Make suspicious infrastructure interactions visible. DecoyStack runs multiple isolated, product-specific infrastructure decoys on a single Linux host to capture unauthorized discovery and lateral movement.
Attackers inspect network segments looking for hypervisors, backup storage and directory services before deploying payloads. Legitimate users have no operational reason to interact with decoy infrastructure.
Decoys carry no production workload. Any inbound connection, credential attempt or port scan represents unexpected activity requiring immediate investigation.
Decoy instances contain no real company records, operational credentials or production keys. Egress traffic is dropped by default at the namespace boundary.
Deploy dozens of distinct infrastructure identities across different subnets from one Linux host, without managing dozens of heavy virtual machines.
Every profile implements selected, bounded protocol surfaces tested against network scanners and protocol analyzers. Candidates lacking authentic protocol evidence remain in research.
Identities mirroring management planes where attackers seek hypervisor control and VM snapshots.
Emulated backup repositories and catalog management surfaces targeted during ransomware preparation.
Authentic SMB, Kerberos and LDAP surfaces that capture domain reconnaissance and credential spraying.
Hardware BMC endpoints frequently scanned by attackers seeking firmware-level persistence.
Firewall and gateway management interfaces that attackers probe to map perimeter rules.
Bounded management surfaces covering remote administration, terminal access and web consoles.
DecoyStack uses standard Linux kernel namespaces and nftables rules to run multiple synthetic identities without cross-contamination or pivot risk.
Each decoy instance operates in a dedicated Linux network namespace with its own IP address, synthetic MAC address, isolated ARP cache and independent TLS certificates.
A compromised decoy cannot be used as an attack pivot. Outbound network traffic is dropped at the firewall layer, containing all interaction within the local instance.
DecoyStack emits structured security telemetry with full instance context, source attribution and ATT&CK mapping for ingestion by Splunk, Elastic, Sentinel or syslog collectors.
DecoyStack is currently in private development. We share transparent milestones to set clear expectations with prospective design partners.
23 infrastructure profiles have completed multi-instance qualification testing, validating concurrent execution and isolation boundaries on Linux.
Appliance packaging, clean update paths and enterprise support tooling are under active engineering prior to general release.
We are collaborating with select security teams and MSSPs to validate deployment topologies, decoy placement and telemetry workflows.
If your team operates enterprise infrastructure or manages security detection, connect with us to discuss your environment and explore technical evaluation opportunities.
We work directly with engineering and detection teams who manage production network segments.