Systems and methods for performing a human user test when a high-risk network access is captured by an intermediary security device are provided. According to one embodiment, when an intermediary security device identifies a high-risk network access that is potentially initiated by a human user or a piece of software running on the device of the human user, a human user test message is sent to the human user to verify that the high-risk network access was indeed initiated by the human user. After a response to the human user test message is received by the intermediary security device, it is determined if the response is a correct response to the human user test. The security device allows the high risk network access if the response is correct.