Coverage is two things: where the machines are, and what they report. We score every withdrawal in the authorization path, read door, cassette and dispense events off the terminal, and sweep the whole fleet once a day for hardware that was not there yesterday.
Detection runs
Coverage runs in four regions. The tier is what each one can actually detect today: authorization scoring, terminal telemetry, and reader-surface vision where a camera is fitted.
| Region | Countries | Terminals | Detection | Note |
|---|---|---|---|---|
| Asia-Pacific | 18 | 640K | Auth path + vision | Reader-surface vision live on the Japan, Singapore and Australia fleets. Kit family B-112, first seen in Manila, is matched on every terminal in the region. |
| Europe, Middle East & Africa | 32 | 780K | Auth path + vision | Door and cassette telemetry from four vendor feeds, plus shared signatures contributed by issuer fleets in the UK, the Nordics and the Gulf. |
| Americas | 14 | 585K | Auth path + telemetry | Authorization scoring and dispense telemetry across the US, Canada, Mexico and Brazil. Reader-surface vision runs on pilot terminals only. |
| Latin America | 8 | 95K | Daily sweep only | Inventory loaded from operator and processor exports. Detections run on the daily sweep until an authorization feed is connected. |
Reader-surface vision live on the Japan, Singapore and Australia fleets. Kit family B-112, first seen in Manila, is matched on every terminal in the region.
Door and cassette telemetry from four vendor feeds, plus shared signatures contributed by issuer fleets in the UK, the Nordics and the Gulf.
Authorization scoring and dispense telemetry across the US, Canada, Mexico and Brazil. Reader-surface vision runs on pilot terminals only.
Inventory loaded from operator and processor exports. Detections run on the daily sweep until an authorization feed is connected.
Five feeds carry the signal. Two of them need hardware or a vendor connection on your side, and one needs nothing at all.
Every withdrawal is scored in the path — read pattern, velocity, terminal risk — and comes back allow, step up or block with the reason codes before the cash is dispensed.
A feed from your switch, processor or ISO host. No terminal agent and no hardware on your side.
A door opened outside the service window, a cassette swap with no work order, a dispense retract on a terminal with otherwise clean reads. Every event is stamped to one machine.
A telemetry feed from your ATM vendor, or your own agent writing to the terminal events API.
Where a camera is fitted, overlay, insert and deep-insert hardware is matched against known kit profiles instead of waiting for a cardholder complaint.
A camera on the machine and a frame feed we can reach. No camera means no vision input, and we do not model around the gap.
Access that appears in telemetry but not in your work-order system is intrusion, not maintenance. Service history also clears terminals your field teams visit every week.
A daily export or webhook from your field-service or cash-in-transit system.
Hardware seen in one market flags in the next one. Signatures are matched against your terminals inside your tenant.
Nothing to supply. The signature graph is aggregated across all deployments.
Same detections, different place in the flow. Most fleets start on the sweep and move scoring into the switch when the change window opens.
<40 ms P50
The scoring call sits inside your switch flow. Every withdrawal returns allow, step up or block with a score, reason codes and the terminal risk that produced it.
24 h cycle
Every terminal in the inventory is re-scored each night against telemetry, service history and shared signatures. Newly compromised machines are on the morning list.
Sub-second delivery
Compromise events and blocked withdrawals push to your endpoint as they happen, so the field team is dispatched while the kit is still on the machine.
A terminal list is enough for the first sweep. Add the authorization feed when your change window allows.