Need indicators
This capability is usually relevant when these signals appear in the operating environment.
Need for high-confidence alerts.
Concern about hidden lateral movement.
Need to detect attackers before real assets are reached.
Back to solutions
Discuss your use case
What is this solution?
Deception places assets that normal workflows should not need, such as a decoy service or lure credential. Interactions create signals worth investigating because they fall outside expected business activity. Effectiveness depends on realistic placement without creating production access or treating every alert as a confirmed attack.
Cyber deception threat detection uses network decoy assets for deception lateral movement detection without treating every interaction as a confirmed incident.
Practical example
An internal device connects to a decoy service that staff are not expected to use. An analyst reviews the interaction and decides whether to investigate.
Technical summary and scope of use
Technical explanation
Cyber deception creates a simulated attack surface in IT and operational environments. Decoys mimic real network services, devices, content, and communications so defenders can detect interaction with them.
The solution deploys decoys that mimic services, systems, devices, files, links, and access keys. When an attacker or unauthorized user interacts with a decoy, it records observed behavior, tools, threat sources, and exploited vulnerabilities in the simulated environment.
Cyber deception adds a monitoring layer to the network. It presents realistic decoy services, devices, and files so defenders can detect interaction before an attacker reaches a real system.
When an attacker tries to explore or move within the network, he interacts with these false elements, the technology begins to record his activity, know his source, the tools he uses, and the routes he tries to exploit.
This gives security teams early warning before the threat reaches actual systems, helps improve network vision, reduces attacks detection time, supports quick response, and provides information that helps to understand the style of attack without affecting the operation of real infrastructure.
Scope of use
The technology is used in:
- Early detection of threats
- Slowing cyber attacks.
- Discover side movement within the network.
- Support for incidents
- Supporting digital investigations after incidents
- Protection of information technology, operating technologies, industrial systems and Internet of Things environments
Working in local environments, it supports information technology and operating technologies environments, industrial environments, divided networks, and multi-leasing environments.
The technical objective is:
- Provide early warning of threats before they reach live systems
- Reduce the time of attack on the network.
- Technical indicators can be analyzed and responded.
What it delivers
Core capabilities that turn the requirement into practical controls.
How it works
Supported Services and Protocols
IT and operational technology environments
Expected value
The impact security teams and leadership can expect from the right implementation.
Early detection
Lower alert noise
More focused investigation
Technical capabilities
Feature availability depends on product version, target systems, deployment, and integrations.
How it works
Simulate a realistic attack surface using decoys
Deploy decoys that resemble selected services and tie interactions to reviewable signals.
Use of decoys that simulate services, content and equipment
Expose a decoy target to detect unexpected interaction without exposing a production asset.
Attracting the attackers to an unreal structure.
Run repetitive steps under defined conditions and review failures and exceptions.
Attackers are involved in a simulated environment to slow the attack.
Use a non-production asset to gather investigation signals without exposing business assets.
Capture information about threat sources
Associate each decoy interaction with its source and the decoy asset so security teams can triage and investigate the alert.
The tools used in the attack.
Run repetitive steps under defined conditions and review failures and exceptions.
Discover the vulnerabilities.
Run repetitive steps under defined conditions and review failures and exceptions.
Analysis of the Attack
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Continuing the work of real infrastructure without impact
The technical file reminds that the real infrastructure continues to work without effect while the attacker interacts with the simulation infrastructure, supporting the operational impact of attacks.
Supported Services and Protocols
Emulate email services on decoy assets
Emulate a mail endpoint on an isolated decoy so reconnaissance attempts can trigger review.
Simulation of Web Applications
Run the scenario within an authorized scope and compare interaction and reporting before and after coaching.
The FTP Protocol
Run the scenario within an authorized scope and compare interaction and reporting before and after coaching.
The SSH Protocol
Provide an encrypted administration channel; verify host keys and restrict approved connection paths.
The SMTP protocol.
Run the scenario within an authorized scope and compare interaction and reporting before and after coaching.
The SMB protocol.
Expose a decoy SMB interface in an approved segment and correlate interactions with their source and context.
The MQTT server
Run the scenario within an authorized scope and compare interaction and reporting before and after coaching.
Simulation of industrial controls
Run the scenario within an authorized scope and compare interaction and reporting before and after coaching.
Support for Siemens S7COMM
Test the supported industrial service on an isolated decoy, not a production controller.
Support of the SNMP Protocol
Query network devices within defined permissions; validate protocol version and access settings before enabling it.
Support of the Modbus Protocol
Verify the supported industrial protocol scope in isolation before connecting it to an operational path.
Support MQTT servers to cheat Internet of Things environments
Expose a decoy target to detect unexpected interaction without exposing a production asset.
IT and operational technology environments
Support of information technology environments
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Supports operational technology (OT) environments
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Support for industrial networks
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Supporting industrial control environments
The technology uses simulation points for industrial control interfaces and industrial protocols, allowing detection of attempts to target industrial environments.
Support of the Internet of Things
The technology uses a MQTT server fake to expand the predictive coverage in IoT-related environments.
Support for specialized industrial networks
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Support for the simulation of devices and services within shared networks
Run the scenario within an authorized scope and compare interaction and reporting before and after coaching.
Publication support in isolated areas and internal networks
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Administration and operations
Local publication
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Centralized Management of Cheating Elements in Information Technology and Operational Technologies Environments
Expose a decoy target to detect unexpected interaction without exposing a production asset.
Easy to publish and maintain.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Flexible license options.
Match file characteristics against security-team rules to support detection and investigation.
Multiplatform support
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Multi-infrastructure tenants for large environments or managed service providers
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Integration
Support of third party integrations
Supports integration with external security tools to improve monitoring and response.
Support integration with security monitoring and analysis systems
Show activity within the covered scope and associate events with an asset or session during review.
Supporting integration with virtual and cloud platforms
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Monitoring and detection
Early detection of threats.
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Detect lateral movement
Show activity within the covered scope and associate events with an asset or session during review.
The attack of the man in the middle.
Show activity within the covered scope and associate events with an asset or session during review.
Surface incident indicators for faster triage
Show activity within the covered scope and associate events with an asset or session during review.
Reduce the time of attack.
Compare representative workflows before and after rollout to measure manual effort and processing time.
Discover targeted attacks.
Show activity within the covered scope and associate events with an asset or session during review.
Criminal investigation of cyber incidents
Show activity within the covered scope and associate events with an asset or session during review.
Provide an insight about the source of threat and the behavior of the attacker
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
How the technology works
Discovery
The technology displays the simulation elements representing services, devices and content within the network; any unexpected interaction with these elements is a early indicator of an investigative or aggressive activity.
Logical insulation and isolation.
Decoys draw attacker activity away from live systems. Interaction with a decoy gives defenders an earlier opportunity to detect and investigate that activity.
Monitoring and Analysis
The technology gathers accurate details of the interaction, such as the source of threat, the tools used, the exploited vulnerabilities, and the attacker's behavior, supporting security analysis and incident response.
Supporting industrial environments
The technology uses simulation points for industrial control interfaces and industrial protocols, allowing detection of attempts to target industrial environments.
Support of the Internet of Things
An MQTT decoy extends detection to IoT environments.
Reaction and Investigation
Behavior captured in the deception environment helps teams identify incidents earlier, reduce attacker dwell time, and support digital forensic investigations.
What to validate before rollout
- Choose realistic decoys without interfering with production services.
- Test what is recorded when a decoy is touched and what an analyst can review.
- Add context to incident workflows rather than treating every interaction as a confirmed attack.
Integration and scope
Define decoy types, placement, and alert ownership. Do not treat deception as a substitute for application protection or incident response.
Challenges this solution addresses
- Detection of threats within the network.
- Weak vision of side movement.
- Difficulty to understand the behavior of the attacker within the environment
- Difficulty in searching for services.
- Risk of targeted attacks
- Attack risks in the middle.
- Weak ability to collect technical details of the attack.
- Difficulty identifying sources of threats.
- Disadvantaged for digital investigations
- The time of the attacker remains within the network.
- Threats to industrial and operating technologies
- Threats of Industrial Protocols
- Internet of Things Threats
- The need to monitor the information technology and operating technologies environments from a central management
- The weak integration between discovery, response and analysis
Regulatory alignment
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
NCA · ECC 2:2024For entities within the scope of the Essential Cybersecurity Controls.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Management of assets | Supports the presence of monitoring elements within the environment and provides a vision of targeted services and devices Related capability: Simulation points for services and equipment | Applied |
| Protection of systems and processing facilities | It helps to detect malware activities before they reach the living systems. Related capability: Early detection and slowing attacks. | Applied |
| Network Security Management | Supports network traffic monitoring and side movement detection Related capability: Side movement detection and network communication simulation | Applied |
| Management of deficiencies | Discover the flaws that the attacker tries to exploit while interacting with a deception environment Related capability: Collecting the weaknesses | Applied |
| Management of records and monitoring of cybersecurity events | Provide data about threat sources, tools and behavior to support monitoring and analysis Related capability: Determination of the interaction with the decoys | Applied |
| Incident and threat management | Support early identification of incidents, investigation and understanding of the methods of attack from observed behavior Related capability: Rapid identification of incidents and criminal investigations | Applied |
| Cyber resistance and continuity of business | Helps to reduce the impact of attack by keeping real infrastructure continuous without effect Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Attracting the attacker to a simulation structure. | Applied |
| Security of third parties | Supports integration with external security tools to improve monitoring and response Related capability: Integration of the third party | Applied |
SAMA · CSFFor financial institutions within the Saudi Central Bank framework, subject to the control's applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Management of assets | The technology supports the existence of simulation elements representing services, devices and components within the environment, helping to provide a vision about the assets and services that the attacker tries to explore or interact with. Related capability: Simulation points for services, equipment and content | Applied |
| Risk Management | The technology helps to reduce the possibility of attacker accessing real systems by attracting it to a simulated environment, while providing data about threat sources, tools and fractions used to support risk analysis. Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Simulate the surface of a real attack and collect threat details | Applied |
| Management of deficiencies | The technology reveals the flaws that the attacker tries to exploit while interacting with decoys, supporting understanding of targeted weaknesses within the environment. Related capability: Discover the weaknesses used during the attack. | Applied |
| Security Monitoring | The technology provides early monitoring of abnormal interactions with services and simulated devices, and helps detect suspicious activities before accessing live systems. Related capability: Early detection of threats and monitoring interaction with decoys | Applied |
| Events and records. | The technology collects the details of the attackers’ activity within a simulated environment, including the source of threat, tools, behavior, and exploited fractions. Related capability: Determination of the interaction with the deception environment | Applied |
| Management of Networks | The technology supports the detection of side traffic within the network and attempts to move between services or network areas through distributed simulation elements. Related capability: Side movement detection and network communication simulation | Applied |
| Protecting the systems | The technology reduces the possibility of directly targeting live systems by creating fake services and devices that attract offensive activity away from the actual infrastructure. Related capability: Attracting the attacker to a simulation structure instead of real systems | Applied |
| Incident response | The technology provides detailed information that helps security teams quickly identify incidents, analyze the attacker’s behavior and support digital investigations. Related capability: Rapid identification of incidents and criminal investigations | Applied |
| Continuity of business | Decoys separate observed attacker interaction from production assets, helping reduce potential operational impact. Validate isolation and deployment impact in the target environment. Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Continuing the work of real infrastructure without impact | Applied |
| Security of third parties | The technology supports integration with external security systems and tools to improve monitoring, analysis and response. Related capability: Integration of the third party | Applied |
| Protection of Critical Environments | The technology supports operating technologies and industrial systems by simulating the interfaces of industrial controls and industrial protocols. Related capability: Simulation of industrial control interfaces and Siemens S7COMM, SNMP and Modbus protocols | Applied |
| compliance and audit | The technology provides reviewable data about threats, behaviors and observed attacks, supporting audit and security analysis activities. Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Interaction records and attack behavior analysis | Applied |
| Protection of Infrastructure | The technology supports infrastructure protection by simulating multiple services such as mail, web, file transfer, secure access, and networking bases. Related capability: Simulation of email and web services, FTP, SSH, SMTP and SMB | Applied |
| Operational Security | The technology helps in early detection, slowing attacks and reducing the time of the attacker remains within the environment, without affecting the operation of the real infrastructure. Related capability: Delay attacks and reduce the time of survival of the attacker. | Applied |
| Protection of sensitive financial systems | The Central Bank framework supports the confidentiality, security and availability of financial assets and services, and technology supports this by early detection of threats before they reach live systems and collecting indicators that help respond. Related capability: Early detection and aggregation of threat signs | Applied |
NCA · OTCC-1:2022For operational technology and industrial control environments to which the controls apply.
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Visibility and monitoring | Provides early vision of attempts to interact with services and simulating devices within industrial environments Related capability: Inflatable points of information technology, operating technologies and central management | Applied |
| Protection of industrial environments | Simulating the interfaces of industrial controls and industrial protocols Related capability: Industrial control interfaces and Siemens S7COMM, SNMP and Modbus protocols | Applied |
| Monitoring of assets | Supports monitoring interaction with simulated assets within industrial environments Related capability: Simulation of equipment and services | Applied |
| Discover threats. | Discover attempts of attack early and gather details of behavior and tools Related capability: Early detection of threats | Applied |
| Protection of Industrial Protocols | Supports industrial protocol simulation to detect targeting attempts Related capability: Siemens S7COMM, SNMP and Modbus protocols | Applied |
| Management of communication between information technology and operating technologies | Supports centralized management of decoys through different environments Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. Related capability: Central management of decoys | Applied |
| Incident response | Provides threat-source, tool, vulnerability, and behavior data to support response and investigation Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. Related capability: Rapid response and criminal investigation | Applied |
| Continuity of operation | Helps to continue the work of real infrastructure while the attacker interacts with the simulated environment Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: Continuing the work of real infrastructure without impact | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Questions before you start
How do we know this solution is right for us?
Start with the risk signals on this page. If they match your environment, they can be turned into a short assessment that defines scope, priority, and a practical implementation approach.
How do we start without adding operational complexity?
Start with a focused risk and scope assessment, then define implementation priorities, technical requirements, and phased rollout steps.
Related solutions
NDR
Network Detection and Response
Analyze network traffic to detect abnormal behavior and hidden threats.
Explore solutionEDR
Endpoint Detection and Response
Detect threat behavior on endpoints and support containment and investigation.
Explore solutionSIEM Advisory
Security Monitoring and SIEM Advisory
Design log sources, detection use cases, and investigation workflows before or during SIEM adoption.
Explore solutionReady for the next step?
Turn this need into a practical assessment and clear implementation plan.
Share your use case and priority systems so we can discuss a pilot and its integration requirements.