Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cybersecurity Teams Are Using Deception Technology
Transcript
- Lucas: So there's this idea in cybersecurity that's been quietly gaining traction, and it flips the usual defense playbook on its head. Instead of just trying to keep attackers out, you invite them in — but into a fake world you control. Luna: You're talking about deception technology, right? Honeypots, honeytokens, that family of tools. Lucas: Exactly. And I think it's worth a closer look because the approach has matured a lot in the last couple of years. The classic honeypot has been around forever — a decoy server sitting on the network hoping someone touches it. But modern deception is much more surgical. Luna: Surgical how? Give me a concrete example. Lucas: Sure. Let's talk about a Fortune 500 retailer — I can't name them, but the details are public in a case study from early 2025. They deployed deception across their environment: fake Active Directory credentials, breadcrumb files on file shares that look like they contain database passwords, decoy endpoints that mimic point of sale systems. The idea is that legitimate users never touch these things, but an attacker scanning the network will trip over them. Luna: And did it work? Lucas: Seventeen minutes. That's how long it took from the first fake credential being used to the security team getting an alert. The attacker was a ransomware crew that had already gotten in through a phishing email. They were moving laterally, trying to escalate privileges, and they grabbed what looked like a service account password. But it was a honeytoken — a fake credential that triggered an immediate high-severity alert. Luna: Seventeen minutes versus the industry average dwell time of something like two hundred days. That's not even a comparison. Lucas: Right. The latest M-Trends report from Mandiant puts median dwell time at 212 days for 2024. And that's actually an improvement over previous years. But with deception, some organizations are getting detection down to hours or minutes. Luna: So why isn't every company doing this? There must be a catch. Lucas: There are a few. First, it's not a set-it-and-forget-it thing. You have to maintain the deception environment. If a decoy server goes offline and nobody notices, or if a honeytoken credential gets rotated out because someone actually changes the real password, you lose coverage. It requires ongoing effort. Luna: And there's the cost. These commercial platforms aren't cheap. Illusive Networks, Attivo Networks — they charge based on the number of decoys and endpoints covered. For a large enterprise, we're talking hundreds of thousands a year. Lucas: True, but compare that to the cost of a single ransomware incident. IBM's 2025 Cost of a Data Breach report put the average at $4.9 million. A deception deployment might pay for itself after one prevented breach. Luna: Yeah, that math does work. But I've also heard security teams say deception adds complexity to an already overburdened stack. More alerts, more false positives. Lucas: That was a real problem with early honeypots. They generated so many false alarms that teams started ignoring them. But modern platforms use machine learning to filter out noise. They correlate decoy touches with other signals — if a decoy is accessed from a known admin workstation during business hours, maybe it's a false positive. But if it's accessed from an unknown IP at 3 a.m., that's almost certainly a real incident. Luna: So the technology has gotten smarter. But is there a risk that attackers figure out they're in a deception environment and just leave — or worse, plant false evidence? Lucas: That's a great question. Sophisticated attackers do try to detect deception. They might look for telltale signs like decoy systems that don't have real user activity, or honeytokens that haven't been used in months. But the best deception platforms are designed to look real. They simulate normal user behavior — logins, file access, network traffic. Some even populate decoy databases with fake but plausible customer records. Luna: So it's like building a digital twin of your network, but only the parts you want attackers to find. Lucas: Exactly. And one of the most interesting developments is the use of deception in identity systems. Instead of just decoy servers, you plant fake service accounts, fake API keys, fake SSH keys. If an attacker grabs one and tries to use it, you know exactly which path they're taking. Luna: That pairs really well with zero-trust architecture. Zero trust says 'never trust, always verify.' Deception gives you a way to verify by seeing who touches what they shouldn't. Lucas: Right. And a lot of the major zero-trust vendors are now building deception capabilities directly into their platforms. It's becoming a standard layer rather than a standalone product. Luna: Before we go deeper, I should mention — and Lucas, you might agree — that the reason we can spend a whole episode on a niche tactic like this is because this show is listener-supported. A small group of listeners chips in monthly through Buy Me a Coffee at buy me a coffee dot com slash fexingo, and that's what lets us go deep on topics that a mainstream ad-funded show would skip. Lucas: Yeah, it's a trade-off we're happy to make. No ads, no sponsors pushing their own products. Just us digging into what actually works. And if this kind of detail is useful for what you're building or running, that's exactly why we do it. Luna: Alright, back to the tech. Lucas, you mentioned human-operated ransomware earlier. How does deception specifically help against that? Lucas: Human-operated ransomware is the scariest kind because there's a person at the keyboard adapting to what they find. They're not just running automated malware. They'll disable your antivirus, delete your backups, escalate privileges. Deception is effective because it gives you early warning before they get to the crown jewels. Luna: So you catch them in the reconnaissance phase. Lucas: Exactly. Most ransomware groups spend days or weeks mapping the network, looking for domain controllers, backup servers, file shares. If they touch a decoy during that recon, you get alerted while they're still figuring out the layout. That's way better than discovering them when they deploy the encryptor. Luna: Is there a public example of deception stopping a major ransomware attack? Lucas: There's a well-known case from 2024 involving a healthcare system. They had deployed deception from Attivo Networks. An attacker got in via a compromised VPN credential, started scanning, hit a decoy domain controller, and within 30 minutes the security team had isolated the segment and blocked the attacker. No data encrypted, no ransom paid. Luna: Thirty minutes from breach to containment. That's the dream. Lucas: It is. And it's not just healthcare. Financial services, energy, government — deception is becoming a standard part of the defense toolkit. The UK's National Cyber Security Centre actually recommends deception as a detection control in their latest guidance. Luna: So if a company wants to start with deception, where do they begin? Do they need to buy a full platform right away? Lucas: Not necessarily. You can start small with open-source tools like Cowrie for SSH honeypots or Canarytokens for fake credentials. But those require more manual management. For a serious deployment, most enterprises go with a commercial platform because you get the automation and integration with existing SIEM and SOAR systems. Luna: And the key metric is dwell time reduction. If you can cut it from months to hours, that's a massive improvement in risk posture. Lucas: That's the headline. But there's a secondary benefit: threat intelligence. Every time an attacker interacts with a decoy, you learn something. What tools are they using? What commands do they run? What credentials are they targeting? That intel can feed back into your defenses. Luna: So deception doesn't just detect — it also informs. Lucas: Exactly. And that intelligence can be shared with industry peers through information-sharing groups. So one company's deception deployment can help protect others. Luna: I want to circle back to something you said earlier about ongoing maintenance. What's the biggest operational challenge? Lucas: Keeping the deception environment realistic. If your decoys look stale — no new files, no login activity, no network traffic — attackers will spot them. Some platforms automate this by cloning real production data and masking it. But it requires oversight. Luna: So you need a dedicated person or team to manage it. Lucas: Typically yes, at least part-time. But for a large enterprise, the ROI is clear. The 2025 Cost of a Data Breach report also found that organizations with extensive deception deployment saved an average of $1.2 million per breach compared to those without. Luna: That's a strong number. And it's not just financial — it's reputational, operational, legal. A breach you detect in 17 minutes is a completely different event than one you discover after 200 days. Lucas: Right. The faster you detect, the less data the attacker exfiltrates, the fewer notifications you have to make, the lower the regulatory fines. Deception is one of the few controls that directly drives down detection time. Luna: So for a security leader listening right now, what's the one takeaway? Lucas: Don't think of deception as an exotic add-on. Think of it as a detection layer that complements your existing tools. If you already have endpoint detection, network monitoring, and a SIEM, deception fills the gaps those tools miss — especially against human-operated attacks where the attacker is actively evading your defenses. Luna: And it works regardless of your industry or company size? Lucas: The principles apply everywhere, but the scale varies. A small business might use a few honeytokens on critical servers. A large enterprise might deploy thousands of decoys across multiple geographies. The key is to start somewhere and iterate. Luna: Alright, I think we've given our listeners a solid framework. Lucas, thanks for walking through that. Lucas: Always a pleasure. And to our listeners, if you want to dig deeper, we'll put some links in the show notes to the case studies we mentioned. Thanks for spending this time with us.