Turn suspicious infrastructure reconnaissance into clear security signals.
Deploy 23 lab-qualified, product-specific decoys across virtualization, backup, identity, and hardware controllers on a single Linux host. Unexpected interactions generate structured events with immediate decoy context for your SOC.
VMware vCenter 8 Decoy Interaction
Action Required
Spot unexpected infrastructure reconnaissance
Lateral discovery routinely probes management ports and storage endpoints. DecoyStack gives defenders early, high-confidence notification by placing high-value decoys in the attacker path.
Surface unauthorized probing
Legitimate administrative workflows have no business connecting to unmapped decoys. Every touch is an explicit anomaly worth investigating.
Protect critical surfaces
Simulate virtualization management nodes, backup targets, and hardware BMCs that adversaries search for during ransomware staging.
Preserve existing pipelines
Export structured events with rich source context directly into Splunk, Elastic, Sentinel, or QRadar through native JSONL, Syslog, or CEF.
High-context signal against telemetry fatigue
Network sensors produce millions of flow records. DecoyStack anchors incident response with an immediate, high-fidelity starting point.
Decoys for high-value targets
Deploy 23 lab-qualified decoy profiles across 5 primary infrastructure families matching the enterprise assets attackers seek during lateral movement.
Virtualization
Hypervisor management planes and control surfaces.
Backup Storage
Endpoints enumerated prior to ransomware execution.
Identity & Directory
Observe domain reconnaissance without risking domain assets.
Hardware BMC
Physical out-of-band server management controllers.
Network Security
Reconnaissance aimed at firewall management APIs.
Multiple decoys. One Linux host.
Run isolated synthetic identities on a single Linux appliance without the operational overhead of maintaining individual operating systems.
01 Select profiles
Choose from 23 implemented profiles matching assets running in your production network.
02 Deploy appliance
Launch isolated identities with dedicated synthetic IPs and kernel network namespaces.
03 Forward to SIEM
Stream structured alerts in JSONL, Syslog RFC 5424, or CEF directly into your SOC pipeline.
Containment engineered at the kernel level
Decoys intentionally attract reconnaissance. DecoyStack implements restrictive network policies designed to contain potential pivot paths within the local instance.
Default-deny egress
Outbound packets are dropped at the kernel firewall boundary, ensuring the decoy cannot initiate outbound reconnaissance or lateral hops.
Explicit IP binding
Listeners bind exclusively to designated synthetic IP addresses. No wildcard listeners (0.0.0.0) are ever opened on host interfaces.
Unprivileged execution
Each profile daemon runs with unprivileged user accounts within segregated network namespaces, preserving multi-tenant host safety.
Collaborate on early enterprise evaluation
We are working with SOC teams, security architects, MSSPs, and infrastructure engineers to validate decoy placement, detection topologies, and SIEM integrations.
- • Test decoy effectiveness against your adversary emulation scenarios
- • Verify telemetry streaming against your existing ingestion pipeline
- • Evaluate controlled pilot access as release packaging progresses
Technical Preview Notice: Discussions focus on architecture and early validation. No commercial purchase commitment is required.
Discuss a Design Partnership
Tell us about your infrastructure. We will follow up with technical details.