Four hundred percent order growth in two months. Fraud doubled inside the same window. Headless checkout runs ten times faster than screen scraping. Token efficiency up fivefold.
Four numbers. One source. Forter's own marketing desk. No third-party verification. No independent audit. No on-chain data anywhere in a document that was pushed to crypto feeds within hours of publication.
I have read a lot of vendor releases. This one is unusually well built. It hands you exactly enough numbers to feel like evidence and exactly zero of the numbers you would need to price the risk. That is not sloppiness. That is design.
So let's read it the way I read a contract before I wire capital into it. Not what it claims. What it implies. And more importantly โ what it leaves out.
The context you need before the numbers mean anything
Forter is not a payment company. It is a risk decisioning layer that sits between a merchant and an acquirer, historically selling one thing above all else: a chargeback guarantee. You take Forter's approve/decline signal, and if it approves a fraudulent order, Forter eats the loss. That guarantee is the product. The scoring model is the delivery mechanism.
That distinction matters more than anything else in this announcement, and I will come back to it.
What Forter shipped is called the Agentic Commerce Engine, phase two. Three pieces. An orchestration layer that performs headless checkout โ no browser, no rendered page, no human eyes โ and sets conditions on each individual transaction. A detection layer that tries to separate legitimate AI shopping agents from abusive bots. And an AI Activity Dashboard that shows a merchant which agents are transacting on its storefront.
Around it sits a stack of partners. Cequence provides Agent Trust, an identity registry that supports four protocol families. Visa has TAP. Google has AP2. Stripe co-authored ACP. Skyfire runs on programmable money rails. Harbor Insurance emerged from stealth the same day with a seed round to sell the liability layer.
The timing is five weeks before Black Friday.
Now read two phrases in the release very carefully. Phase two is "live for existing customers" โ that is a free feature extension on contracts already signed. It is also "open to interested customers" โ that is the actual new revenue line. One of those is a cost center. The other is a product. Forter put them in the same paragraph and let the headline blur them.
And then the two numbers that actually describe the market rather than the vendor. Twenty-eight percent of merchants are willing to fully open their inventory to agents. Under eleven percent of small merchants are ready at all.
Hold those. Everything else is downstream of them.
The identity gap: you cannot score a forgeable input
Here is the structural flaw at the center of the pitch, and I want to be precise about it because it is not a small thing.
Forter's detection capability is described as distinguishing legitimate AI assistants from fraudulent abuse bots. Mechanically, that is bot detection plus behavioral reputation plus the historical transaction graph from Forter's own network. Device fingerprint, behavioral signals, cross-site correlation. It is a probabilistic judgment rendered on observed behavior.
Now consider the adversarial case that matters: a legitimate agent that has been hijacked. An agent with valid credentials, a valid merchant relationship, a clean history โ and a malicious operator behind it.
That agent behaves identically to a good one. Same headers. Same cadence. Same session shape. There is no behavioral tell, because the behavior is not the compromised part. The credential is.
If-then. If your detection is behavioral inference, then a compromised-but-valid agent is indistinguishable from a healthy one. Therefore the only real defense is cryptographic attestation โ proof at the protocol layer of who is operating this agent and under what mandate. And that layer lives at Cequence, at Visa, at Skyfire. Not at Forter.
This is the crack running through the entire technical narrative. Forter is running a risk model on inputs it cannot verify. The identity is asserted upstream and consumed downstream as though it were ground truth. When the upstream assertion is wrong โ or forged โ the model does not know. It cannot know. It was never given the primitive.
Code doesn't care about your feelings. A probability score computed over unauthenticated metadata is a confidence interval dressed as a decision.
Token efficiency is a metric for the other side of the table
Buried in the claims is the one I find most revealing: token efficiency roughly five times higher on headless protocols versus screen scraping.
Ask who cares about tokens. Merchants do not pay per token. Agent operators do. An autonomous shopping agent running inference at scale has a real cost per task, and a fivefold reduction in token consumption is the difference between a viable margin and a dead one.
So what Forter is actually advertising is not a merchant benefit. It is a routing argument aimed at the agent platforms. Take my merchant's endpoint, it says, because your cost per completed purchase is a fifth of what the alternative costs you.
That exposes a two-sided structure the release never names. The merchants pay the invoice. The agent platforms allocate the traffic. Forter is fighting for default routing priority inside runtimes it does not control, and it is selling that fight to merchants as a fraud product.
This is the same pattern I watched play out in DEX aggregator routing during the 2020 liquidity sprint. The pool that got routed first captured the volume, and the pool that captured the volume could afford to pay for the next integration. The fee was never the point. The default was the point.
Except here Forter does not own the router. It owns a plugin the router may or may not call. And the entities building the routers โ Google, Visa, Stripe โ are also building the identity registries and, in Stripe's case, a competing risk engine.
The guarantee is the balance sheet, and nobody priced it
This is the part of the story I think is genuinely being missed.
Forter's historical differentiator is loss liability transfer. The merchant buys certainty, not a score. That is what separates a guarantee business from a software business, and it changes the accounting entirely.
Now reread the headline claim. Automated fraud doubled in two months.
If agentic fraud losses fall inside the existing guarantee terms, that sentence is not a market observation. It is a claims event. It is a line item on Forter's own loss ratio heading into the highest-volume quarter of the year.
If those losses fall outside the guarantee, then the guarantee โ the entire reason merchants chose Forter over a cheaper scoring vendor โ has a hole in it, and the first enterprise procurement team to notice will ask why they are paying for coverage that excludes the fastest-growing traffic segment on their storefront.
Either branch is bad. The release picks neither. It publishes the fraud number and lets you assume it belongs to somebody else.
And look at what Forter does next. It pushes responsibility outward โ toward Harbor, the insurance layer, and toward the AI providers themselves, which is exactly what the merchant survey says they want. Ninety-three percent of merchants reportedly want AI providers to carry the liability.
Read that as a strategic tell. A company that historically sold risk transfer is now publicly campaigning to relocate risk transfer to a third party. That is not a positioning statement. That is a hedge against its own book.
Yield is the bait, rug is the hook. The bait here is a fraud product. The hook is an underwriting exposure that has not been disclosed, sized, or priced in any document I can find.
The protocol-agnostic claim is an admission, not an advantage
Four protocols. Visa TAP, Google AP2, Stripe's ACP, Skyfire. Forter supports all four and markets that as neutrality.
Strip the marketing. Building an adapter layer across four immature, mutually incompatible standards is not evidence of technical superiority. It is evidence that you could not become the standard. You are paying an integration tax to four parties who each reserve the right to change the specification underneath you.
That tax has a clock on it. The moment one protocol achieves de facto dominance โ and in payments, one always does โ the value of neutrality collapses to zero overnight. Forter's window is not five weeks to Black Friday. It is twelve to twenty-four months, ending whenever a single standard wins.
And the most dangerous counterparty in that race is not Riskified or Signifyd. It is Stripe. Stripe co-authored ACP, which means Stripe writes the specification Forter must adapt to. Stripe also operates Radar, which means Stripe sells the competing product. Standard-setter and competitor in one entity, with the standard-setting power upstream of the competitor.
That is not competition. That is a licensing relationship where the licensor also bids on your contracts.
The same logic applies to Visa and Google. Both control agent identity and payment authorization. If either decides to ship merchant-side risk tooling as a bundled feature, Forter's middle layer does not get outcompeted. It gets absorbed.
Model risk: agent traffic is out-of-distribution by construction
One more technical point that the release treats as a feature when it is actually a warning.
The network data is growing fast. Orders quadrupled in two months. That does feed the model โ more agent traffic, more samples, better behavioral library. Genuine single-sided data effect. I will grant it.
But the training distribution was built on human shopping behavior accumulated over years. Agent traffic is a different generative process. It is faster, more parallel, more deterministic in its sequencing, and it does not get distracted, does not abandon carts for emotional reasons, and does not browse idly.
That is a textbook distribution shift. Every model deployed against agent traffic in Q4 is operating on out-of-distribution input, at peak volume, five weeks after launch, with a portion of the functionality still gated behind "interested customers."
And here is the failure mode that never makes the news. If the model false-declines a legitimate agent, the merchant does not get an outage alert. There is no 500 error. There is no status page update. There is a quiet decline of a purchase that would have completed, a conversion-rate dip that gets attributed to seasonality, and a GMV number that comes in slightly light and nobody can explain why.
Silent failure. No alarm, no incident report, just revenue that never existed. That is the most expensive kind of downtime, because you do not find out until the quarter closes.
Layer a single-point-of-failure architecture on top. The pitch is one no-code integration. That is efficient, and it is also the definition of concentrated operational risk. Every transaction in the merchant's agentic channel routes a decision through one endpoint. One latency spike, one capacity miss at peak, and the storefront stops completing agent purchases entirely.
The release closes with a rhetorical question about whether the system can survive peak season traffic. That is not humility. That is pre-emptive liability framing.
The compliance branch nobody wants to discuss
Forter claims protocol-agnostic support that includes Skyfire. Skyfire settles on programmable money rails.
That single sentence pulls the entire product into a regulatory perimeter the release never acknowledges. Stablecoin settlement rails mean MiCA in Europe, emerging U.S. stablecoin legislation, and Travel Rule obligations on transfer originators and beneficiaries. A merchant-side decision engine that touches those rails inherits data-transfer obligations across jurisdictions, and it inherits them as a re-transmitter of identity data sourced from third-party registries.
Then add the harder wall. Europe's strong customer authentication framework requires multi-factor verification of the cardholder. Agentic shopping, by definition, is a purchase executed by a non-human process. Those two definitions do not reconcile without an explicit delegated-authority exemption that regulators have not written.
No player in this stack wants to say that out loud, because it caps the addressable market in the second-largest e-commerce region on earth. But it is the same ceiling for everyone, and it is completely absent from a release that spends its word budget on Black Friday.
And note the privacy asymmetry. Identifying an agent is not legally the same act as identifying a person. Different lawful basis, different retention rules, different transfer restrictions. If Forter's detection leans on upstream registries for agent identity, it is building a data supply chain it does not own and cannot fully audit.
The contrarian read: that three-layer diagram is a pitch deck
Look at the map the announcement draws. Identity layer, orchestration layer, insurance layer. Cequence, Forter, Harbor. Three complementary partners, each with a seat at the table.
Now notice who is missing from the diagram. Visa. Google. Stripe. The acquirers. The entities that write the specifications, control the identity registries, and settle the funds.
The diagram places Forter at the center of a three-layer stack and quietly removes the four parties that actually hold rule-making power. Accept that map and you accept a framing where Forter is infrastructure. Reject it and you see what it is โ a plugin vendor that has drawn itself into the middle of a picture it did not commission.
That is not a criticism of the diagram's honesty. It is a criticism of its usefulness. You cannot plan against a map that erases the terrain.
The second contrarian point is the ceiling. Everyone is reading four hundred percent growth as a market signal. It is not. It is arithmetic on a tiny base. The signal is the other number: twenty-eight percent of merchants willing to open inventory, eleven percent of small merchants prepared.
Agentic commerce GMV is capped by merchant authorization appetite, not by technology. A merchant that opens twenty-eight percent of its catalog to agents has, by definition, limited the denominator on which a GMV-take-rate pricing model depends. You cannot bill a percentage of transactions that merchants have declined to permit.
And the eleven percent figure is the regulatory fuse. Small merchants are simultaneously the most exposed to agent traffic, the least able to absorb fraud losses, and the least able to negotiate terms. When the first large-scale consumer harm event lands โ a hijacked agent wave, a mass card-testing run through agent endpoints โ the regulatory response will be written to protect exactly that cohort. It will move liability toward the platforms and the AI providers, which helps Forter's disclosure position, and it will arrive with mandatory technical standards and compliance cost, which does not.
What I am actually watching
Forget order growth. It is self-reported, unverified, and computed off a base small enough to make any multiplier look like a trend.
Watch three things instead.
Whether Forter discloses a loss ratio on agentic traffic in its next reporting cycle, and whether agentic fraud sits inside or outside the chargeback guarantee. That single disclosure answers the only question that matters: is this company a software vendor or an underwriter.
Whether the protocol layer converges. The day one of TAP, AP2, or ACP becomes the default, the adapter tax stops being a moat and becomes a stranded cost. Watch which standard Stripe's own merchant base adopts, because Stripe holds both the pen and the competing product.
And whether the delegated-authority question gets answered in Europe. Until someone writes the rule that lets a non-human agent satisfy strong customer authentication, the largest regulated market for this product is closed, and every growth number in the release is a U.S.-only number wearing a global costume.
Panic sells, liquidity buys. Right now the panic is a Black Friday deadline and the liquidity is a seed round. The question worth asking is not whether the engine survives the traffic. It is who signs the loss when the engine is wrong โ and why that signature is not in the document.
