AegisWall
AegisWall sits in front of the website and checks every request against the business's rules.
Rules like these
“A refund can't be more than what was paid.”
“Nobody approves their own request.”
These rules are learned, not a fixed list of known attack patterns.
Tested examples
A 900 SAR refund on a 300 SAR order
BlockedA normal 200 SAR refund
AllowedSomeone approves their own request
BlockedA different person approves the request
Allowed
Clear, careful and on the record
A clear reason for every block
When it blocks a request, it says which rule was broken. Some blocks, like opening a protected page without logging in, also explain in Arabic.
Optional fake success for attack bots
When it is switched on, flagged attack bots get fake success, so they waste their time on answers that aren't real. It is off by default.
Tested first, then a human approves
Before any new rule goes live, it is replayed against the attack it was written for, plus normal requests, to make sure it works and doesn't hurt real customers. Then a named person approves it. Nothing switches on by itself.
Proof for every decision
Every decision is saved as proof that can be checked later and can't be secretly edited.