Hash matching remains an essential part of CSAM detection, but the rapid growth of generative AI has exposed its structural limitation: it can only match content that has already been identified and added to a database.

NCMEC received approximately 4,700 reports involving generative AI in 2023. That figure rose to 67,000 in 2024. In 2025, NCMEC recorded 1.5 million reports with a generative AI nexus, although more than 1.1 million were submitted by Amazon AI Services in connection with potential CSAM in AI training datasets and did not include actionable offender or victim information. More than 182,000 other reports involved offenders possessing, generating, or attempting to generate generative AI CSAM.

This guide compares seven CSAM detection tools across detection method, coverage of known and novel material, reporting support, scale, access, and best-fit platform type.

Why Detection Method Is the First Question to Ask

Every CSAM detection vendor leads with accuracy figures. Before comparing those numbers, platform teams should ask which categories of material the product is technically capable of detecting.

Hash matching generates a fingerprint of a file and compares it against a database of fingerprints from previously identified material. Cryptographic hashes detect exact copies. Perceptual hashing, used by tools such as Microsoft PhotoDNA and Shield by Project Arachnid, can also detect visually similar versions that have been resized, cropped, recolored, or otherwise modified.

The limitation is that both methods depend on an existing database entry. If an image was newly produced by an offender or generated by an AI model and has never been identified and hashed, hash matching alone will return no match. Once that material has been discovered and added to a hash database, hash tools may detect subsequent copies.

AI classification analyzes visual characteristics rather than looking only for an existing fingerprint. A classifier can therefore flag previously unseen material that has no known hash. The tradeoff is that AI classification produces probabilistic results and can generate false positives, while a verified hash match to known CSAM can provide much higher certainty.

A strong production workflow combines both approaches: hashing for high-confidence identification of known material and AI classification for first-generation and previously unseen synthetic content. For a deeper explanation, read Why Hash Matching Alone Can’t Protect Your Platform and How CSAM Detection Evolved From Hashing to AI.

What Platforms Are Legally Required to Do

Detection capability and legal reporting obligations should be evaluated separately.

In the United States, 18 U.S.C. § 2258A requires covered electronic service providers to report apparent violations to the NCMEC CyberTipline after obtaining actual knowledge of relevant facts or circumstances. The statute does not create a general duty to monitor users or affirmatively search every file for violations.

The REPORT Act, signed into law in 2024, expanded reporting requirements to cover offenses including online enticement and child sex trafficking, extended the required preservation period for report-related information, and increased penalties for knowing and willful failures to report.

In the United Kingdom, services covered by the Online Safety Act must conduct illegal-content risk assessments, implement appropriate safeguards, and maintain required records. Ofcom’s illegal-content guidance explains how these duties apply to regulated services.

In the European Union, the Digital Services Act establishes notice-and-action procedures, transparency requirements, and a trusted-flagger framework. It does not impose a general monitoring obligation on every platform.

The legal and financial consequences of inadequate child-safety practices are becoming more visible. In March 2026, a New Mexico jury ordered Meta to pay $375 million after finding the company liable for misleading consumers about platform safety and endangering children. The New Mexico Department of Justice described it as the first state trial victory against a major technology company over harm to young people. Read CaseScan’s analysis of what the Meta verdict means for platform CSAM detection.

A detection tool that flags content but produces no structured record may still leave trust and safety teams assembling incident information manually. Reporting support should therefore be evaluated alongside detection accuracy, even when the final legal submission remains the platform’s responsibility.

The 7 Best CSAM Detection Tools

1. CaseScan

CaseScan is designed for platforms that need real-time detection of both known and previously unseen CSAM. It pairs a deep-learning AI classifier with perceptual and exact hashing, allowing it to match catalogued material while also flagging first-generation and synthetic content that has not yet entered a hash database.

CaseScan scans more than 2 billion files per day. For single-frame image analysis, its published performance benchmarks show P95 end-to-end latency below one second and P99 below two seconds. Its stateless, cloud-native architecture supports horizontal auto-scaling without latency degradation during traffic spikes.

Under its Zero Media Retention policy, processed images remain in volatile memory and are not written to disk. This reduces the storage attack surface and limits data-retention exposure for platforms processing highly sensitive content.

CaseScan offers customer-selectable operating profiles based on the desired balance between recall and false alerts:

• Autonomous Maximum Precision: 69.34% recall and approximately one false positive per 45 million general-traffic images.
• High Coverage with Review: 85.93% recall and approximately one false positive per 1.9 million general-traffic images.
• Maximum Recall: 95.48% recall and approximately one false positive per 75,977 general-traffic images.

The optional Context Analysis engine is designed to distinguish potential CSAM from difficult benign scenarios, including medical imagery, family photos, and adult content.

The performance documentation also provides an illustrative account-level calculation. Under a simple independence assumption, a 70% per-image recall rate produces approximately a 99.8% probability of detecting at least one of five offending uploads. This is a statistical model rather than a measured account-level result.

CaseScan’s compliance dashboard tracks incidents and takedowns and exports evidence kits. The output can include a risk score, recommended action, and structured evidence file, supporting internal review and reporting workflows. Named customers include Wix and DoubleVerify. The technology has also been deployed and field-validated by more than 100 law enforcement units globally, including the FBI and HSI.

Gaps: Direct CyberTipline submission and detailed EU DSA or UK Online Safety Act implementation workflows are not covered in the current public documentation.

Best for: High-volume UGC platforms, cloud and file-sharing providers, ad-verification operators, and platforms that need detection of both known and previously unseen CSAM.

Explore CaseScan’s CSAM detection API for content platforms

2. Safer by Thorn

Safer by Thorn offers tools for known and novel CSAM detection. Safer Match uses multiple hashing methods to compare content against known CSAM hash lists. Safer Predict uses machine-learning classifiers to assess whether previously unseen images and videos are likely to contain CSAM.

Thorn says its predictive models are trained on confirmed CSAM and real conversations, giving the product access to specialized child-safety data that general-purpose moderation models may not have. Customers can use an API-based deployment or a self-hosted option.

Gaps: Public materials do not provide detailed throughput, latency, false-positive, or SLA figures comparable to CaseScan’s operating-profile documentation. Reporting and workflow details should be confirmed during procurement.

Best for: Platforms that prioritize Thorn’s child-safety expertise and want both known-CSAM matching and predictive detection of novel material.

3. Hive Moderation

Hive’s CSAM detection product uses Thorn’s Safer technology rather than a CSAM engine developed entirely by Hive. It provides known and novel CSAM detection through Hive’s broader moderation platform, which also covers visual content, text, audio, and other policy categories.

Hive has also integrated NCMEC’s CyberTipline into its Moderation Dashboard. Customers with valid NCMEC credentials can submit reports from the review workflow with company, moderator, content, and incident information.

The main advantage is consolidation: platforms can manage CSAM detection alongside other moderation categories through one vendor and dashboard. The tradeoff is that Hive’s core CSAM detection capability depends on Thorn’s technology and product roadmap.

Gaps: Public pricing, throughput, latency, and CSAM-specific SLA figures are limited.

Best for: Platforms that need broader visual, text, and audio moderation alongside CSAM detection and want direct NCMEC reporting through a moderation dashboard.

4. Google CSAI Match

Google’s child-safety toolkit includes CSAI Match and the Content Safety API, both available free of charge to qualifying partners.

CSAI Match is a YouTube-developed video-matching tool that identifies reuploads of previously identified abusive video content. It is particularly useful for platforms with substantial video-upload volume and can identify known abusive segments even when they appear inside longer videos.

The Content Safety API uses AI classifiers to prioritize images and videos that are more likely to contain abusive material for human review. It is a triage tool rather than an autonomous enforcement or compliance-reporting system.

Gaps: CSAI Match is limited to known video material. The Content Safety API prioritizes potential content for review but does not replace human verification or a platform’s reporting workflow. Access requires qualification through Google’s partner program.

Best for: Qualifying organizations that need a free video-matching layer or AI-assisted prioritization for human review.

5. Microsoft PhotoDNA

Microsoft PhotoDNA is one of the most widely deployed perceptual-hashing technologies for detecting known child sexual abuse imagery. It generates a non-reversible fingerprint and compares it against fingerprints of previously identified material.

Unlike a basic cryptographic hash, PhotoDNA can recognize visually similar images after common transformations such as resizing or minor editing. However, it still requires a known reference image and cannot classify first-generation material with no existing hash.

The PhotoDNA Cloud Service is free for qualified organizations, businesses, nonprofits, law enforcement agencies, and tool providers.

Gaps: PhotoDNA is designed for known still-image matching. It does not provide an AI classifier for novel CSAM or an end-to-end moderation and reporting workflow.

Best for: Organizations that need a trusted, free perceptual-hashing layer for known CSAM. It is best used as part of a broader detection program rather than as the only detection method.

6. Shield by Project Arachnid

Shield by Project Arachnid is a no-cost API developed by the Canadian Centre for Child Protection. It allows electronic service providers to compare incoming or existing media against Project Arachnid’s list of known digital fingerprints.

Shield uses exact and perceptual matching and can identify both verified CSAM and certain harmful-abusive images of children that may violate a platform’s policies even when the material does not meet a specific criminal threshold.

As of July 2026, Project Arachnid had processed more than 176 billion images and issued more than 141 million takedown notices. Its global analyst network includes child-protection organizations and hotlines across multiple countries.

Gaps: Shield is designed for known content and cannot classify first-generation or previously unseen AI-generated material until that content has been identified and fingerprinted. Public throughput and SLA figures for the Shield API are limited.

Best for: Electronic service providers that need a no-cost known-CSAM detection layer with broader harmful-abusive content coverage.

7. Cloudflare CSAM Scanning Tool

Cloudflare’s CSAM Scanning Tool compares images served through the Cloudflare cache against known CSAM lists supplied by child-safety organizations, including NCMEC.

When the tool identifies a matching fuzzy hash, Cloudflare creates a detection event, takes steps to block access where applicable, and notifies the website owner. The feature is available through the Cloudflare dashboard on all plans.

Gaps: The tool operates on cached content and known hashes. It does not provide an AI classifier for first-generation or previously unseen synthetic CSAM. Website operators remain responsible for reviewing incidents, removing material from their origin infrastructure, and completing any required reports.

Best for: Cloudflare customers that want a free, low-effort known-CSAM scanning layer at the infrastructure level.

CSAM Detection Tool Comparison

How to Choose the Right Tool for Your Platform

High-Volume UGC and Social Platforms

Look for a genuine AI classifier, real-time throughput, documented false-positive rates, and structured evidence export. Hash-only tools cannot identify previously unseen AI-generated content, although they may detect copies after the material has been identified and hashed.

CaseScan and Safer are the two hybrid enterprise options evaluated in this guide. Detailed recall, false-positive, and latency benchmarks are published for CaseScan, while comparable Safer figures generally require a procurement conversation.

Cloud Storage and File-Sharing Providers

Consider where scanning occurs in the upload pipeline. Scanning before a file is stored or made available may reduce exposure and prevent prohibited material from entering the main storage environment.

CaseScan’s API and SDK support scanning at upload or ingestion, including before storage when integrated into the customer’s content pipeline. Any implementation will still require product and engineering work.

Video Platforms

Google CSAI Match provides known-video matching, while Google’s Content Safety API assists with prioritizing potentially abusive images and videos for review. CaseScan also supports image and video ingestion through its API and SDK.

CaseScan’s published throughput, latency, and accuracy benchmarks are based on single-frame image analysis, so platforms should request video-specific performance and implementation details during evaluation.

Smaller Electronic Service Providers and Hosting Companies

PhotoDNA, Shield by Project Arachnid, and Cloudflare’s CSAM Scanning Tool can provide a free starting layer for known content. They should be treated as a baseline rather than complete coverage for platforms exposed to first-generation or AI-generated CSAM.

Law Enforcement

Law-enforcement workflows have different requirements, including fully offline operation, rapid on-scene results, investigator-controlled review, chain-of-custody documentation, and support for field and lab triage.

CaseScan for law enforcement supports fully offline, on-device field and lab triage. It has also been tested by ICAC investigators in active investigation workflows. Read the CaseScan field results from ICAC investigators and the guide to evaluating CSAM triage tools for ICAC units.

Agencies should separately verify chain-of-custody documentation, prosecution support, expert-witness resources, and admissibility requirements for their jurisdiction before selecting any tool.

How We Evaluated These Tools

Six criteria determined the order and recommendations in this guide:

1. Detection breadth: Whether the tool can detect only known material or also flag first-generation and previously unseen synthetic content.
2. Published performance data: Whether the vendor provides recall, false-positive rates, latency, and a clear explanation of how those figures were measured.
3. Reporting support: Whether the product exports structured evidence, supports review workflows, or offers direct CyberTipline integration.
4. Scalability: Published throughput, latency, deployment model, and ability to handle traffic spikes.
5. Cost and access: Free qualifying programs, cloud APIs, self-hosted options, and enterprise sales requirements.
6. Operational validation: Named customers, law-enforcement adoption, specialist training data, and documented field use.

CaseScan publishes recall and false-positive rates across multiple operating modes. Its technical white paper explains which figures are lab-measured, which are production-derived, and where validated adjustments were used. The platform page separately publishes a 98%+ detection precision benchmark, although precision is not provided separately for every operating profile.

CaseScan performance figures are based on the measurement methodology detailed in its technical white paper. Recall figures are lab-measured. False-positive figures are based on general-image production traffic unless otherwise stated, with validated adjustments used for certain Context Analysis operating points.

The growth of AI-generated CSAM has changed the procurement calculation for platforms that previously relied on hashing alone. A hash database grows by cataloguing material that has already been identified. It cannot anticipate new content. Platforms that need coverage across known, first-generation, and synthetic material should evaluate a hybrid detection stack that combines hashing, AI classification, human review, and a documented reporting process.

See how CaseScan fits your upload volume and content-safety workflow.

Frequently Asked Questions

What is CSAM detection software?

CSAM detection software identifies potential child sexual abuse material in uploaded or stored content using hash matching, AI classification, or both. Platforms use it to detect prohibited material, route content for review, take enforcement action, and support legally required reports.

Hybrid tools such as CaseScan and Safer by Thorn combine hashing and AI classification, providing coverage for known catalogued material as well as previously unseen first-generation and synthetic content.

What is the difference between hash-based and AI-based CSAM detection?

Hash-based detection compares a file against a database of fingerprints from previously identified material. It is highly reliable for known content but cannot detect a new file that has no matching database entry.

AI classification analyzes visual characteristics and assigns a likelihood that previously unseen content contains CSAM. Hybrid tools combine both methods to provide broader coverage across known and novel material.

Are platforms legally required to scan for CSAM?

US federal law does not impose a general obligation on electronic service providers to proactively monitor every user or scan every file. However, covered providers must report apparent violations to NCMEC when they obtain actual knowledge of relevant facts or circumstances.

Other jurisdictions may impose broader risk-assessment, mitigation, record-keeping, and illegal-content duties. Platforms should obtain legal advice based on where they operate, the services they provide, and the users they serve.

Can hash-based tools catch AI-generated CSAM?

Hash-based tools can detect AI-generated CSAM after it has been identified, fingerprinted, and added to a relevant database. They cannot detect previously unseen AI-generated material for which no matching fingerprint exists.

AI classifiers analyze the visual content itself, allowing them to flag novel synthetic material. NCMEC’s 2025 data makes this capability increasingly important for high-volume platforms.

Which CSAM detection tool is best for high-volume UGC platforms?

High-volume platforms should prioritize real-time AI classification, hashing for known material, scalable throughput, documented false-positive rates, and structured reporting support.

CaseScan scans more than 2 billion files per day, with published P95 latency below one second for single-frame image analysis. It combines perceptual and exact hashing with AI classification and provides a compliance dashboard with exportable evidence kits. It is used by Wix and DoubleVerify and has been deployed and field-validated by more than 100 law enforcement units globally, including the FBI and HSI.

What is a false-positive rate in CSAM detection?

A false positive occurs when benign content is incorrectly flagged as potential CSAM. High false-positive rates can overwhelm review teams, delay investigations, and create unnecessary user and business risk.

CaseScan’s published benchmarks show 69.34% recall and approximately one false positive per 45 million general-traffic images in its Autonomous Maximum Precision profile. Its secondary Context Analysis engine is designed to distinguish potential CSAM from medical imagery, family photos, and adult content.

Does CaseScan store the images it scans?

No. Under CaseScan’s Zero Media Retention policy, processed images remain in volatile memory and are not written to disk. This reduces storage and security exposure and supports privacy-conscious platform architectures.