We Recommend Sansec to Every Magento Merchant. Here's Why.

We published a piece on Adobe's August security patch yesterday. While we were writing it, Sansec's firewall was already blocking attacks against CVE-2026-71362, the unauthenticated account takeover in that bulletin, and Adobe's advisory still said it wasn't aware of any exploits in the wild.

Before anything else: we don't sell Sansec. We're not in their partner program, we don't resell licenses, and we get nothing if you buy it. Their partner program doesn't pay commission to anyone anyway. We've just used it — eComscan running daily on client stores, and Shield on stores where the malware kept coming back after we cleaned them.

The window between the patch and your deploy

Adobe publishes a patch. Attackers download it, read the diff and work out what got fixed, usually within hours.

Your side depends on where you're starting from. If you're already current, an isolated patch is a small change: apply it, smoke test login and checkout and payment, ship it. An afternoon, and you shouldn't turn it into more than that.

If you're not current it's a different job. Isolated patches need you on the latest -p release with last month's patch already applied, so a store that's drifted has a patch-level upgrade to get through first, and that one does need proper regression testing. Then you're into days or weeks. There are also reasons that have nothing to do with engineering. The patch drops on a Friday, or you're inside a change freeze, or it's November and nobody is deploying anything to production until January.

So the gap varies a lot. Sometimes it's a few hours and not really worth worrying about. Sometimes it's the whole of December.

Worth saying plainly: if your store is always current and you can ship the same day, this is the weakest reason in this article to buy anything. The two below are better ones.

CosmicSting is the example everyone points at. After CVE-2024-34102 went public, seven separate groups hit 4,275 stores, and by the end of that summer about 5% of all Adobe Commerce and Magento stores had a payment skimmer sitting on checkout. Those are Sansec's numbers, and they're the ones who did the counting.

What the two products do

eComscan runs on your server and goes through files, database and third-party extensions looking for malware, rogue admin accounts, database triggers and vulnerable modules.

Adobe has a free Security Scan Tool that's worth running, but it scans from outside, so it only sees what's publicly exposed. Most Magento malware isn't publicly exposed. It's a few lines buried in a PHP file, or a row in a database table, and nothing scanning from the outside is going to find either.

You don't have to pay to try it. Sansec publish a one-line install:

curl https://ecomscan.com | sh

That runs their signature checks across your files, database and processes — they say over 50,000 of them, updated daily. Paying gets you the detailed reporting and the troubleshooting notes, which matter more than they sound like they do, because a detection you can't interpret is just anxiety. One caveat worth checking: their licensing page says usage licenses go to customers with a paid subscription, so if you plan to run this continuously, read the terms instead of assuming.

Either way, run the free one this week. It reads your actual server, which already puts it ahead of anything checking your homepage from the outside.

Sansec Shield is a firewall, installed as a Composer module inside Magento, that blocks known attack patterns as the requests come in. You need the Advanced plan or higher for it.

Sansec say it adds no measurable overhead and produces no false positives. Both have held up for us. We've had Shield running on production stores without it showing up in response times or in anything anyone noticed, and it hasn't flagged legitimate traffic as an attack.

Those are usually the two objections to putting a firewall inside Magento — that it'll slow the store down, or that it'll start blocking real customers. Neither happened.

How we've used it

Two things, neither of them complicated.

The first is just running eComscan every day. Malware detection is monitoring, not auditing. A clean scan from March tells you nothing about today, and a skimmer is designed to sit quietly while the store carries on taking orders normally. Scanning daily means your worst case is about a day of exposure, instead of however many months it takes before someone complains about their card.

Setting it up is a cron entry. It needs shell access, because it works server-side across the filesystem, database, running processes and scheduled tasks, and it will report to email, Slack or JSON. After that you don't hear from it unless something changes.

The second is Shield, on stores that kept getting reinfected. That's the case where we've actually told people to buy it.

If you haven't dealt with one of these: you clean a compromised store, and a week or two later the malware is back. Usually that means the way in is still open, or something got left behind to reopen it — a rogue admin account, a database trigger, a cron entry, a backdoor file somewhere nobody thinks to look — or the store is being re-exploited through the same hole as last time, because that never got patched either. Cleaning it again buys you another week.

What you actually have to do is find the persistence and close the entry point, and that's slow, careful work on a store that's live and taking money the entire time. Shield covers you while you do it by blocking the re-exploitation attempts, and the daily scan tells you whether you got everything or missed a bit. A store getting reinfected every couple of weeks is the clearest case for paying for this that we've run into.

Generic firewalls don't know what Magento is

Cloudflare and AWS WAF are good products and you should probably have one of them.

Neither knows what a Magento admin route is, what your checkout does internally, or which API endpoint got a CVE last Tuesday. They match generic web attack patterns. A Magento authorization bug arrives looking like a perfectly ordinary POST request.

Sansec say Adobe's own WAF took five weeks to filter CosmicSting. That's one vendor talking about another, so treat the number carefully, though the underlying point doesn't really depend on it. A firewall that doesn't understand your application is guessing.

Shield is meant to sit alongside Cloudflare instead of replacing it, and Sansec are clear about that.

Their track record is the real argument

They found CosmicSting and named it. They contacted all 4,275 compromised merchants with remediation instructions instead of publishing and moving on. They documented a Magecart campaign that hid a fake checkout overlay inside invisible SVG elements across 99 stores. The PCI Security Standards Council and the Retail & Hospitality ISAC cite their research.

There's a shorter version of all that. Next time a Magento breach turns up in the technical press, read down to where the reporting came from. It's usually Sansec, usually a few days before the vendor advisory says anything.

What it costs

Sansec sizes its plans by how much your store sells online in a year, not by which features you want. Secure covers stores doing up to €3 million in annual online revenue, Advanced up to €20 million, and Enterprise up to €50 million. Larger than that, or several stores to cover, and you contact them for a quote.

The tier you fall into decides what you get, and Shield only starts at Advanced. So the entry plan gets you scanning and no firewall, which is the thing to check before assuming the cheapest option covers you.

They don't publish actual prices anywhere on the site, so you'll be asking for a quote either way. Sansec is a Dutch company, so everything is priced in euros.

Agencies license separately, somewhere between €549 and €8,925 a month depending on how many stores and which platforms. Useful context if you're working out what your development partner charges you for security against what it costs them.

What it won't do

Sansec's own Shield page suggests you can postpone patches, or skip them entirely. Ignore that bit.

A firewall blocks the attacks it recognizes. Patching removes the bug. Those are different promises, and the difference shows up the first time somebody finds a new way at something you decided not to fix. We argued for a 72-hour patch window on APSB26-92, and we'd still argue for it on a store running Shield.

What Shield genuinely buys you is the gap between a patch shipping and your store getting it, whatever that gap looks like for you. eComscan tells you whether something got in already. Neither is a reason to stop patching.

If the budget really isn't there

Run the free scan. curl https://ecomscan.com | sh costs nothing, reads your actual server, and takes a few minutes. Put it on a cron, patch promptly, and you've covered a fair amount of ground without spending anything.

What you don't get is the reporting that explains a detection, or Shield, which is the part that stops attacks rather than telling you about them afterwards. That's a genuine gap and worth being honest about, though it's still a long way better than not looking.

For everyone else, particularly if you're taking card payments at any volume: the expensive part of a checkout skimmer isn't the cleanup. It's the disclosure, the card brand fines, and the customers who find out their card got used somewhere else after they bought from you.

Emyrix does Magento support and maintenance, including patch management and Adobe Commerce work. We're happy to help you get monitoring in place, whether or not you buy anything from Sansec. If you want a straight assessment of where your store stands, get in touch.

Sources: Sansec Shield · eComscan · Sansec pricing · Sansec agency partnership terms · Sansec threat research · CosmicSting fallout: thousands of stores hacked