Every claim on this page maps to something in the product you can open, a format you can name, or a licence flag you can read. Where a competitor is better, we say so.
A fabric of device-faithful decoys (FortiGate and MikroTik, an Ivanti gateway, SAP NetWeaver, an MCP server) meets the attacker before your customers do, outside and inside your network. A capture engine clones the devices you actually run into new decoys. Every session, credential and payload becomes indicators you generated, and a ledger shows which ones were new.
Unlike aggregators, which read the same public CTI you do.
›17 device personas incl. cloned FortiGate, UniFi, Dahua and Aruba UIs, RouterOS/FortiOS CLIs, Ivanti Connect Secure, SAP NetWeaver and a decoy MCP server
›A capture engine that clones a real device into a new decoy from host, user and password
›Internal decoy groups and canary tokens: an internal touch pages Critical
›First-party ledger: which indicators each run produced and whether they were new
02
One graph from 40+ inputs
Built-in integrations, reviewed presets and generic TAXII, MISP and CSV connectors flow through one write path with your sensors, endpoints and customer reports: deduplicate, correlate, score, allowlist, alert.
Unlike a SIEM with three feeds wired in, which cannot tell you which source to trust.
›Source reliability grades and a redistributable flag on every source
03
Enforcement your firewalls already speak
Blocklists in Palo Alto EDL, Fortinet, Suricata, DNS RPZ and nginx formats with ETag polling, and sightings back from the edge so confidence reflects what was actually blocked.
Unlike a portal you read, which never closes the loop.
›Sightings API: what the edge blocked re-scores confidence
04
Licensed per installation, not per analyst
Every package is an annual licence per installation or tenant with unlimited analysts. MFA, API keys and a hash-chained audit log are in all of them; a database per tenant isolates every client of a provider.
Unlike per-seat licensing, which charges you for every analyst you add.
›Annual licence per installation or tenant; unlimited analysts in every package
›MFA, scoped API keys and a hash-chained audit log in every package; SSO and SCIM are the Enterprise Identity module
›Database per tenant, per-tenant jobs, operator control plane separated from client admins
05
Sovereign because of where it runs
On-prem, nothing goes to us: the licence is a signed file verified offline, AI runs locally, on your own key or not at all. Or take a tenant on Wahukeza-operated instances with its own database, or both, and change your mind later.
Unlike vendor-hosted SaaS, whose region is not an answer to a compelled-access request.
Deception buyers have a specific fear: a poisoned honeypot feeding false indicators, or a compromised one used as a foothold. Containment in the sensor answers it, not a policy.
Sensors are not shells
CLI personas are bounded command trees, never a real shell. Static tests forbid exec, subprocess, eval and any outbound client in the attacker-facing transports, the login wall, the web, lure and TDS modules and the Dahua, MikroTik, Ivanti, MCP and SAP modules; each CLI engine has its own security suite.
Answered, never performed
Every outbound verb an attacker types (wget, curl) gets a plausible answer and does nothing. URLs are recorded and fetched later by the platform into quarantine, never by the sensor.
No reflector, nothing runs
UDP is never served, so a sensor cannot amplify an attack. Upload lures store bodies inert; captured artefacts are hashed, triaged and detonated in isolation, never run on the sensor.
Allowlist before enforcement
CIDR and wildcard allowlists force indicators Clean before they reach a blocklist. The exchange counts allowlist collisions per contributor as a poisoning signal.
Objections
What a technical buyer asks, answered without a script.
Where we lose to an intelligence content vendor
If what you need is finished analyst reporting on named actors (Recorded Future, Google, CrowdStrike, Group-IB), we are not that. We are the platform that makes the intelligence you already own and generate operable across clients.
Where we lose to "do nothing"
A single team with three free feeds wired into a SIEM and no clients to report to may not need a platform yet. Come back when the second client asks for evidence.
Where a hosted product is simpler
On-prem, you run it. That is the point for many buyers, and it is also work: a Postgres, a Redis, upgrades. We make it as small as it can honestly be (Compose or Helm, a migration runner, signed images), and we do not pretend it is zero. If nobody can own that, take a tenant on Wahukeza-operated instances instead.
Why not OpenCTI?
For a single team, use it. For a service provider it has no native multi-tenancy, and organisation segregation is an Enterprise Edition feature; one instance per client is exactly the overhead you are trying to escape. And it has no sensors of its own.
Why not MISP?
Keep MISP. We interoperate with it: MISP feeds in, a MISP feed out, and sharing groups that push and pull over the MISP REST API. But hosting it properly is an infrastructure project and it ships a dozen or more upgrades a year. We are the operating layer above the standard, not a replacement for it.
Shadowserver is free.
Take it. It is excellent. It gives you daily reports about your own netblocks. It does not correlate them with your other sources, tell you which exposure is being probed on your own sensors this week, produce enforcement-format output or a branded deliverable. Attack Surface Management does the outside-in view from seeds you prove you own.
Self-hosting is an operational burden.
Then choose. Run it on-prem (Docker Compose on a VM, or Helm for high availability), take a tenant with its own database on Wahukeza-operated instances, or combine the two. Models can be changed later, with export in STIX 2.1, CSV and JSON. On-prem ships with a migration runner, signed images with SBOMs, and upgrade and restore drills as release gates.
Honeypots only see internet noise.
Low-interaction ones do. Ours are high-interaction personas: cloned management UIs and command lines, an Ivanti Connect Secure gateway, SAP NetWeaver, a decoy MCP server, a camera that streams. The device clones are replicas of real devices built by a capture engine that records the management surface of the kit you actually run, not hand-written fakes. Exploit watch maps sessions to a cited catalogue of named exploitation campaigns, so you see which ones are aimed at the kit you run.
How do I know your sensors can’t be turned into a foothold?
Attacker-facing code cannot execute or dial out: static tests forbid exec, subprocess, eval and any outbound client in the transports, the login wall, the web, lure and TDS modules and the Dahua, MikroTik, Ivanti, MCP and SAP modules, and each CLI engine has its own security suite. Every outbound verb (wget, curl) is answered, never performed. UDP is never served, so a sensor cannot be a reflector, and uploaded bodies are stored inert.
How much?
Four packages (Basic, Standard, Advanced, Complete) and every module except the two AI modules can be licensed on its own. Each is an annual licence per installation or tenant with unlimited analysts. Pricing follows a short scoping workshop, because sensors, endpoints and delivery model are what move it.
Check the claims yourself.
A demo on a reference deployment, with the licence file, the feed formats and the sensor console open. Bring your hardest question.