How to test a vendor’s automation claims in a two-week POC
A two-week proof of concept that turns automation claims into numbers: seeded threats, four clocks, hand-off count, false positives, and what the report shows.
Every vendor will say their takedowns are automated. Two weeks and a short list of measurements settle it. This is the test behind our automation comparisons.
Before the test
Agree the scope: which brands, which surfaces, which platforms.
Hand over the same allowlist and letter of authorization to each vendor.
Seed the test with 20 known threats across surfaces, including three gray-area cases (a fan account, a parody, a staff lookalike) and two on slow providers.
What to measure
Measure
How
What good looks like
Time to detect
Timestamp when each seeded threat appears in the vendor’s dashboard
Hours, not days, on web; same day on social
Time to block
When the seeded site shows a warning in a wallet or browser
Minutes to a few hours
Time to file
Timestamp of the filing, by route
Minutes after confirmation, through API or integration
Time to takedown
Verified removal
Varies by provider; compare the slow-provider cases
Hand-offs
How many of the 20 waited for a person, and which
Only the gray-area cases
False positives
Any action against an allowlisted or legitimate asset
Zero
Report quality
Does the report show the cases still live, with status and timestamps
Yes
ChainPatrol’s answers
Blocking in about 5–10 minutes in wallets and 1–3 hours in browsers for confirmed sites; filing through direct APIs and automated routes; the three gray-area cases go to review, while confirmed, high-confidence cases are filed without waiting for a person once your letter of authorization is on file; every case shows its timestamps and status, including still live. See speed, escalation and reporting.
After the test
Score each vendor on the table, weight the rows by your threat mix, and read the still-live list in each report. The vendor that explains its open cases is the one you’ll be able to hold to account. See how to measure automation in a POC for the metric definitions.
Every vendor will say their takedowns are automated. Two weeks and a short list of measurements settle it. This is the test behind our automation comparisons.
Before the test
Agree the scope: which brands, which surfaces, which platforms.
Hand over the same allowlist and letter of authorization to each vendor.
Seed the test with 20 known threats across surfaces, including three gray-area cases (a fan account, a parody, a staff lookalike) and two on slow providers.
What to measure
Measure
How
What good looks like
Time to detect
Timestamp when each seeded threat appears in the vendor’s dashboard
Hours, not days, on web; same day on social
Time to block
When the seeded site shows a warning in a wallet or browser
Minutes to a few hours
Time to file
Timestamp of the filing, by route
Minutes after confirmation, through API or integration
Time to takedown
Verified removal
Varies by provider; compare the slow-provider cases
Hand-offs
How many of the 20 waited for a person, and which
Only the gray-area cases
False positives
Any action against an allowlisted or legitimate asset
Zero
Report quality
Does the report show the cases still live, with status and timestamps
Yes
ChainPatrol’s answers
Blocking in about 5–10 minutes in wallets and 1–3 hours in browsers for confirmed sites; filing through direct APIs and automated routes; the three gray-area cases go to review, while confirmed, high-confidence cases are filed without waiting for a person once your letter of authorization is on file; every case shows its timestamps and status, including still live. See speed, escalation and reporting.
After the test
Score each vendor on the table, weight the rows by your threat mix, and read the still-live list in each report. The vendor that explains its open cases is the one you’ll be able to hold to account. See how to measure automation in a POC for the metric definitions.
What ZeroFox and ChainPatrol automate in takedowns: filing routes, registrar integrations, blocking, approvals, follow-up and what reaches people. With sources.
Netcraft cites a 33-minute median phishing takedown. What that clock measures, which cases it covers, and how ChainPatrol’s three clocks compare. With sources.
