People, places and data
Build believable decoy identities, locations and information around the organisation an adversary is researching.
Human-centred cyber deception
Turn attacker curiosity into threat intelligence.
Most deception products imitate software and protocols. Simbotnik creates convincing trails through people, places and data, then measures how far a visitor follows them and how much effort they invest—whether the reconnaissance is conducted by a human operator or a malicious, LLM-powered agent.
Built on more than 25 years of experience in cybersecurity, telecommunications and threat intelligence.
Cyber defence through deception
Deceive the adversary, not just their tools.
Conventional cyber decoys wait for an adversary or automated tool to touch a server, service or protocol. Simbotnik engages human researchers and AI agents automating reconnaissance against your organisation: searching, reading, making connections and deciding where to look next.
Built for security teams that want to understand interest in their organisation, not simply count probes.
This focus aligns with MITRE ATT&CK Reconnaissance (TA0043), while the campaign model reflects MITRE Engage's planned approach to adversary engagement.
Effort reveals interest
Measure the searches, page depth, return visits and trail progression that separate a glance from sustained attention.
Prioritised intelligence
Score observed behaviour so analysts can focus on the visitors investing the most effort in the deception.
How it works
A reconnaissance funnel for threat intelligence.
Simbotnik applies the logic of an engagement funnel to adversary research. Each step through the deception adds context, turning an anonymous visit into a measurable journey.
Build a believable trail.
Create a connected deception from people, places and information relevant to the organisation.
Seed the entry points.
Place controlled breadcrumbs where a researcher can discover them and choose to continue.
Follow the journey.
Record page paths, searches, dwell patterns, heatmaps and return visits across the decoy environment.
Score the effort.
Use progression, persistence and depth of exploration to rank the strength of interest.
Give analysts the story.
Present the journey, score and supporting indicators as a focused investigation lead.
-
AttractionTrail discoveredControlled breadcrumbs
-
EngagementDecoy exploredPeople, places and data
-
QualificationInterest scoredEffort, persistence and depth
-
IntelligenceLead prioritisedJourney, score and indicators
Outside production
Production systemsSeparate environment
A scanner that leaves after one page should not look the same as a visitor who follows a trail, searches for specific material and keeps returning. Simbotnik makes that difference visible.
Product
See interest build, page by page.
Move from a ranked lead to the evidence behind it. See the route through the deception, the content that held attention and the actions that increased the visitor's score.
Interest scoring
Rank visitors by the effort, persistence and depth they demonstrate across the decoy journey.
Journey analysis
Trace discovery, searches, navigation paths and repeat visits as one connected sequence.
Page heatmaps
See which parts of a decoy attract attention and where a visitor spends time exploring.
A private briefing includes a demonstration of the current interface and available capabilities.
The model
From curiosity to qualified signal.
How is this different from a honeypot?
Most honeypots emulate software, systems or protocols. Simbotnik creates an information environment for a human researcher to discover and explore, then analyses the journey through it.
What forms can a decoy take?
A campaign can connect believable people, places, pages and data into a trail shaped around your organisation and the subjects likely to attract interest.
How is interest scored?
The scoring model uses the effort visible in the journey, including progression through the trail, searches, exploration depth, page engagement and repeat visits.
What does a briefing cover?
The briefing covers current capabilities, the deployment model, intelligence outputs and the requirements for evaluating Simbotnik in your environment.
Experience
Built from operational experience.
Simbotnik's founder brings more than 25 years of experience across telecommunications, cybersecurity and threat intelligence, including hands-on work with government and military customers. That background informs the product's focus: collecting useful evidence, understanding adversary behaviour and delivering intelligence that security teams can act on.
Private briefing
See the reconnaissance funnel in action.
Walk through a decoy journey, see how Simbotnik scores engagement and discuss how a campaign could be shaped around your organisation.
The product is in active development. Private demonstrations are available.
For investment enquiries, use the same form and select Investment.