[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:deception":3},{"control":4,"products":25,"stories":88,"lessons":132,"related":157,"compare":186},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.","Decoys that no legitimate user has any reason to touch: fake servers, fake admin accounts, planted credentials, cloud keys and documents that raise an alarm the moment they are used. Because normal work never trips them, an alert almost always means a real intruder. Honeypots on the internet also show which new vulnerabilities attackers are exploiting, often before an advisory is out.","Detection tools struggle with attackers who use valid accounts and built-in admin tools, because that looks like normal work. A decoy turns this around: touching it is suspicious by definition, so its alerts are rare, trustworthy and early, while the attacker is still exploring. Deception is cheap to start with, small teams can run it, and it complements EDR and monitoring rather than replacing them.",[11,12,13,14],"What kinds of decoys does it offer: servers, accounts, credentials, cloud keys, documents? How realistic are they?","How are decoys kept believable as our environment changes, without manual work?","How do alerts reach our SOC or SIEM, and what does a typical false positive look like?","Could an attacker recognise or abuse the decoys, and how is the platform itself protected?","Risk: intruders moving through the network undetected after the first break-in. Control: decoy systems, accounts and credentials across the network, identity systems and cloud, alerting the SOC. Owner: security operations lead. Measure: share of network segments and cloud accounts covered by decoys, and time from a decoy being touched to response.",[17,18,19,20],"NIST SP 800-53 Rev. 5 SC-26: decoys","MITRE Engage: adversary engagement and deception","ISO\u002FIEC 27001:2022 A.8.16: monitoring activities","NIS2 Art. 21(2)(b): incident handling",{"name":22,"slug":23},"Logging & Monitoring","logging-monitoring","2026-10-16T16:05:05.104475+00:00",[26,34,39,47,52,60,68,72,80],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-advanced-threat-defense","ShadowPlex Advanced Threat Defense","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fadvanced-threat-defense\u002F","Deception that detects lateral movement and insider threats early, using AI to place and tune decoys.",{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":35,"product_name":36,"url":37,"description":38},"shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":40,"vendor_name":41,"vendor_logo":42,"product_slug":43,"product_name":44,"url":45,"description":46},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-builder","Defused Builder","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Fbuilder","Runs Defused decoys on your own infrastructure, in the cloud, on premises or both, so the data stays with you. In early access.",{"vendor_slug":40,"vendor_name":41,"vendor_logo":42,"product_slug":48,"product_name":49,"url":50,"description":51},"defused-ex","Defused EX","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Fex","Managed honeypots placed next to your VPNs, firewalls and gateways and made to look like your own infrastructure, alerting on attacks aimed at your perimeter.",{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortideceptor","FortiDeceptor","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Ffortideceptor","Deception platform that deploys decoys to expose attacks coming from outside or inside the network.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"thinkst-canary","Thinkst Canary","\u002Fvendor-logos\u002Fthinkst-canary.png","canarytokens","Canarytokens","https:\u002F\u002Fcanarytokens.org\u002F","Free tripwires, such as fake documents, cloud keys, web links and DNS names, that notify you when an attacker opens or uses them.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":69,"product_name":62,"url":70,"description":71},"canary","https:\u002F\u002Fcanary.tools\u002F","Hardware, virtual and cloud honeypots that pose as servers, routers or file shares and alert the moment an attacker interacts with them.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"tracebit","Tracebit","\u002Fvendor-logos\u002Ftracebit.png","tracebit-canaries","Tracebit Security Canaries","https:\u002F\u002Ftracebit.com\u002Fplatform\u002Fcredentials-and-artifacts","Deploys and maintains decoy credentials, cloud resources and files across AWS, Azure, Google Cloud, Kubernetes, CI\u002FCD, identity providers and workstations.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-deception","Zscaler Deception","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fdeception-technology","Decoys built into the Zscaler platform that turn any attacker interaction into a confirmed alert.",{"total":89,"last_days":90,"recent":91},37,33,[92,97,102,107,112,117,122,127],{"slug":93,"title":94,"published_at":95,"brief":96},"fbi-says-north-korean-hackers-stole-over-400-million-in-crypto-using-deepfake-vi-d32b5f","FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls","2026-11-13T14:28:58+00:00","North Korean hackers stole over $400M in crypto using deepfake video calls.",{"slug":98,"title":99,"published_at":100,"brief":101},"a-hacker-targeted-high-stakes-poker-players-with-malware-that-exposed-their-card-715f06","A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards","2026-10-29T10:30:00+00:00","Hacker used malware to expose poker players' cards, costing victims millions.",{"slug":103,"title":104,"published_at":105,"brief":106},"openai-ai-agents-demonstrate-vm-escapes-and-secret-cross-sandbox-communication-2b44ac","OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication","2026-10-25T06:54:29+00:00","OpenAI AI agents demonstrate VM escapes and cross-sandbox communication.",{"slug":108,"title":109,"published_at":110,"brief":111},"specter-attack-uses-usb-power-signals-to-leak-data-from-air-gapped-pcs-83858e","SPECTER Attack Uses USB Power Signals to Leak Data From Air-Gapped PCs","2026-10-24T16:02:19+00:00","SPECTER attack uses USB power signals to leak data from air-gapped PCs.",{"slug":113,"title":114,"published_at":115,"brief":116},"autonomous-attack-agent-in-skynet-mode-hijacks-other-models-to-carry-out-its-evi-9b482d","Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds","2026-10-24T13:02:00+00:00","Autonomous AI agent hijacks other models for attacks, capable of 100,000 steps without approval.",{"slug":118,"title":119,"published_at":120,"brief":121},"openai-ai-agents-bypass-security-isolation-exploiting-0-days-in-red-teaming-test-7e3b53","OpenAI AI Agents Bypass Security Isolation, Exploiting 0-Days in Red-Teaming Tests","2026-10-24T05:43:26+00:00","OpenAI AI agents exploited zero-days to escape sandboxes and reach the internet during red-teaming.",{"slug":123,"title":124,"published_at":125,"brief":126},"red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging-372c83","Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack","2026-10-23T19:14:57+00:00","OpenAI's AI agent monitoring system failed during Hugging Face attack, report finds.",{"slug":128,"title":129,"published_at":130,"brief":131},"exposed-infrastructure-reveals-how-ransomware-affiliates-used-ai-agents-to-execu-6fb95e","Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions","2026-10-23T17:50:47+00:00","Ransomware affiliates use AI agents for intrusions, leveraging an 'Autonomous Red Team Kill Chain Framework' called",[133,137,141,145,149,153],{"slug":134,"title":135,"published_at":136},"north-korean-deepfake-video-calls-drain-400m-in-crypto","North Korean Deepfake Video Calls Drain $400M in Crypto","2026-11-13T16:23:15.645+00:00",{"slug":138,"title":139,"published_at":140},"poker-malware-scheme-exposes-cards-and-machines-for-years","Poker Malware Scheme Exposes Cards and Machines for Years","2026-10-29T11:20:24.369+00:00",{"slug":142,"title":143,"published_at":144},"ai-models-escape-vm-sandboxes-and-communicate-covertly-during-openai-testing","AI Models Escape VM Sandboxes and Communicate Covertly During OpenAI Testing","2026-10-25T08:20:23.126+00:00",{"slug":146,"title":147,"published_at":148},"specter-attack-leaks-data-from-air-gapped-pcs-via-usb-power-signals","SPECTER Attack Leaks Data from Air-Gapped PCs via USB Power Signals","2026-10-24T17:20:26.001+00:00",{"slug":150,"title":151,"published_at":152},"autonomous-ai-agent-skynet-mode-hijacks-exposed-models-for-mass-attacks","Autonomous AI Agent 'Skynet Mode' Hijacks Exposed Models for Mass Attacks","2026-10-24T14:20:27.516+00:00",{"slug":154,"title":155,"published_at":156},"ai-agents-escape-sandboxes-by-chaining-zero-days-and-config-errors","AI Agents Escape Sandboxes by Chaining Zero-Days and Config Errors","2026-10-24T06:20:26.057+00:00",[158,162,166,170,174,178,182],{"slug":159,"name":160,"problem":161},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":163,"name":164,"problem":165},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",{"slug":167,"name":168,"problem":169},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":171,"name":172,"problem":173},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",{"slug":175,"name":176,"problem":177},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",{"slug":179,"name":180,"problem":181},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":183,"name":184,"problem":185},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"defused\u002Fdefused-ex":187,"zscaler\u002Fzscaler-deception":193,"fortinet\u002Ffortideceptor":210,"thinkst-canary\u002Fcanary":227,"acalvio\u002Fshadowplex-identity-protection":237,"tracebit\u002Ftracebit-canaries":246,"defused\u002Fdefused-builder":254,"thinkst-canary\u002Fcanarytokens":257,"acalvio\u002Fshadowplex-advanced-threat-defense":262},{"hq_country":188,"also_provides":189,"reviews":190,"affected":191,"reported":192},null,[],[],0,9,{"hq_country":194,"also_provides":195,"reviews":196,"affected":191,"reported":209},"US",[],[197,200,203,206],{"label":198,"url":199},"CyberRatings 2025 Q2 SSE Report: Zscaler","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q2-sse-report-zscaler\u002F",{"label":201,"url":202},"TechRadar: Zscaler Private Access review (2023)","https:\u002F\u002Fwww.techradar.com\u002Freviews\u002Fzscaler-private-access",{"label":204,"url":205},"Gartner Peer Insights: Zscaler Zero Trust Exchange user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fzscaler-zero-trust-exchange",{"label":207,"url":208},"PeerSpot: Zscaler Internet Access user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fzscaler-internet-access-reviews",4,{"hq_country":194,"also_provides":211,"reviews":212,"affected":225,"reported":226},[],[213,216,219,222],{"label":214,"url":215},"CyberRatings 2025 Q4 Enterprise Firewall Report: Fortinet follow-on","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q4-enterprise-firewall-report-fortinet-follow-on\u002F",{"label":217,"url":218},"CyberRatings 2025 Q1 Cloud Network Firewall Report: Fortinet","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q1-cloud-network-firewall-report-fortinet\u002F",{"label":220,"url":221},"Gartner Peer Insights: FortiGate Next-Generation Firewall user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Ffortigate-next-generation-firewall-2077436483",{"label":223,"url":224},"PeerSpot: Fortinet FortiGate user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Ffortinet-fortigate-reviews",31,14,{"hq_country":228,"also_provides":229,"reviews":230,"affected":191,"reported":191},"ZA",[],[231,234],{"label":232,"url":233},"Lenny Zeltser: Plant Honeytokens to Detect Intrusions (2026)","https:\u002F\u002Fzeltser.com\u002Fplant-honeytokens",{"label":235,"url":236},"TechCrunch: A decade in, bootstrapped Thinkst Canary reaches $20M in ARR without VC funding (2025)","https:\u002F\u002Ftechcrunch.com\u002F2025\u002F05\u002F29\u002Fa-decade-in-bootstrapped-thinkst-canary-reaches-20m-in-arr-without-vc-funding\u002F",{"hq_country":194,"also_provides":238,"reviews":242,"affected":191,"reported":191},[239],{"slug":240,"name":241},"identity-threat-detection","Identity threat detection and response (ITDR)",[243],{"label":244,"url":245},"Gartner Peer Insights: ShadowPlex Advanced Threat Defense user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fshadowplex-advanced-threat-defense",{"hq_country":247,"also_provides":248,"reviews":249,"affected":191,"reported":253},"GB",[],[250],{"label":251,"url":252},"Gartner Peer Insights: Tracebit user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Ftracebit-1156548213",1,{"hq_country":188,"also_provides":255,"reviews":256,"affected":191,"reported":192},[],[],{"hq_country":228,"also_provides":258,"reviews":259,"affected":191,"reported":191},[],[260,261],{"label":232,"url":233},{"label":235,"url":236},{"hq_country":194,"also_provides":263,"reviews":264,"affected":191,"reported":191},[],[265],{"label":244,"url":245}]