Overview
Labyrinth Deception Platform detects attackers inside the network at an early stage. It places decoys across the network that look like real servers, workstations, network devices, files and industrial (OT/SCADA) systems. Legitimate users have no reason to touch a decoy, so any interaction with one is a strong sign of an intruder, a compromised account or a malicious insider.
When an attacker engages a decoy, the platform records what they do and raises an alert with the details a security team needs to investigate, including the source host, the techniques used and the order of their actions.
How it works
- Points are decoy hosts that imitate real services, devices and content, including industrial protocols such as Modbus, Siemens S7comm and MQTT.
- Workers are hosts or virtual machines that run the Points and can place them across several network segments (VLANs).
- Seeder agents place decoy files and other lures on real servers and workstations to lead attackers towards the Points.
- Admin is the central console for managing decoys, alerts and integrations.
Key capabilities
- Early detection of reconnaissance, lateral movement and misuse of stolen credentials inside the network
- Few false alerts, because only an attacker has a reason to interact with a decoy
- A full record of each attack for investigation
- Coverage of IT, OT and cloud environments
- Integration with SIEM, SOAR, EDR, XDR and NDR systems
- Automated response through those integrations, such as isolating a host or ending a session based on the severity of an alert
- Decoys run on their own Worker hosts, separate from production systems
Photos
What happens next
- First meetingTell us about your network and what you need to protect.
- Demo or proof of conceptSee the product working, together with the vendor, before you decide.
- QuoteWe send you a quote for the solution.
- Installation by our engineersOur engineers install it and connect it to your systems.
- TrainingWe train your team to use it.
- Ongoing supportWe keep supporting you after it goes live.
