Cyber Deception Platform

Labyrinth Deception Platform detects attackers inside the network at an early stage. It places decoys across the network that look like real servers, workstations, network devices, files and industrial (OT/SCADA) systems. Legitimate users have no reason to touch a decoy, so any interaction with one is a strong sign of an intruder, a compromised account or a malicious insider.

When an attacker engages a decoy, the platform records what they do and raises an alert with the details a security team needs to investigate, including the source host, the techniques used and the order of their actions.

How it works

• Points are decoy hosts that imitate real services, devices and content, including industrial protocols such as Modbus, Siemens S7comm and MQTT.
• Workers are hosts or virtual machines that run the Points and can place them across several network segments (VLANs).
• Seeder agents place decoy files and other lures on real servers and workstations to lead attackers towards the Points.
• Admin is the central console for managing decoys, alerts and integrations.

Key capabilities

• Early detection of reconnaissance, lateral movement and misuse of stolen credentials inside the network
• Few false alerts, because only an attacker has a reason to interact with a decoy
• A full record of each attack for investigation
• Coverage of IT, OT and cloud environments
• Integration with SIEM, SOAR, EDR, XDR and NDR systems
• Automated response through those integrations, such as isolating a host or ending a session based on the severity of an alert
• Decoys run on their own Worker hosts, separate from production systems