Why Directory Decoy

Where it fits

It runs alongside existing services

The only purpose-built deception for certificate services

ADCS escalation is the most reliable path to domain dominance in a modern network and the least covered by anything else. Directory Decoy was built around it rather than extended to reach it.

Decoy templates for the escalation paths that matter

Templates that appear vulnerable to ESC1, ESC2, ESC3, ESC4, ESC9, and ESC13 are published into your certificate authority alongside the real ones. An attacker enumerating templates for a way to impersonate a domain administrator finds them.

The request is denied as it alerts

A policy module on the certificate authority enforces every decoy template. The certificate is never issued — not held for review, not issued and revoked, never issued. The attempt raises an alert and returns the attacker nothing.

Safe by construction

Because the decoy templates cannot issue, a decoy that is misconfigured or forgotten is not a liability sitting in your certificate authority. The failure mode of this control is that it stops detecting, not that it becomes the vulnerability it imitates.

Coverage where there is otherwise no signal at all

Certificate issuance is ordinary activity, so exploitation of a genuinely misconfigured template produces logs that look exactly like a certificate authority working. A decoy template is the difference between an event and an answer.

Every major Active Directory attack path

Decoys cover the most well-known and lucrative attack paths, making them irresistable to attackers.

Kerberoasting and AS-REP Roasting

Attackers target service accounts for offline password cracking. Once they attempt this attack against a decoy, you will be notified immediately.

DCSync

Replication requested by anything that is not a domain controller is the step immediately before a full credential dump. Directory Decoy alerts when a decoy account is named, or when the request comes from an account with no reason to sync passwords.

Shadow credentials and resource-based delegation

Both are quiet privilege escalations that leave a legitimate-looking directory change behind. Directory Decoy catches the change on a decoy object, then reverses it and disables the account automatically.

Pre-Windows 2000 machine accounts

Legacy computer accounts whose password is derivable from the account name. Widely exploited, barely covered by anything, and trivially decoyed.

Files, shares, and credentials

Honey files, folders, shares, and planted credentials extend the same idea past the directory to the places an attacker looks next.

Alerts in seconds, with nothing to tune

Traditional detection is based on distinguishing normal behavior from malicious behavior. Directory Decoy inverts the process, providing high fidelity alerts.

Deterministic, not probabilistic

A decoy is not touched by employees, applications, or scheduled jobs. There is no baseline period, no learning mode, no threshold, and no score. An interaction is not evidence that an attack MAY be underway, it IS the attack.

Every alert is worth opening

The expensive part of a noisy tool is not the alerts, it is the deliberation. Removing the ambiguity removes the queue, and removes the habit of assuming the next one is nothing.

Attribution arrives with the alert

The account responsible, the address it came from, the object targeted, and the MITRE ATT&CK technique are all in the detection. Triage starts with the answer instead of a search.

Containment without waiting for a human

For the techniques where the attacker has already changed something, the agent reverses the change and disables the account, then records what it did. Response time stops depending on who is awake.

Deployed in an afternoon, not a quarter

Most security tooling fails at the install rather than the detection. A control that is still half-rolled-out protects nothing.

Nothing on your endpoints

One self-contained executable on your domain controllers, and on your certificate authority if you want certificate coverage. No workstation agent, no appliance, and no network tap.

One single install script

The agent installs, registers itself, and pulls its configuration automatically. Agents are ready to monitor for decoys immediately.

Stays correct as environments change

Agents continuously re-verify every decoy against the environment and report their status. If settings and accounts are changed, you will be notified in the dashboard, and provided with a solution to fix it.

Priced for the organizations who need protection

Enterprise security tooling can be prohibitively expensive and still requires an entire team to operate it.

One product, no feature tiers

Every detection, ADCS abuse blocking, every integration, and the full API ship to every account at every size. Companies of all sizes can benefit from state-of-the-art deception.

Billed per protected identity

Agents and decoys are unlimited, deploy hundreds across as many servers as you like. You are only billed for the number of total identities protected.

No infrastructure required

There is no appliance to buy, and no log volume to pay for downstream. The operating cost stops at the licenses.

Negligible overhead on the servers it runs on

The agent is a lightweight Windows service that monitors for decoy interactions.

Built for those protecting others

Multi-tenancy is native to the deception platform. Monitor an ever-growing number of organizations at a glance.

One console across every client

Manage all client tenants from a single dashboard with aggregated views, rather than juggling endless logins.

Guaranteed Isolation

Client organizations are isolated in their own tenants, but available for MSPs and MSSPs to manage at once.

Independent client roles

Each client keeps its own notification channels and destinations, and your staff hold roles scoped to the clients they actually work on.