20 Device Intelligence Terms You Should Know

Device intelligence has its own vocabulary, and the terms are easy to blur together. A visitor ID is not a session ID, a confidence score is not a suspect score, and a smart signal is not a fingerprint. Getting the distinctions right matters because they map to different decisions in your fraud and bot-defense stack.

This glossary defines twenty core terms in plain language, grouped so related concepts sit together. Use it as a reference while reading the deeper guides, starting with what device fingerprinting is and the device fingerprinting pillar.

Identity and matching

These terms describe how a device gets recognized across visits.

• Visitor ID. A stable identifier for a browser or device that persists across sessions, cleared cookies, and incognito mode. It is the anchor everything else attaches to. See the confidence score guide for how it is matched.
• Fingerprint. The set of device and browser attributes, canvas, fonts, WebGL, and more, hashed or combined to distinguish one device from another.
• Confidence score. A measure of how certain the system is that the current observation matches a known visitor ID, reflecting both entropy and stability.
• Entropy. The information a signal carries, measured in bits; higher entropy narrows a device to a smaller group. See entropy explained.
• Session ID. A short-lived identifier for a single browsing session, unlike the durable visitor ID.

The key relationship: a fingerprint is a measurement, a visitor ID is the durable identity that measurement resolves to, and the confidence score is how sure you are the resolution is correct.

Signals and their sources

These terms name the raw material of a fingerprint.

• Canvas fingerprinting. Rendering hidden graphics and hashing the result, which varies by GPU and drivers. Detailed in how canvas fingerprinting works.
• WebGL fingerprinting. Reading GPU vendor, renderer, and precision quirks through the graphics API. See the WebGL guide.
• JA4. A modern TLS fingerprint computed from the handshake, capturing the client’s crypto stack server-side. Covered in TLS fingerprinting with JA4.
• Smart signals. Risk flags computed alongside the fingerprint, bot, incognito, VM, VPN, Tor, datacenter, proxy, tampering, location spoofing, that describe trustworthiness rather than identity.
• Behavioral biometrics. Patterns in how a person types, moves, and interacts, used to distinguish humans from bots and one user from another.

Signal	Layer	Identifies or flags
Canvas / WebGL / fonts	Client	Device identity
JA4	Network	Client software stack
Smart signals	Mixed	Risk condition
Behavioral biometrics	Client	Human-ness and identity

Risk and scoring

These terms describe how signals become decisions.

• Suspect score. A single risk number fusing device, network, and behavioral signals, used to decide whether to allow, challenge, or block. See suspect score explained.
• Reason codes. Human-readable explanations attached to a score, so a decision is auditable and appealable. See reason codes.
• False positive. A legitimate user wrongly flagged as fraudulent, the error that costs you customers. See reducing false positives.
• Step-up authentication. Adding verification friction only when risk warrants it, rather than for everyone.
• Identity graph. A network linking accounts, devices, and signals to expose rings and shared infrastructure. See identity graphs.

The design goal across all of these is proportionality: spend friction where risk is high, keep the path clear where it is low, and always be able to explain why.

Integrity and network

These terms cover trust in the result and the origin of traffic.

• Sealed results. The fingerprinting payload encrypted and signed by the agent so your backend can verify it without trusting the client. See sealed results.
• Reputation network. A privacy-preserving system that shares verdicts about devices across properties, so a device burned on one site arrives flagged on the next. See reputation network.
• Residential proxy. A proxy that exits through a real consumer device, defeating IP reputation by presenting a genuine ISP address. See residential proxy detection.
• Datacenter IP. An address in a hosting provider’s range, a common and easily-detected marker of VPNs and bots. See datacenter IP detection.
• Proof of work. A challenge that costs the client measurable CPU per request, cheap for one human and expensive for a bot at scale. See proof-of-work challenges.

Sealed results answer “can I trust this data?”, the reputation network answers “has this device misbehaved elsewhere?”, and the network terms answer “where is this traffic really coming from?”

Putting the vocabulary to work

The terms are not trivia; each maps to a lever in your stack. A visitor ID with a strong confidence score anchors a returning-user decision. Smart signals and a suspect score with reason codes drive the allow-challenge-block choice. Sealed results ensure the backend trusts only verified data. A reputation network extends memory across properties, and proof of work provides a humane fallback when a decision is genuinely ambiguous.

A quick mental map:

• Who is this device? Visitor ID, fingerprint, confidence score, entropy.
• What are the risk conditions? Smart signals, behavioral biometrics, JA4.
• What should I do? Suspect score, reason codes, step-up, proof of work.
• Can I trust and correlate it? Sealed results, identity graph, reputation network.

Keep these four questions in mind and the vocabulary organizes itself.

Frequently asked questions

What is the difference between a visitor ID and a session ID?

A session ID lasts one browsing session and resets, while a visitor ID is a stable identifier that persists across sessions, cookies cleared, and incognito mode.

What does a confidence score represent?

It represents how certain the system is that a given observation matches a known visitor identity, reflecting both the entropy and the stability of the contributing signals.

Are smart signals the same as a fingerprint?

No. A fingerprint identifies a device, while smart signals are risk flags, such as bot, VPN, or tampering, computed alongside it to describe the device’s trustworthiness.

Shared vocabulary makes better decisions, because it forces you to separate identity from risk from action. Bookmark this glossary, follow the linked deep dives when you need detail, and explore the full glossary and playground to see the terms on live data.