Auto Escalation

Auto-escalation is the Pro feature that triggers Panic Freeze automatically when an attack spreads across multiple device fingerprints faster than per-fingerprint lockouts can contain it. It’s the answer to distributed botnet attacks: when one bot trips a lockout, the next bot in the rotation just takes over. Auto-escalation watches for that pattern and freezes the entire checkout until you can intervene.

---

How It Works #

Every time velocity detection newly locks out a fingerprint, auto-escalation records it in a counter of distinct fingerprints over a sliding window. When the counter reaches the trigger threshold, Panic Freeze activates automatically.

Value	Fixed at
Trigger threshold	3 distinct fingerprints
Window	10 minutes
Panic Freeze duration	15 minutes

So: if 3 different fingerprints trip velocity lockouts within any 10-minute span, auto-escalation fires. That’s a strong signal of a distributed attack, since legitimate traffic rarely produces 3 separate devices hitting decline thresholds at once.

---

The Geo-Diversity Safeguard #

Before firing, auto-escalation runs the geo-diversity safeguard to check whether the pattern looks like an attack rather than legitimate viral or flash-sale traffic. See Geo-Diversity Safeguard (Pro) for the full logic. In summary: if the locked-out fingerprints come from 3 or more countries with no single country accounting for more than half, the safeguard blocks the escalation.

This prevents the worst-case failure: auto-freezing the store on Black Friday because a viral hit spiked decline counts naturally.

---

What Happens When It Fires #

1. Panic Freeze activates for 15 minutes
2. The TrustLens Dashboard alert band, the header status chip, and the Card-Testing Defense page show the freeze — the same display as a manual freeze
3. The trustlens/card_testing/auto_escalated action fires, and an auto_escalated email and/or Slack alert is sent if Pro card-testing alerts are configured
4. The freeze can be deactivated manually like any Panic Freeze

TrustLens doesn’t keep a separate log of escalations; the alert and the action are the record.

---

Tuning the Threshold #

The trigger threshold, the window, the freeze duration, and the safeguard’s limits are fixed in this version — there are no settings or filters for them. The 3-fingerprint, 10-minute default is conservative: it triggers on relatively small distributed attacks.

You can shape what reaches auto-escalation in other ways:

• Velocity thresholds decide when an individual fingerprint is locked out, and therefore counted. Lowering them makes escalation more likely during an attack.
• Allowlists keep QA devices, partners, and other known-good traffic out of the count entirely.
• The Browser Challenge stops attackers who rotate identity on every attempt — the pattern that never trips a per-fingerprint lockout and so never reaches auto-escalation.

---

Configuration #

There is no Auto-Escalation section or switch. Auto-escalation runs whenever all of these are true:

Requirement	Where
Pro license active	Your TrustLens account
Card-Testing Defense enabled	TrustLens → Card-Testing Defense → Detection Settings

The geo-diversity safeguard is part of auto-escalation and can’t be turned off separately.

---

When Auto-Escalation Won’t Fire #

Even with Pro and Card-Testing Defense on, the system won’t fire if:

• Geo-diversity safeguard determines the pattern looks legitimate
• Fewer than 3 fingerprints have been locked out within 10 minutes
• Panic Freeze is already active (no duplicate freezes)
• The attacking traffic is allowlisted, or comes from users who can manage WooCommerce — neither reaches the velocity rule
• Each attempt comes from a fresh identity that never accumulates enough declines to be locked out

---

Alerting #

The auto_escalated event sends an email and/or a Slack Incoming Webhook message when those are configured. The alert includes:

• The event name (auto_escalated)
• The freeze duration in seconds
• The number of distinct attacking fingerprints in the window

There is no settings screen for card-testing alerts in this version: they use the trustlens_card_testing_alert_email and trustlens_card_testing_alert_slack_webhook options, which a developer can set (for example with WP-CLI). Alerts are sent in the background a moment after the event, so they never slow down checkout.

This is one of the highest-priority alerts the system produces — if you’re going to wake up for any TrustLens event, this is the one.

---

After the Escalation #

Use the freeze time to:

1. Review the 24-hour intelligence card — the contributing fingerprints, decline codes, and hourly chart
2. Check whether the attack continues after the freeze lifts (often it shifts to a different vector)
3. Consider tightening per-fingerprint velocity thresholds if the attack used the slow-paced pattern
4. Document the attack pattern for post-incident review

Auto-escalation is reactive, not preventive. If you’re seeing repeated auto-escalations, the underlying attack pattern is recurring — adjust the per-fingerprint defenses and consider the Browser Challenge to catch attacks earlier rather than waiting for the distributed signal.

---

Auto-Escalation vs Manual Panic #

Both result in the same Panic Freeze state. The differences:

Aspect	Manual Panic	Auto-Escalation
Trigger	Admin clicks Engage	System detects distributed attack
Reaction time	Depends on admin presence	Within seconds of pattern detection
Duration	5, 15, or 30 minutes	15 minutes
Action and alert	trustlens/panic_button_activated / panic_activated	trustlens/card_testing/auto_escalated / auto_escalated
Geo-diversity safeguard	Doesn’t apply	Required to fire

Best practice: treat auto-escalation as a backup. Use manual panic for known-bad situations where you have specific evidence the system hasn’t picked up yet.