You deploy decoys: fake servers (SSH, databases, and more) that your staff never use. If something connects, it is not everyday IT work — it is reconnaissance or an attack. Zero false positives from normal business use.
To move deeper into a network, an intruder — or automated tooling, including AI-assisted attacks — must first scan: find hosts, try passwords, map what is reachable. Decoya makes that visible with decoys only a malicious visitor would touch.
Too many vague alerts
Network logs pile up — hard to tell what is serious and what is noise.
Under-watched areas
Branch offices, guest Wi‑Fi, lab VLANs: places where a scanner can pass unnoticed.
Reacting too late
Without dedicated traps, the first clear proof of intrusion may come after data is already leaving.
The Decoya response
Decoya runs decoy services on your network: believable fake SSH, web or database endpoints your teams never use. When an IP scans or connects, the console shows who, what and when — including automated or AI-driven recon that still has to scan to go further.
Protection coverage
Ten simulated attack surfaces, managed from one console.
Each decoy looks like a real service attackers usually hunt for. You pick protocols in the console; every touch is logged in plain language.
Remote access
SSHSuspicious connections, logins and commands
FTPUsername and password capture
TelnetLogin and password prompts
Web & Windows
HTTPDecoy portal and credential capture
RDPRemote access negotiation
Databases
MySQLConnection attempts and client details
PostgreSQLConnection attempts and credentials
MSSQLService discovery and connection attempts
Identity & DNS
LDAPIdentity queries and login attempts
DNSCaptured name-resolution requests
Ready-to-use profiles: web server, workplace environment, databases, legacy equipment or complete coverage.
Sentinel S1
Dedicated appliance
On-site protection, ready to operate.
Sentinel S1 stays on the network it protects and sends events to your console. Compact and autonomous, it fits every location without adding operational complexity.
DiscreetSensitive zones, server rooms or remote offices — simple network connection and remote configuration.
AutonomousLocal event continuity with automatic synchronization to the console.
ConsistentThe same services, profiles and monitoring experience across your entire organization.
Getting started
From adding a sensor to your first event.
01
Add the sensor
Name your sensor in the console and assign it to the site or network zone you want to monitor.
02
Turn on decoys
Pick a profile (office, web server, databases…). The sensor exposes fake services your users ignore — scanners and intruders do not.
03
Monitor & respond
Every decoy touch becomes an alert. Add email, webhooks or canary credentials for the most sensitive cases.
Decoya Console
Control, history and notifications.
One interface for your entire estate: sensor status, deployments, aggregated event feeds, alert rules and audit history. An interactive demo lets you explore everything before deploying a sensor.
Sensor view: availability, last synchronization and active configuration
Events: service, source address and useful activity details
Instant notifications, decoy credentials and multi-user management
Connections to your monitoring tools and automated workflows
Accessible early detection, without a six-month project.
Growing organizations
Start with one network sensor
Decoys on the LAN: if someone scans or connects, you get simple proof for leadership or insurers.
IT & security teams
Extend your existing defenses
Decoys reveal internal reconnaissance and lateral movement that central logs may filter out or bury.
Integrators & service providers
Manage multiple clients
Organize sensors by client site, review everything centrally and connect alerts to existing workflows.
What you gain
Actionable signals, not a mountain of logs.
↗
Zero false positives
Staff never use decoys in daily work. If something hits a trap, it is a malicious human or bot (scanner, malware, AI-driven chain) trying to move forward.
◎
Add decisive context
Plant fake credentials: if they are used, the alert is even clearer. History by sensor, IP and protocol.
✓
Respond faster
Send notifications, review the console and connect existing workflows to qualify, isolate or escalate quickly.
Pricing
Three ways to deploy software, hardware, or tailored.
€39 excl. tax / pack (3 sensors) · €59 excl. tax / Sentinel unit · stack both on one account.
01
Software
Sensors on your infrastructure (VM, Docker, or .deb) — no appliance.
A fake service you install on purpose (for example a fake SSH server). Your employees do not use it. If a connection arrives, someone with bad intent or automated tooling is exploring the network — including modern AI-assisted attacks that still have to scan to take control. Decoya alerts you right away.
Does Decoya replace a firewall or endpoint protection?
No. Decoya sets traps and reports; it does not block traffic. It complements firewalls and endpoint tools by showing who touches services that do not exist for your business.
Do I need to expose services to the Internet?
No. Start on the network where the sensor is plugged in (LAN, DMZ). Only the sensor-to-console link needs to be allowed (HTTPS in production).
What are canaries?
They are decoy credentials placed deliberately. If an attacker uses one, Decoya raises a priority alert — strong evidence that protected secrets have been accessed.
Where is the data stored?
Events are centralized in the console and retained according to your plan. Several hosting options can meet your security and data-location requirements.
How soon will I see events?
After connecting a sensor and choosing a protection profile, most teams observe scans or suspicious attempts within an hour on an active network.
Next step
Test Decoya against your own scenario.
The interactive demo reproduces sensors, events and alerts without installation. When you are ready, simply connect your first site.
