Cybersource Review

Visa's enterprise payment gateway, founded in 1994 in Silicon Valley and bought by Visa for about $2 billion in 2010. It is one of the largest gateways in the world — Cybersource's own marketing claims 14.3 billion transactions a year, connections to more than 200 acquirers and processors across 160-plus countries, and 99.999% uptime — and its Decision Manager fraud engine is genuinely among the best-regarded in the industry. What it does not do is publish a single price. Cybersource has no public rate card, no published gateway fee and no self-serve signup; every quote comes through a sales conversation or through whichever acquirer resells it to you. For a large merchant with a payments team that is normal. For anyone smaller, it is the main reason to look at its sister brand Authorize.net instead.

Estimated annual cost at three realistic processing volumes, using Cybersource’s published online rate plus monthly fees. Real costs vary with average transaction size, chargeback rate, and any negotiated terms.

A 1994 gateway that Visa bought and kept

Cybersource was founded in 1994 by William S. McKiernan to sell fraud management and online payment services to medium and large merchants — an unusually early bet on card-not-present commerce. It bought Authorize.net for $565 million in 2007, picking up the small-business end of the market, and in 2010 Visa acquired the whole thing for roughly $2 billion, closing that July. At the time Visa said Cybersource handled about a quarter of all US e-commerce dollars. Both brands now sit inside Visa Acceptance Solutions, and both still trade under their own names.

That lineage is the single most useful thing to understand about Cybersource, because it explains both what it is good at and who it is for. It is a gateway, not principally an acquirer. It sells to enterprises. And it is owned by a card network, which is why its fraud engine sees things independent gateways cannot.

What you are actually buying

The core product is the Global Payment Gateway: one integration reaching, by Cybersource's own count, more than 200 acquirers and processors across over 160 countries, settling in more than 50 currencies. For a merchant opening a new market, that means adding a local acquirer without rebuilding checkout. Cybersource publishes supporting scale figures — 14.3 billion transactions a year, 1,200 transactions per second on average against 8,000 per second of capacity, 99.999% uptime. Those are company figures, not audited ones, but they are consistent with its position in the market.

Around the gateway sits a menu: Decision Manager for fraud, Token Management Service and point-to-point encryption for security and PCI scope reduction, Unified Checkout and Click to Pay for the checkout itself, payouts, orchestration across processors, tax calculation, currency conversion and account updater. Decision Manager is the one that tends to close the deal. It scores transactions against models informed by Visa network data rather than only your own transaction history, and that input is not something a competitor can go and buy.

The pricing problem

Cybersource publishes nothing about what it costs. Not a gateway fee, not a per-transaction rate, not a module price list, not an entry-level plan. There is no self-serve signup. Every number comes out of a sales conversation, or out of whichever acquirer, ISO or software platform is reselling the gateway to you.

That is normal for enterprise software and it is defensible when a buyer has procurement leverage. It is still worth naming plainly, because the modular structure is where the cost lives. A quote covering the base gateway is not a quote for the system you will actually run: switch on fraud screening, tokenisation, account updater and currency conversion and the per-transaction economics change. Before signing, get every module you intend to use listed with its own per-transaction cost, and establish in writing whether card processing rates are inside this contract or come from a separate acquiring agreement.

One more question worth asking early: can you export your card vault? Tokenisation is a genuine security benefit and also a genuine switching cost, and the answer is much easier to get before you sign than after.

Integration and support are the weak points

The criticism Cybersource attracts is remarkably consistent across sources, and it is not about reliability. It is about the developer experience — documentation described as unclear, flows described as unnecessarily complex, a Business Center dashboard reviewers find awkward — and about support and sales, where slow responses and stale pricing information come up repeatedly. The public rating data is too thin to lean on (eight Trustpilot reviews on an unclaimed profile, a near-empty BBB record filed to a PO box), but the pattern of complaint repeats everywhere the sample is larger.

None of it suggests a gateway that fails. It suggests a platform that costs real engineering time to adopt and does not offer much hand-holding while you do it.

How to decide

• If you sell across borders and want to add local acquirers without rebuilding checkout, Cybersource's reach is hard to match and is the reason to be here.
• If fraud losses are a material line in your P&L, Decision Manager is worth pricing seriously; the Visa data input is a real edge.
• If you have no in-house developer, look elsewhere. The integration is the single most-cited difficulty.
• If you are a small or mid-sized merchant, start with Authorize.net — the same Visa family, published pricing, self-serve signup.
• Whatever you buy, get the module list, the per-transaction cost of each module, the contract term, and written confirmation that you can export your tokens.

The B is a strong product held back by how it is sold. Cybersource does the hard part — global reach, network-grade fraud modelling, five-nines availability — better than almost anyone. It just will not tell you what that costs until you are already in a sales process, and it expects you to bring engineers.