[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:deception":3},{"control":4,"products":25,"stories":88,"lessons":131,"related":156,"compare":185},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.","Decoys that no legitimate user has any reason to touch: fake servers, fake admin accounts, planted credentials, cloud keys and documents that raise an alarm the moment they are used. Because normal work never trips them, an alert almost always means a real intruder. Honeypots on the internet also show which new vulnerabilities attackers are exploiting, often before an advisory is out.","Detection tools struggle with attackers who use valid accounts and built-in admin tools, because that looks like normal work. A decoy turns this around: touching it is suspicious by definition, so its alerts are rare, trustworthy and early, while the attacker is still exploring. Deception is cheap to start with, small teams can run it, and it complements EDR and monitoring rather than replacing them.",[11,12,13,14],"What kinds of decoys does it offer: servers, accounts, credentials, cloud keys, documents? How realistic are they?","How are decoys kept believable as our environment changes, without manual work?","How do alerts reach our SOC or SIEM, and what does a typical false positive look like?","Could an attacker recognise or abuse the decoys, and how is the platform itself protected?","Risk: intruders moving through the network undetected after the first break-in. Control: decoy systems, accounts and credentials across the network, identity systems and cloud, alerting the SOC. Owner: security operations lead. Measure: share of network segments and cloud accounts covered by decoys, and time from a decoy being touched to response.",[17,18,19,20],"NIST SP 800-53 Rev. 5 SC-26: decoys","MITRE Engage: adversary engagement and deception","ISO\u002FIEC 27001:2022 A.8.16: monitoring activities","NIS2 Art. 21(2)(b): incident handling",{"name":22,"slug":23},"Logging & Monitoring","logging-monitoring","2026-10-16T16:05:05.104475+00:00",[26,34,39,47,52,60,68,72,80],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-advanced-threat-defense","ShadowPlex Advanced Threat Defense","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fadvanced-threat-defense\u002F","Deception that detects lateral movement and insider threats early, using AI to place and tune decoys.",{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":35,"product_name":36,"url":37,"description":38},"shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":40,"vendor_name":41,"vendor_logo":42,"product_slug":43,"product_name":44,"url":45,"description":46},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-builder","Defused Builder","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Fbuilder","Runs Defused decoys on your own infrastructure, in the cloud, on premises or both, so the data stays with you. In early access.",{"vendor_slug":40,"vendor_name":41,"vendor_logo":42,"product_slug":48,"product_name":49,"url":50,"description":51},"defused-ex","Defused EX","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Fex","Managed honeypots placed next to your VPNs, firewalls and gateways and made to look like your own infrastructure, alerting on attacks aimed at your perimeter.",{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortideceptor","FortiDeceptor","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Ffortideceptor","Deception platform that deploys decoys to expose attacks coming from outside or inside the network.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"thinkst-canary","Thinkst Canary","\u002Fvendor-logos\u002Fthinkst-canary.png","canarytokens","Canarytokens","https:\u002F\u002Fcanarytokens.org\u002F","Free tripwires, such as fake documents, cloud keys, web links and DNS names, that notify you when an attacker opens or uses them.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":69,"product_name":62,"url":70,"description":71},"canary","https:\u002F\u002Fcanary.tools\u002F","Hardware, virtual and cloud honeypots that pose as servers, routers or file shares and alert the moment an attacker interacts with them.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"tracebit","Tracebit","\u002Fvendor-logos\u002Ftracebit.png","tracebit-canaries","Tracebit Security Canaries","https:\u002F\u002Ftracebit.com\u002Fplatform\u002Fcredentials-and-artifacts","Deploys and maintains decoy credentials, cloud resources and files across AWS, Azure, Google Cloud, Kubernetes, CI\u002FCD, identity providers and workstations.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-deception","Zscaler Deception","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fdeception-technology","Decoys built into the Zscaler platform that turn any attacker interaction into a confirmed alert.",{"total":89,"last_days":89,"recent":90},21,[91,96,101,106,111,116,121,126],{"slug":92,"title":93,"published_at":94,"brief":95},"federal-agencies-recommend-cyber-controls-independent-testing-for-frontier-ai-sy-fb152e","Federal agencies recommend cyber controls, independent testing for frontier AI systems","2026-10-17T00:34:02+00:00","Federal agencies issue cybersecurity guidance for AI testing environments.",{"slug":97,"title":98,"published_at":99,"brief":100},"openai-employee-arrested-for-allegedly-planting-hidden-recorder-in-executive-con-4bc4c1","OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room","2026-10-14T01:59:25+00:00","OpenAI employee arrested for planting hidden recorder in executive conference room.",{"slug":102,"title":103,"published_at":104,"brief":105},"an-openai-employee-allegedly-used-a-chatbot-to-help-plant-a-recording-device-at--d1479a","An OpenAI Employee Allegedly Used a Chatbot to Help Plant a Recording Device at the Office","2026-10-13T23:17:59+00:00","OpenAI engineer accused of using AI to plan planting of listening device at company.",{"slug":107,"title":108,"published_at":109,"brief":110},"ai-is-getting-really-good-at-messing-with-cybercriminals-e83db6","AI Is Getting Really Good at Messing With Cybercriminals","2026-10-10T12:00:00+00:00","AI-powered bots are being used to engage and gather intelligence from cybercriminals.",{"slug":112,"title":113,"published_at":114,"brief":115},"social-engineering-detection-moves-into-the-live-conversation-1fd609","Social Engineering Detection Moves Into the Live Conversation","2026-10-06T08:38:14+00:00","New AI-powered technology aims to detect social engineering in live conversations.",{"slug":117,"title":118,"published_at":119,"brief":120},"openai-pauses-tool-use-after-agent-bypasses-internet-controls-to-reach-external--50972d","OpenAI Pauses Tool Use After Agent Bypasses Internet Controls to Reach External Chatbot","2026-09-29T04:45:20+00:00","OpenAI pauses AI model training after agent bypasses internet controls.",{"slug":122,"title":123,"published_at":124,"brief":125},"windows-linux-android-file-notification-systems-leak-user-activity-efebb5","Windows, Linux, Android File Notification Systems Leak User Activity","2026-09-25T10:53:32+00:00","File notification systems on Windows, Linux, Android, and macOS can leak user activity.",{"slug":127,"title":128,"published_at":129,"brief":130},"autonomous-ai-hacks-raise-thorny-questions-of-legal-accountability-1ac761","Autonomous AI Hacks Raise Thorny Questions of Legal Accountability","2026-09-24T20:35:21+00:00","Autonomous AI models from major tech companies have hacked into other organizations during testing.",[132,136,140,144,148,152],{"slug":133,"title":134,"published_at":135},"federal-agencies-issue-cybersecurity-guidance-for-frontier-ai-systems","Federal Agencies Issue Cybersecurity Guidance for Frontier AI Systems","2026-10-17T02:20:17.238+00:00",{"slug":137,"title":138,"published_at":139},"insider-threat-hidden-recorder-found-in-openai-executive-conference-room","Insider Threat: Hidden Recorder Found in OpenAI Executive Conference Room","2026-10-14T04:20:18.348+00:00",{"slug":141,"title":142,"published_at":143},"insider-threat-openai-engineer-allegedly-plants-covert-recording-device-using-ai-tools","Insider Threat: OpenAI Engineer Allegedly Plants Covert Recording Device Using AI Tools","2026-10-14T00:20:34.271+00:00",{"slug":145,"title":146,"published_at":147},"ai-honeypots-turn-the-tables-on-scammers-by-wasting-their-time-and-harvesting-intel","AI Honeypots Turn the Tables on Scammers by Wasting Their Time and Harvesting Intel","2026-10-10T14:20:33.99+00:00",{"slug":149,"title":150,"published_at":151},"ai-powered-social-engineering-defeats-traditional-security-training","AI-Powered Social Engineering Defeats Traditional Security Training","2026-10-06T10:21:05.41+00:00",{"slug":153,"title":154,"published_at":155},"ai-agent-bypasses-sandbox-controls-via-dns-loophole","AI Agent Bypasses Sandbox Controls via DNS Loophole","2026-09-29T08:21:38.931+00:00",[157,161,165,169,173,177,181],{"slug":158,"name":159,"problem":160},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":162,"name":163,"problem":164},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",{"slug":166,"name":167,"problem":168},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":170,"name":171,"problem":172},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",{"slug":174,"name":175,"problem":176},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",{"slug":178,"name":179,"problem":180},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":182,"name":183,"problem":184},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"defused\u002Fdefused-ex":186,"zscaler\u002Fzscaler-deception":192,"fortinet\u002Ffortideceptor":209,"thinkst-canary\u002Fcanary":225,"acalvio\u002Fshadowplex-identity-protection":235,"tracebit\u002Ftracebit-canaries":244,"defused\u002Fdefused-builder":251,"thinkst-canary\u002Fcanarytokens":254,"acalvio\u002Fshadowplex-advanced-threat-defense":259},{"hq_country":187,"also_provides":188,"reviews":189,"affected":190,"reported":191},null,[],[],0,12,{"hq_country":193,"also_provides":194,"reviews":195,"affected":190,"reported":208},"US",[],[196,199,202,205],{"label":197,"url":198},"CyberRatings 2025 Q2 SSE Report: Zscaler","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q2-sse-report-zscaler\u002F",{"label":200,"url":201},"TechRadar: Zscaler Private Access review (2023)","https:\u002F\u002Fwww.techradar.com\u002Freviews\u002Fzscaler-private-access",{"label":203,"url":204},"Gartner Peer Insights: Zscaler Zero Trust Exchange user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fzscaler-zero-trust-exchange",{"label":206,"url":207},"PeerSpot: Zscaler Internet Access user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fzscaler-internet-access-reviews",3,{"hq_country":193,"also_provides":210,"reviews":211,"affected":224,"reported":191},[],[212,215,218,221],{"label":213,"url":214},"CyberRatings 2025 Q4 Enterprise Firewall Report: Fortinet follow-on","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q4-enterprise-firewall-report-fortinet-follow-on\u002F",{"label":216,"url":217},"CyberRatings 2025 Q1 Cloud Network Firewall Report: Fortinet","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q1-cloud-network-firewall-report-fortinet\u002F",{"label":219,"url":220},"Gartner Peer Insights: FortiGate Next-Generation Firewall user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Ffortigate-next-generation-firewall-2077436483",{"label":222,"url":223},"PeerSpot: Fortinet FortiGate user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Ffortinet-fortigate-reviews",28,{"hq_country":226,"also_provides":227,"reviews":228,"affected":190,"reported":190},"ZA",[],[229,232],{"label":230,"url":231},"Lenny Zeltser: Plant Honeytokens to Detect Intrusions (2026)","https:\u002F\u002Fzeltser.com\u002Fplant-honeytokens",{"label":233,"url":234},"TechCrunch: A decade in, bootstrapped Thinkst Canary reaches $20M in ARR without VC funding (2025)","https:\u002F\u002Ftechcrunch.com\u002F2025\u002F05\u002F29\u002Fa-decade-in-bootstrapped-thinkst-canary-reaches-20m-in-arr-without-vc-funding\u002F",{"hq_country":193,"also_provides":236,"reviews":240,"affected":190,"reported":190},[237],{"slug":238,"name":239},"identity-threat-detection","Identity threat detection and response (ITDR)",[241],{"label":242,"url":243},"Gartner Peer Insights: ShadowPlex Advanced Threat Defense user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fshadowplex-advanced-threat-defense",{"hq_country":245,"also_provides":246,"reviews":247,"affected":190,"reported":190},"GB",[],[248],{"label":249,"url":250},"Gartner Peer Insights: Tracebit user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Ftracebit-1156548213",{"hq_country":187,"also_provides":252,"reviews":253,"affected":190,"reported":191},[],[],{"hq_country":226,"also_provides":255,"reviews":256,"affected":190,"reported":190},[],[257,258],{"label":230,"url":231},{"label":233,"url":234},{"hq_country":193,"also_provides":260,"reviews":261,"affected":190,"reported":190},[],[262],{"label":242,"url":243}]