against requirements 6.4.3 and 11.6.1.
Compliance dashboard
Dashboard mapped directly to the language of requirements 6.4.3 and 11.6.1. Drives the customer's PCI-DSS evidence path with what auditors actually expect to see.
Audit evidence export
Evidence packages exported in formats QSAs accept, covering the script inventory, authorization state, integrity monitoring, and incident history.
Continuous attestation
Continuous monitoring of the controls so the customer can attest at any point in the audit cycle, not only at year-end. Reduces the scramble for evidence at audit time.
Where Client-side Protection findings flow into the customer's broader security operations.
Real-time alerting
High-severity behavioral changes produce alerts for the customer's security team within seconds of the behavior occurring in the browser.
SIEM forwarding
Findings forwarded into Splunk, QRadar, Sentinel, and Chronicle for cross-tool detection engineering.
Closed-loop blocking
Pairs with App and API Protector for inline blocking of script callouts to malicious destinations the behavioral analytics flag.
Where it fits in the stack
Deployment and implementation
Licensing and packaging
Client-side Protection and Compliance
Script discovery, behavioral monitoring, PCI-DSS v4.0 compliance dashboard, alerting, and SIEM forwarding.
Best for: E-commerce, financial services, and healthcare programs addressing PCI-DSS v4.0 client-side requirements.
Closed-loop with App and API Protector
Adds inline enforcement at the Akamai edge for malicious script callouts.
Best for: Customers running both products that want enforcement without manual policy authoring.
Merito services
Merito sells licenses and the delivery work around them. Pick the service that matches where you are in the lifecycle.
Sensor configuration, script-inventory baseline, justification-workflow design, and PCI-DSS v4.0 compliance dashboard setup.
Explore service02Runtime program scoping for client-side controls alongside the customer's broader AppSec posture.
Explore service03Named engineer, priority SLAs, and release-window coverage for Client-side Protection and Compliance.
Explore service04Long-term run support including ongoing script-inventory review, behavioral baseline tuning, compliance evidence collection, and alert-routing maintenance.
Explore service05Role-based training for compliance leaders, AppSec engineers, and SOC analysts using Client-side Protection findings.
Explore serviceClient-side Protection licensing
PCI-DSS v4.0 requirements 6.4.3 and 11.6.1 are mandatory. Buy the license through Merito and get the script inventory, justification workflow, compliance dashboard, and alert routing configured to your audit cycle.
Merito point of view
PCI-DSS v4.0 requirements 6.4.3 and 11.6.1 became mandatory in March 2025, and Client-side Protection is the most direct path to addressing them. The compliance dashboard maps directly to the requirement language QSAs work against. Customers that wait until the audit cycle to address client-side controls find themselves rebuilding script governance under deadline pressure. Merito recommends adoption ahead of the next QSA cycle, not during it.
The compliance angle is the budget anchor and the smaller part of the value. The product also monitors every third-party script running on protected pages, including analytics, marketing, personalization, A/B testing, chat widgets, and tag-management scripts. Those scripts are out of PCI scope. They are also where supply-chain compromises tend to enter the customer's pages. Programs that adopt the product only for PCI miss the long-tail value the platform produces.
Edge injection is the right deployment architecture. Origin-instrumented client-side protection forces the customer's developers to ship security tags, which is fragile across releases and creates a coordination cost between security and product engineering. The Akamai edge approach takes the application change off the critical path and lets the security team own the rollout end-to-end.
What buyers usually underestimate
Related from Merito
Related solutions
Related services
Related products
Frequently Asked Questions
Consultation request
Share your payment-page footprint, third-party-script profile, and audit cycle. A Merito Client-side Protection specialist follows up within one business day.
Compliance-led
The compliance dashboard maps to the requirement language QSAs use. Evidence the auditor recognizes without translation.
Edge-injected
Akamai injects the sensor at the edge for pages already served through Akamai. Deployment is an Akamai property change, not an application change.
Next step
A Client-side Protection engagement with Merito starts with the compliance dashboard configured against the customer's QSA. The first month covers PCI scope. The second month expands behavioral monitoring across the full script footprint where the long-term value lives.