Abstract: In a system for protecting user accessible software applications, an application is executed in coordination with a security agent, and the security agent can monitor communications between users and the application. By analyzing one or more automation characteristics of the communications, and by comparing and contrasting these characteristics with those of known security scanners, the agent can determine whether the communication is likely associated with a malicious user. The agent can also monitor whether a communication attempts to change the value of a decoy unit, and can designate such communication as associated with a likely malicious user. By analyzing the contents of the communication, the agent can designate a threat level to the communication. The agent can block the communications likely associated with malicious users and/or having a designated high threat level, or can alert a system administrator, to protect the software application.