David Mytton is the founder and chief executive of Arcjet, which helps developers defend applications against malicious bots, abuse, prompt injection, and unsafe AI-agent actions. He previously founded the infrastructure-monitoring company Server Density, co-founded the Console developer-tools newsletter, and researched the environmental costs of cloud computing.
Mytton started out running Olate, a web-hosting and development business. In 2009, he co-founded Server Density and built its initial monitoring platform, including an open-source agent and custom time-series database. After StackPath acquired the company in 2018, he became its vice president of product engineering, working on security and edge-computing products until late 2019.
He subsequently completed a master’s degree in environmental technology at Imperial College London and researched data-center sustainability with Uptime Institute. His peer-reviewed analysis of data-center water consumption examined water used for cooling and electricity generation, identifying gaps in measurement and disclosure. He has also pursued engineering-science doctoral research in sustainable computing at the University of Oxford.
Mytton co-founded Console in 2020 and founded Arcjet in 2023, bringing application security into the development workflow. Its open-source JavaScript SDK supports bot detection, rate limiting, prompt-injection protection, sensitive-data handling, and controls governing agents’ access to tools.
- Security as application code. Application-level protections can incorporate authentication, subscription tier, user history, and route sensitivity—information unavailable to network-edge controls alone. The same request volume might identify an important paying customer or an abusive scraper, depending on context.
- Bot policy based on intent. Mytton distinguishes search-indexing crawlers, model-training bots, user-initiated retrieval, and browser agents acting for real people. Each creates different costs and benefits: search traffic may produce referrals, training crawlers may consume infrastructure without reciprocating, and an automated request may represent an actual customer. His analysis of AI-driven website traffic favors policies tailored to those differences.
- Layered bot verification. User-agent strings and robots.txt are useful but easily spoofed or ignored. Stronger controls combine reverse DNS, verified IP ranges, request fingerprinting, appropriately keyed rate limits, and cryptographic authentication. Arcjet’s well-known-bots catalog helps identify and verify automated clients. Mytton also emphasizes the accessibility costs of CAPTCHAs and the limited deterrent value of challenges when abuse remains profitable.
- Privacy-preserving local detection. His approach to sensitive-data detection combines deterministic identifier recognition with locally executed named-entity inference, avoiding unnecessary transmission of potentially sensitive requests.
- Developer-owned security. Mytton describes coding-agent-assisted security workflows that identify sensitive routes, apply framework-aware controls in dry-run mode, examine traffic through MCP integrations, and propose policy changes for human review.
