SecurityMetrics vs Proteside: scan the page from outside, or check every payment?
By Laís Peixoto
Growth Marketer, Proteside
Published
SecurityMetrics Shopping Cart Monitor scans your payment page from outside at intervals and files the evidence for requirements 6.4.3 and 11.6.1 in the PCI portal where you complete your SAQ. Proteside runs in the page, in every shopper session, checks that the QR code, account details or wallet address shown match what you issued, and blocks a swap before confirmation.
Side by side
- How it describes itself
- Payment page monitoring for requirements 6.4.3 and 11.6.1 (Shopping Cart Monitor), from a company that operates as a QSA, ASV and PFI; Shopping Cart Inspect is its human-led forensic inspection.
- Headquarters
- Orem, Utah, United States. Founded in 2000.
- How it enters the site
- No code on your site: an external system simulates the checkout at intervals, with scans run manually or on an automatic schedule depending on configuration. Version 2.0 released in March 2025.
- What it checks on the payment page
- Inventory of static and dynamic scripts with justification, content and header changes, 24/7 alerts and an exportable log for the assessor.
- PCI DSS
- Requirements 6.4.3 and 11.6.1, integrated with the SecurityMetrics PCI portal (SAQ questionnaire and ASV scans).
SecurityMetrics Shopping Cart Monitor
- How it describes itself
- Cybersecurity layer for the moment of payment: integrity of what the buyer sees, copies and confirms.
- Headquarters
- São Paulo, Brazil. Operating since 2026.
- How it enters the site
- One line of code on the payment page, or an integration in the platform or payment provider template. No proxy, no DNS or CDN change.
- What it checks on the payment page
- Third-party scripts, card form, Pix QR code and key, boleto (Brazilian bank slip) line, crypto wallet address and the QR codes of eight instant payment rails, matched against what the merchant issued.
- PCI DSS
- Evidence for PCI DSS requirements 6.4.3 and 11.6.1, with an exportable report for the QSA.
Proteside
Criterion by criterion
Marks are based on each vendor's public documentation. Hover over or tap a mark to read the legend.
| SecurityMetrics | Proteside | |
|---|---|---|
| What is checked on the payer's screen | ||
| Inventory and authorization of scripts on the payment pageThe basis of requirement 6.4.3: know what runs on the page and authorize each script. | Described in public documentation | Described in public documentation |
| Card details typed into the formStop a script from copying the number, expiry date and security code. | Described with a limitation (optional, sampled, requires human action or only in one product tier)1 | Described in public documentation |
| Pix QR code and copy-and-paste code (Brazil)Brazil's most common checkout scam: the QR code shown leads to another account. | Not found in public information | Described in public documentation |
| Boleto (Brazilian bank slip) payment lineA swapped line pays a different payee for the same amount. | Not found in public information | Described in public documentation |
| QR codes of instant payment rails worldwide (UPI, PayNow, DuitNow, PromptPay, QR Ph, FPS, CoDi, Transferencias 3.0)The same swap as Pix, across eight instant payment systems. | Not found in public information | Described in public documentation |
| Stablecoin and crypto wallet address, including when copiedA wallet address swapped on screen or in the clipboard is irreversible. | Not found in public information | Described in public documentation |
| Matches what is on screen against what the merchant issued and blocks the swap before confirmationThe check that defines payment integrity: payee and amount equal to what was issued. | Not found in public information | Described in public documentation |
| How it protects | ||
| Blocks unauthorized scripts in the buyer's browserDetecting after the fact does not bring the copied data back. | The vendor states it does not do this2 | Described in public documentation |
| Watches real buyer sessionsTargeted scams do not show up in simulated visits. | The vendor states it does not do this3 | Described in public documentation |
| Works without changing CDN, DNS or proxyDrops into any platform with one line of code. | Described in public documentation | Described in public documentation |
| PCI DSS compliance | ||
| Evidence for PCI DSS requirement 6.4.3Inventory, authorization and integrity of scripts. | Described in public documentation | Described in public documentation |
| Evidence for PCI DSS requirement 11.6.1Unauthorized changes to the page and its headers. | Described in public documentation | Described in public documentation |
| Exportable report for the assessor (QSA)Evidence has to leave the dashboard and reach the assessment. | Described in public documentation | Described in public documentation |
- Described in public documentation
- Described with a limitation (optional, sampled, requires human action or only in one product tier)
- Not found in public information
- The vendor states it does not do this
Notes on the marks
- 1Card details typed into the form: The public material describes script and change detection based on simulated visits to the checkout; it does not describe any action inside the shopper's browser while card details are being typed.
- 2Blocks unauthorized scripts in the buyer's browser: SecurityMetrics writes that Shopping Cart Monitor was built for detection, not prevention, and lists CSP and script blocking as outside the product.
- 3Watches real buyer sessions: The tool is described as agentless: an external system simulates the checkout at intervals. By its own description it does not follow each real shopper's session.
Where SecurityMetrics stands out
The vendor is itself an assessor
SecurityMetrics operates as a QSA, ASV and PFI. The monitor comes from a company that audits merchants, runs vulnerability scans and investigates card breaches for a living.
Evidence lives next to the questionnaire
Shopping Cart Monitor logs sit alongside the SAQ and ASV scans in one portal, which keeps the paperwork in one place for merchants already assessed there.
Forensic inspection on request
Shopping Cart Inspect adds a specialist review of the cart when a compromise is suspected, something few monitoring tools pair with their product.
Nothing to install
The agentless approach suits merchants who cannot add code to the payment page, including stores on locked-down platforms.
What Proteside checks that the SecurityMetrics material does not mention
A furniture store in Bengaluru shows a UPI QR code for a 48,000 rupee order. The shopper scans it with her banking app and pays in seconds. A compromised review widget replaced the QR code with one that carries the same amount and a different payee, but only for shoppers arriving from a particular ad campaign. The money is gone, the order never settles, and the store hears about it two days later. An external scan that visited the page at 3 a.m. saw a perfectly normal QR code, because the swap never ran in that visit.
SecurityMetrics is clear about what it delivers: a script inventory with justification, content and header change detection, alerts and an exportable log for the assessor, all gathered from outside at intervals. For UPI, PromptPay, PayNow, DuitNow, FPS, Brazil's Pix and bank slip (boleto), and stablecoin wallets, the public documentation does not describe checking what the shopper actually sees. Proteside records what your server issued (QR payload, account identifier, wallet address, amount) and compares it with what is displayed and copied in every session. If they differ, confirmation is blocked and the attempt becomes an alert and a piece of evidence.
Card form fields and third-party scripts are covered by the same installation, with the inventory and change history that requirements 6.4.3 and 11.6.1 call for. One line of code produces the assessor's evidence and protects the payment itself, including for the shopper who arrives between two scans.
How each one enters your operation
SecurityMetrics
- Register your payment pages in the SecurityMetrics PCI portal; no code on the site.
- An external scan simulates the checkout, triggered manually or on an automatic schedule depending on the configuration you hold.
- 24/7 alerts, a justification for each script and an exportable log, in the same portal as the SAQ and ASV scans.
Proteside
- One line of code on the payment page, on any platform, or a single integration in the platform's or payment provider's template.
- Checks in every real session, from the first shopper of the day to the last, with no gap between visits.
- Automatic blocking before confirmation; dashboard, API and alerts by email, Slack, Teams and webhook.
When to choose each one
SecurityMetrics makes sense when
- Your PCI DSS assessment already runs through SecurityMetrics and you want the 6.4.3 and 11.6.1 evidence inside the same portal.
- You cannot add any code to the payment page and detection with human review is acceptable.
- You want a forensic team on call to investigate a suspected cart compromise, beyond the monitor itself.
Proteside makes sense when
- You accept UPI, PromptPay, PayNow, DuitNow, FPS, Pix, boleto or stablecoins and need to verify what the shopper sees.
- A payee swap or a card copy has to be blocked in the session where it happens, not reported after the next scan.
- You want protection and 6.4.3 and 11.6.1 evidence in a single installation, independent of any assessor's portal.
Both together
A merchant who completes the SAQ and runs ASV scans with SecurityMetrics can keep Shopping Cart Monitor as external evidence and add Proteside on the page to verify each payment and block swaps in real sessions. The external monitor keeps seeing the page from outside, and Proteside leaves legitimate payments untouched.
Frequently asked questions
Does SecurityMetrics cover Pix, boleto or QR codes?
Not in the public information reviewed in October 2026. The Shopping Cart Monitor material describes scripts, content and header changes on the payment page, with card data as the focus.
Can SecurityMetrics and Proteside be used together?
Yes. Shopping Cart Monitor watches the page from outside and needs no code; Proteside is a script on the page itself. Neither interferes with the other, so a merchant can keep the evidence in the SecurityMetrics portal while Proteside blocks swaps in every session.
What does SecurityMetrics mean by built for detection, not prevention?
Those are the company's own words for Shopping Cart Monitor: it identifies new scripts and changes and alerts the merchant; stopping a script while the shopper is on the page is outside what the product sets out to do. Blocking in real sessions is what Proteside adds.
Do interval scans satisfy requirements 6.4.3 and 11.6.1?
According to its public documentation, SecurityMetrics delivers an inventory with justification, change detection and a log for the assessor, which is what the two requirements ask for. The difference lies between scans: Proteside follows every shopper, so an attack aimed at a single session shows up as well.
Does Proteside produce the kind of evidence a QSA expects?
Proteside exports the script inventory, authorizations and the change history of the page and its headers as a report for the QSA. It does not replace the assessment itself, which stays with the assessor you choose, SecurityMetrics included.
See Proteside checking your checkout
Fourteen days free, one line of code, every payment method on your page.