Question 1

What is AI threat detection, exactly — is this marketing, or real?

Accepted Answer

Casper's threat detection runs a real machine-learning classifier on the domains your devices try to reach. The model is trained on millions of labeled examples — known phishing sites, malware command-and-control servers, scam storefronts, malvertising infrastructure, exfiltration endpoints. When your device tries to resolve a hostname (even one we've never seen before), the model scores it in milliseconds based on registration age, TLS cert patterns, DNS topology, naming structure, similarity to known-bad clusters, and ~40 other features. High-risk scores get blocked. Pure blocklists alone can't catch zero-day phishing — the AI layer is what closes that gap.

Question 2

What threats does this actually block?

Accepted Answer

Phishing sites (the fake login pages that get sent via SMS/email/iMessage), malware command-and-control servers (where compromised apps phone home), credential exfiltration endpoints, scam e-commerce stores, malvertising redirectors, cryptocurrency drain sites, romance-scam hosting, fake delivery-notification scams, fake banking apps' backends, and the entire pipeline of post-compromise tools used by mobile-targeting threat actors.

Question 3

How is this different from iOS Safe Browsing / Chrome Safe Browsing?

Accepted Answer

Apple and Google's Safe Browsing only protect you inside their own browsers. If a phishing link comes in via SMS, iMessage, WhatsApp, a third-party email app, or a webview embedded in a random app — Safe Browsing doesn't run. Casper's protection is at the network layer (DNS), so it intercepts every connection from every app on the device. The phishing link in your SMS gets blocked even if you tap it in Messages.

Question 4

How fast does Casper catch a brand-new phishing site that hasn't been reported yet?

Accepted Answer

Median time-to-block for a previously-unseen phishing domain in our internal evaluation is under 90 seconds from first observation, because the AI model scores domains on registration features (cert age, registrar reputation, hostname similarity to known brands) — it doesn't need the site to be reported anywhere first. A blocklist-only product typically takes hours-to-days for the same domain to land in PhishTank or OpenPhish.

Question 5

Does this protect me on public WiFi (coffee shops, airports, hotels)?

Accepted Answer

Yes. Casper's VPN tunnels all of your device's traffic over an encrypted channel, so even on a hostile WiFi network, the local network operator can't see what you're browsing, can't inject scripts into pages, and can't run a man-in-the-middle attack on your TLS connections. This is the original VPN use case — Casper handles it alongside the threat detection and ad/tracker blocking.

Question 6

What happens when something gets blocked? Do I see a warning?

Accepted Answer

Yes. When a high-risk site is blocked, Casper presents a clear warning screen explaining what was detected (phishing / malware / scam / etc.), where the link came from, and offers a one-tap 'override and proceed anyway' for the small minority of false positives. The override is per-domain and per-day, never permanent unless you explicitly add to the allowlist. Suspicious activity from apps (silently phoning home) gets a notification you can review in the activity feed.

Question 7

Will threat protection break legitimate sites?

Accepted Answer

False-positive rate in production is under 0.05% measured against the Tranco top-1M (sites your devices are actually likely to reach). The model is tuned conservatively — it errs on the side of letting borderline sites through rather than blocking your bank. When false positives do happen, the override flow takes one tap, and reports flow back to retrain the classifier so the same site won't false-positive on anyone else within ~24 hours.

Question 8

Does Casper see what I'm browsing? Could you sell my browsing data?

Accepted Answer

No. Threat-detection scoring happens on the DNS resolver: we see the QUESTION (what hostname does your device want), not the content of the connection that follows. DNS queries are processed in-memory, not logged to disk. Independently audited annually; latest audit linked in our trust center.

Phone security that catches zero-day phishing in under 90 seconds

What Casper actually blocks

Phishing sites — including zero-day

Malware command-and-control

Scam storefronts + crypto drains

Public-WiFi attacks

Credential exfiltration

Zero-day, not just known-bad

How AI threat detection actually works

Your device tries to reach a hostname

Model scores the hostname in ~3 ms

Decision in real time

Feedback loops back into the model

Net effect

Threat-protection FAQs

Catch the next phishing link before you tap it.