Captcha risk or score technique systems and methods are presented. A method can begin with extracting client information from the service request. The extracted client information may be used to determine if the client device has been identified as a computer bot. A captcha is also selected in response to the service request. Captcha instructions and expected captcha response are generated for the selected captcha. The captcha instructions are sent to the client device for processing and a captcha response from the client device may be received, which is compared to the expected response to determine based on the service policy if the client device is operating under control of a human user or operating autonomously. Risk levels may be associated with likelihood of the client device being a bot computer and operating autonomously or operating under control of a human user.