Connected decoys
Build discoverable trails around people, places and things, with controlled pages and synthetic material designed for authorised observation.
Reconnaissance-focused cyber deception
Find out what attackers are looking for, before they strike
Simbotnik builds connected decoys around people, places and things attackers might investigate. Track the searches, choices and return visits that reveal what attracts interest—and turn that activity into actionable intelligence.
Built on more than 25 years of experience in cybersecurity, telecommunications and threat intelligence.
The approach
Build around the subject of reconnaissance.
A person. A location. A project. An asset. Reconnaissance follows connections between them.
Simbotnik creates a controlled environment of connected decoys for that research to unfold. Define the paths worth watching and the actions that matter, then examine how visitors discover, explore and return to them.
The result is an actionable intelligence feed showing what a visitor pursued, how far they progressed and how their interest developed—giving your team intelligence it can use to protect real assets.
Decoys sit outside production. Visibility comes from recorded interactions with those decoys, kept separate from production systems and from analyst assessment.
Bounded visibility
Record how visitors interact with the decoy environment without placing decoys or collection paths inside production.
Analyst context
Keep the recorded sequence behind an investigation lead visible for review and intelligence reporting.
How it works
How connected deception becomes intelligence.
Create a controlled environment outside production, make a discoverable trail available and observe the recorded activity that follows.
Create connected decoys.
Build a controlled environment around the people, places and things that form the subject of reconnaissance.
Make the trail discoverable.
Publish selected breadcrumbs and paths for research to uncover, while keeping the decoy environment outside production.
Observe recorded interaction.
Capture discovery, navigation, internal searches and return visits inside the controlled environment.
Qualify the investigation lead.
Review progression and supporting behaviour to prioritise evidence for analyst assessment.
Deliver actionable intelligence.
Turn approved evidence and its recorded context into an intelligence feed for reporting and standards-based delivery.
-
DiscoveryTrail discoveredConnected breadcrumbs
-
ExplorationDecoy exploredPeople, places and things
-
ObservationActivity recordedSearches, choices and returns
-
QualificationLead prioritisedProgression and supporting context
Outside production
Production systemsSeparate environment
Engagement analysis
Measure the pursuit.
Goals
Define meaningful actions within a decoy environment, such as reaching a particular page or following a selected breadcrumb. See which visitors reach those milestones.
Funnels
Map the route from initial discovery to deeper exploration. Identify where visitors continue, abandon the trail or reach a goal.
Heatmaps
Examine click and scroll patterns across decoy pages. See which elements receive interaction and how far visitors explore.
Search analysis
Inspect the terms visitors enter within the decoy environment. Understand which people, places and subjects they actively seek.
Visitor journeys
Connect navigation paths and recorded return visits. Examine the sequence behind an individual interaction.
Lead qualification
Combine goal completion, progression and repeat engagement to prioritise activity for investigation. Keep the supporting behaviour visible so analysts can assess the lead.
Product evidence
Inspect the recorded evidence.
The current interface shows the decoy environment, recorded engagement and standards-based intelligence delivery. The views below use fictional demonstration data.
Decoy environment
Prepare connected pages and controlled trails for authorised observation outside production.
Visitor journeys
Review recorded interaction and the supporting sequence behind an investigation lead.
STIX / TAXII delivery
Publish Observed Data and reviewed Indicator, Sighting and Note objects through a tenant-scoped TAXII 2.1 collection.
Interface captured from the current MVP using fictional local demonstration data. Product details may change during active development.
The model
Built for operational intelligence.
How is this different from a honeypot?
Simbotnik creates connected decoys around people, places and things for a researcher to discover and explore, then examines recorded activity through that controlled environment.
What forms can a decoy take?
The current workflow builds a controlled website decoy from selected public pages, with synthetic protected content and an attributed lure URL. Additional environment types remain part of ongoing development.
What does qualification mean?
Goal completion, progression and repeat engagement help prioritise activity for investigation. The recorded behaviour behind each lead remains visible for analyst assessment.
How does intelligence leave the platform?
Recorded interactions produce STIX 2.1 Observed Data. Analyst-promoted findings additionally produce Indicator, Sighting and assessment Note objects, available through a tenant-scoped TAXII 2.1 collection.
What does a briefing cover?
The briefing covers operation design, decoy preparation, engagement scoring, STIX/TAXII output and the requirements for evaluating Simbotnik in your environment.
Experience
Built from operational experience.
Simbotnik's founder brings more than 25 years of experience across telecommunications, cybersecurity and threat intelligence, including hands-on work with government and military customers. That background informs the product's focus: collecting useful evidence, understanding adversary behaviour and delivering intelligence that security teams can act on.
Private briefing
See connected deception in context.
Walk through a private decoy preview, recorded engagement, investigation-lead qualification and STIX/TAXII delivery, then discuss how an authorised evaluation could be shaped around your organisation.
The product is in active development. Private demonstrations are available.
For investment enquiries, use the same form and select Investment.