What It Really Costs to Implement CPU Concurrency Detection

Implementing CPU concurrency detection does not require a license fee or special hardware. The true cost is measured in engineering hours, performance overhead, and the risk of false positives. If you build it yourself, you pay for development and testing. If you buy a commercial solution, you pay for a subscription, but you get a finished, cross-checked signal that is hard to replicate alone.

CPU concurrency detection is a client-side check that compares reported hardware concurrency with actual behavior. As one of 106 checks used by BotRefund, it is not meant to be used in isolation. The cost of implementation therefore depends on how much context you add around it. A naive implementation can be cheap but inaccurate; a robust one requires investment.

What is CPU concurrency detection and why does it cost anything?

CPU concurrency detection is a browser fingerprinting signal. It checks whether the number of logical processors reported by the browser matches what the actual environment suggests. Automated browsers and virtual machines often reveal a mismatch. The check is simple in theory, but the cost appears when you try to make it reliable.

Building a single JavaScript check that reads navigator.hardwareConcurrency and compares it with a baseline is a few hours of work. That low-effort version is what many tutorials show. But it produces false positives. Genuine users on corporate networks, privacy tools, or unusual devices may trip the check. As BotRefund explains, “A single anomaly is not a bot verdict.” So the real cost is building the surrounding logic that decides when the signal matters.

Development effort: what you are actually paying for

The biggest cost driver is the time your engineering team spends designing, building, and testing the detection. A bare-bones implementation might take a day. A production-grade version takes significantly more because it must integrate with other signals.

• Core check logic: Reading the concurrency value, setting thresholds, and handling browser quirks.
• Cross-checking: You need to correlate the concurrency result with other fingerprinting data like graphics, fonts, and network behavior. BotRefund keeps this as “evidence—not a verdict” and cross-checks against independent browser, network, device, and behavior data.
• AI or weighted model: If you want accuracy, you need to combine multiple signals. This means building a scoring system or training a model, which adds days or weeks of work.

For most teams, the development effort is the single largest line item. It is not a weekend project if you care about false positives.

Performance overhead: the quiet tax on every page load

Every client-side check you add runs on your visitors’ devices. CPU concurrency detection is a lightweight read, but it often triggers additional fingerprinting calls. If you combine it with other checks—like the ones BotRefund uses (impossible tab speed, window.open tamper, ghost clicks)—the total JavaScript size grows.

Performance overhead shows up in two places: page load time and device resource usage. A poorly optimized script can delay interaction metrics like LCP or TTI. This matters because slow pages increase bounce rates and hurt ad quality.

The cost here is not monetary in a direct sense. It is the risk of degrading user experience. That risk can turn into lost conversions and weaker ad performance. To keep overhead low, you need code that runs asynchronously and delays heavy checks until after the page is interactive.

The cost of false positives and the need for cross-checking

A false positive happens when a real human is flagged as a bot. This is more expensive than a missed bot because it blocks genuine customers. The CPU concurrency check is especially prone to this because privacy tools, virtual machines, and corporate proxies can make legitimate visitors look suspicious.

BotRefund addresses this by treating the check as one of 106 independent signals. Their model weighs the complete pattern instead of trusting a raw rule. Reproducing that cross-checking logic is where most of the engineering cost goes.

If you skip cross-checking to save money, you will likely block real users. The resulting support tickets, lost sales, and damaged ad campaigns will cost more than the development time you saved.

Maintenance and updates: the cost you cannot skip

Browsers change. Hardware changes. Bot authors adapt. A concurrency detection that works today may fail tomorrow when Chrome updates its Fingerprint Protection feature or when a headless browser patches its spoofing.

Maintenance means monitoring your detection rate, adjusting thresholds, and updating your model as new browser versions appear. This is an ongoing engineering cost. It is not a one-time purchase.

If you rely on a commercial service, maintenance is included in the subscription. If you build in-house, you need to budget for continuous updates. Many teams underestimate this line item.

In-house vs. commercial: a cost comparison

Let’s compare the two main paths. The trade-off is between up-front control and ongoing expertise.

Choose a do-it-yourself approach if you have a dedicated anti-fraud team and the budget to maintain it. Choose a commercial service if you want to avoid the engineering burden and get a production-ready signal with minimal setup.

Key facts about BotRefund's implementation

Limitations of a single-signal approach

A CPU concurrency check is not a standalone solution. Even BotRefund, which has a polished implementation, uses it as one piece of a larger puzzle. If you implement only this check, you will not get reliable bot detection.

You also need to accept that no client-side check is foolproof. Sophisticated bots can spoof hardware concurrency. The detection works best when combined with behavioral signals like mouse movement, tab speed, and session timing. That is why the cost of full implementation is always higher than the cost of a single check.

Finally, remember that the “normal user” vs. “bot browser” comparison (as seen on BotRefund’s signal page) shows that real browsers present coherent hardware and software data. Any mismatch deserves investigation, but it is not proof by itself.

FAQ: quick answers on cost and implementation

Can I implement CPU concurrency detection for free?

Yes, if you count only monetary cost. The code itself is simple and open-source examples exist. But you pay with engineering time, especially if you want to avoid false positives. The free version may cost you more in lost sales.

How long does it take to build a production-grade detection?

No public benchmark exists, but based on the need for cross-checking and model integration, you should plan for at least several weeks of one engineer’s time. A barebones version can be done in a day, but it is not safe to rely on alone.

Does CPU concurrency detection slow down my website?

It can, if not implemented carefully. The check itself is small, but the surrounding scripts add weight. You need asynchronous loading and non-blocking execution. A commercial service like BotRefund optimizes this for you.

What is the real cost of a false positive?

Every false positive is a real visitor blocked. That means lost conversions, wasted ad spend, and potential harm to your brand. The cost varies by industry, but it can far exceed the cost of building the detection correctly.

Is CPU concurrency detection enough to stop bots?

No. It is one signal among many. BotRefund uses 106 checks and combines them with AI. A single check is trivial for bots to bypass. You need a broader approach.

How do I decide if a commercial service is worth it?

Compare the engineering hours you would spend against the subscription fee. If you lack in-house fraud expertise, commercial services usually deliver better accuracy faster. Many offer free audits, which lets you see the problem before paying.