Decoys confirm the threat. The report tells you what to do about it.
Three parts: decoy systems only an attacker would touch, an incident report written for regulators and 2 AM founders, and a deployment that fits inside a lunch break.
Fake systems. Real signal.
You run convincing decoys inside your environment — a fake SSH server, a fake web server, and canary files placed next to your real documents. They look like the real thing to an attacker scanning your network. They hold no real data and connect to nothing real.
Decoys see no legitimate traffic, so alerts are high-signal: your team has no reason to ever touch a decoy. So when something does, it’s not an anomaly score — it’s an intruder, confirmed by their own behaviour.
The alert reaches you in seconds. Compare that with the global average of 181 days to identify a breach.
Written for the regulator. Readable at 2 AM.
Every incident generates a report that opens with the only question that matters, then walks you through severity, evidence, and exactly what to do next. Read a sample report →
The report opens with a plain-language verdict on both clocks — file or don’t — with the reasoning underneath.
Not a score out of ten. A sentence: “probing activity only; no login attempt succeeded and no data was involved.” Plus flags a founder needs — like when a source IP is inside the internal network ranges you configured.
Raw logs, a human-readable timeline, and an integrity hash. Retained 365 days in tamper-evident storage — what regulators expect if things escalate.
Two ways in. Pick the one you already understand.
No agents on your real systems to get started. Telemetry is outbound-only — you never open a port.
Run the decoy on any machine in your network, then start our forwarder next to it with the one Docker command your dashboard gives you. The forwarder phones home; nothing phones in.
Download a Word or Excel canary file from your dashboard and put it where your real documents live. Open it once to arm it. If anyone else opens it later, you get an alert.