David Mytton is the founder and chief executive of Arcjet, which helps developers defend applications against malicious bots, abuse, prompt injection, and unsafe AI-agent actions. He previously founded the infrastructure-monitoring company Server Density, co-founded the Console developer-tools newsletter, and researched the environmental costs of cloud computing.
Mytton started out running Olate, a web-hosting and development business. In 2009, he co-founded Server Density and built its initial monitoring platform, including an open-source agent and custom time-series database. After StackPath acquired the company in 2018, he became its vice president of product engineering, working on security and edge-computing products until late 2019.
He subsequently completed a master’s degree in environmental technology at Imperial College London and researched data-center sustainability with Uptime Institute. His peer-reviewed analysis of data-center water consumption examined water used for cooling and electricity generation, identifying gaps in measurement and disclosure. He has also pursued engineering-science doctoral research in sustainable computing at the University of Oxford.
Mytton co-founded Console in 2020 and founded Arcjet in 2023, bringing application security into the development workflow. Its open-source JavaScript SDK supports bot detection, rate limiting, prompt-injection protection, sensitive-data handling, and controls governing agents’ access to tools.
Security as application code. Application-level protections can incorporate authentication, subscription tier, user history, and route sensitivity—information unavailable to network-edge controls alone. The same request volume might identify an important paying customer or an abusive scraper, depending on context.
Bot policy based on intent. Mytton distinguishes search-indexing crawlers, model-training bots, user-initiated retrieval, and browser agents acting for real people. Each creates different costs and benefits: search traffic may produce referrals, training crawlers may consume infrastructure without reciprocating, and an automated request may represent an actual customer. His analysis of AI-driven website traffic favors policies tailored to those differences.
Layered bot verification. User-agent strings and robots.txt are useful but easily spoofed or ignored. Stronger controls combine reverse DNS, verified IP ranges, request fingerprinting, appropriately keyed rate limits, and cryptographic authentication. Arcjet’s well-known-bots catalog helps identify and verify automated clients. Mytton also emphasizes the accessibility costs of CAPTCHAs and the limited deterrent value of challenges when abuse remains profitable.
Privacy-preserving local detection. His approach to sensitive-data detection combines deterministic identifier recognition with locally executed named-entity inference, avoiding unnecessary transmission of potentially sensitive requests.
Developer-owned security. Mytton describes coding-agent-assisted security workflows that identify sensitive routes, apply framework-aware controls in dry-run mode, examine traffic through MCP integrations, and propose policy changes for human review.
Effective bot defense starts with deciding which automation serves your users, then combines crawler verification, network signals, computational challenges and durable rate-limit keys.
▶ Watch ↗