Expert services · special projects · deception

Let the intruder tell you they’re in.

Decoys, honeytokens and traps placed where an attacker’s first move would touch them, so a compromise announces itself in minutes rather than months.

Talk to a senior operator →Or start with a hunt →
Why it works

An intruder has to look around.

Whoever gets in has to find their way: list the shares, try the credentials, read the documents, map the network. That looking around is the one thing they cannot skip.

A decoy is a thing no legitimate user touches. One touch is a high-fidelity alert, with none of the noise a detection rule brings.

A detection ruleone week
42 alerts, 1 real
A decoyone week
1 alert, 1 real
Nobody legitimate opens the decoy. So when it opens, you already know what it means.
What we deploy

Placed where we would go first.

Each one placed from how we would attack you, because we know which doors an intruder tries first.

Identity

Decoy accounts and credentials

Believable enough to try, watched closely enough to catch the attempt.

Files

Fake file shares and documents

The folder named for exactly what an intruder is hunting.

Cloud & code

Honeytokens

Cloud keys and API keys that do nothing except tell you they were used.

Hosts

Decoy hosts and services

Machines that exist to be scanned, logged in to, and reported.

Data

Canary records in databases

Rows that should never be read, and raise the alarm when they are.

How it runs

Designed from an attacker’s path. Proven by one.

The senior operator who designs the layer is the one who trips it, and the one in the room when we walk you through what fired.

  1. 01 Designed from an attacker’s path

    Often after a red team or a hunt has shown where one would go.

  2. 02 Deployed with your team

    So it stays believable to an intruder and invisible to your users.

  3. 03 Wired into your SOC or SIEM

    In the format your analysts already triage.

  4. 04 Tripped by us

    We attack it ourselves, to prove every decoy fires.

  5. 05 Kept believable

    A maintenance plan, so the decoys stay current and keep looking real.

What you walk away with

A layer that fires, and the proof.

A deception layer that fires

Decoys in the places an intruder goes first.

Proof that it fires

Because we attacked it, and you watched the alerts arrive.

The playbook for when it does

Who moves, what they do, and how fast.

A map of where it sits

Relative to what you would least like to lose.

Included

What every engagement includes.

Not a tier you pay extra for. Every client gets it.

01

Help beyond the scope

A problem outside what you hired us for? If we can help, we will.

02

Seniors on call

Reach the people who did the work, any time, for as long as you need them.

Go deeper

What our seniors learn here is encoded into Incenter: every engagement makes the engine smarter.

Want a compromise to announce itself? Set the traps.

Talk it through
Talk to a senior operator
Tell us what you would least like to lose. A senior operator tells you where the first trap goes.
Next step
Or start with a hunt
Not sure anyone is in? A hunt finds out, and shows where the decoys belong.