| Heavier protection for selected sensitive functions |
Yes · Corporate+
Available for selected high-value functions when standard Maximum mode is not enough. |
Often available on higher tiers, but names and implementation details vary. |
Yes
The defining feature of the category. |
Public OSS obfuscators (the most-used npm package, online playgrounds) explicitly do not include bytecode VM. |
| Protection changes from release to release |
Yes
Maximum mode is designed so protected output changes across releases, reducing reusable attack patterns. |
Top-tier offerings often advertise this; mid-tier offerings may be more static. |
Yes
Standard at this level. |
Open-source virtualizers (KProtect, js-virtualizer) ship a static dispatcher that does not regenerate per build. |
| Selective use on only the most valuable code |
Yes
Advanced protection can be limited to code where the added protection is worth the added cost. |
Annotation-driven on top tiers. Often whole-bundle on entry tiers. |
Yes
Annotation-driven, sometimes auto-detected. |
Whole-input only on the open-source virtualizers. |
| Published per-month pricing that includes VM |
Yes
$49 (Corporate) and $99 (Enterprise) per month, posted on the site, no sales call. |
Rare
Where pricing is published, VM is typically reserved for the highest tier; the entry tier ships static transforms only. |
No
Sales-led. Annual contracts in the five- to six-figure range are typical. |
Free / open license. No tier gating. |
| Works with every JavaScript pattern? |
Advanced protection has compatibility limits. Standard protection remains the right baseline for most code. |
Top tiers handle it; entry tiers often don't. |
Yes
Standard at this level. |
Not supported. |
| Runtime threat monitoring / live alerts |
Yes
Runtime callbacks plus first-party SIEM forwarders (Splunk HEC, Elasticsearch, signed webhook) route tamper events to the team's monitoring tools. Active countermeasures (break, clear cookies, redirect, self-destruct, custom callback) respond locally. A hosted dashboard remains a runtime-suite strength. |
Yes
Most cloud-VM vendors bundle telemetry as a paid layer. |
Yes
Core feature. |
Not part of the offering. |
| Magecart and payment-page script monitoring |
Yes
Runtime third-party-script inventory flags unknown origins, post-load injections, and CDN content swaps. Pair with the PCI DSS v4 evidence report for audit-ready coverage of controls 6.4.3 and 11.6.1. |
Available on selected runtime-protection tiers, usually positioned as a separate Webpage Integrity product. |
Yes
Core feature of payment-page protection suites. |
Not part of the offering. |
| Compliance evidence (PCI DSS v4 6.4.3 / 11.6.1) |
Yes
Built-in compliance report maps script watermarks, signed manifests, and beacon wiring directly to PCI DSS v4 sub-requirements. Markdown + JSON output for auditors. |
Compliance write-ups are vendor-supplied marketing collateral, not generated per build. |
Yes
Some enterprise vendors include guided compliance modules. |
Not part of the offering. |
| Different protection profiles per app section |
Yes
Named configuration sets apply different presets, options, and countermeasures to checkout, dashboard, marketing, and other parts of one app in a single build. |
Often available as named profiles or labels on top tiers. |
Yes
Standard at this level. |
Not part of the offering. |
| Electron desktop app bytecode protection |
Yes
Post-protection step compiles the protected JavaScript to V8 bytecode that is bound to the Electron release. Layered with obfuscation rather than replacing it. |
Limited; usually positioned as a web protection product. |
Available case-by-case through professional services. |
Not part of the offering. |
| Mobile / hybrid (React Native, Cordova, Ionic) device RASP |
Yes
Runtime guard detects root / jailbreak / emulator / Frida / Magisk / unc0ver / checkra1n and routes the verdict to your SIEM with a configurable response. Bundle obfuscation plus mobile-class device checks. |
Yes
A core strength of the mobile-app-shielding vendors (DexGuard/iXGuard, DexProtector); often the reason teams pick that category. |
Yes
Native mobile RASP is the defining feature. |
Not part of the offering. |
| Compatible with commercial distribution (license) |
Yes
Commercial license; output ships unencumbered. |
Yes
Commercial license. |
Yes
Commercial license, custom contract. |
Mixed
MIT-licensed virtualizers can be embedded; GPL-licensed ones (KProtect) are incompatible with proprietary distribution. |
| Free playground demonstrating VM output |
Not exposed — VM is paid-tier only. Maximum mode (everything except the VM pass) is exposed in the free online tool. |
Free demos usually expose CFG flattening and self-defending toggles, not the bytecode VM. |
Guided demo by request. No public playground. |
Yes
Public playgrounds expose every option, including VM in the OSS virtualizers. |