ES Start for free

Precise detection.
Immediate certainty.

Preemptive cyberdeception for businesses: traps only an intruder touches, even with valid credentials. They fire before the attacker reaches anything real and tell you who it is and what they did.

Start for free
See how it works
What NullDec catches
50replicas of real products
30+decoy types
8attack stages covered
1alert per attack, not per event

In action

Watch an attack end on a decoy.

An intruder logs in with valid credentials. This is what NullDec sees, from the first trap to containment.

01 · Use cases

Six attacks. A trap for each one.

The most common attacks against a business, and the decoy that gives each one away.

01

Stolen credentials

With a valid password, access looks legitimate.

Entra ID accounts, AWS keys and secrets nobody uses. A sign-in with them is an intruder, even though the credential works.

Identity and cloud →

02

Lateral movement and ransomware

Before encrypting, attackers explore your network.

Decoy services, shares and machines that fire on the first connection attempt, before they get to encrypt.

Internal network →

03

Perimeter exploitation

An exposed VPN or Citrix is the most sought-after way in.

Replicas of your own products, with vulnerabilities that answer back. You see which exploit they try and what they take.

Attack surfaces →

04

Secrets in code and CI/CD

A token left in a repository opens your cloud and your pipeline.

Kubeconfig, internal packages and credentials delivered on every GitHub Actions run. If someone uses them, you know from where.

Code and CI/CD →

05

Leaked documents and insider threat

What leaves your network doesn't warn you when someone opens it.

Decoy documents, mailboxes and links that give away whoever opens them, inside or outside.

Documents →

06

Manipulated AI agents

Whoever fools your agent inherits its access.

Decoy configurations, tools and documents that tell your agent out of place from an intruder using AI.

AI agents →

02 · How it works

Set it up in minutes. It fires on first use.

A decoy looks valuable, but no employee or process needs it. So when someone touches it, you start from a fact, not a suspicion.

  1. 01 · PlacePick the decoy and where it goesFrom the console, in minutes. We suggest where an intruder would look for it.
  2. 02 · FireSomeone uses itThey open the document, try the key or sign in. No need to wait for them to do damage.
  3. 03 · KnowYou get an incident, not a loose alertWho it is, from where, what technique they used and what else they touched. In your email, Slack, Telegram or SIEM.

03 · Decoy catalog

A bait wherever an intruder looks.

More than thirty decoy types, from a document to an identity. Each one catches a different moment of an attack, and the console tells you where to plant it so it looks real.

Free

You know who opens what they shouldn't.

A document taken out of your network, a compromised mailbox or an internal page someone reads for no reason.

Word documentWeb bugEmail canaryQR code

Where it lives: you generate it in the console and place it yourself. Nothing to install.

Where to plant it, per the console

  • Payroll-2026.docx in the HR folder
  • A shared mailbox like finance@ that looks abandoned
  • A "Guest WiFi" poster with a QR code

When it fires · illustrative example

Payroll-2026.docx · opened203.0.113.42 · Microsoft Word · 23:14

All are deployed from the console and can be chained into a campaign. Compare plans →

04 · Attack surfaces Enterprise

A VPN that doesn't exist.

A complete replica of a real product, such as your VPN, your GitLab or your vCenter, under a hostname in your domain. Many show a known vulnerability so the attacker believes they've found a gap.

https://vpn.example.com/login
Mock-up of a surface. It looks like the real portal, answers like the real one and protects nothing.

Illustrative example · what your team sees

  1. 09:12:01DiscoversA scanner finds the portal and checks its version. IP, tool and request fingerprint.
  2. 09:14:37ExploitsTries a public exploit against the advertised version, and it "works". The full payload of the attempt.
  3. 09:15:02Gets inBrowses the panel: users, groups, access, all consistent with each other. Every path, command and timing.
  4. 09:21:48TakesDownloads a configuration backup with credentials inside. What they took.
  5. +1 dayUsesThe credentials were decoys and fire in your AWS from another IP. Where they use it.

Consistent on every probe

The same company, the same people and the same files on the attacker's first probe and on the tenth.

Vulnerabilities answer back

SQL injection, path traversal or a webshell get believable responses. Nothing they send is executed.

Secrets that lead elsewhere

It holds credentials for your other decoys: what the attacker takes fires later somewhere else.

50 products in 10 families

FortiGatePalo Alto GlobalProtectCisco AnyConnectCitrix GatewayGitLabJenkinsVMware vCenterOutlook Web AppJiraSAP NetWeaverand 40 more

05 · Deception campaigns Enterprise

You know where they got in, how fast they moved and what they took.

A campaign chains catalog decoys and surfaces: each one holds the clue to the next. Instead of isolated alerts, you get the attacker's full path, with timings.

Illustrative example · what a campaign tells you

  1. 09:12:05 · EntryFake intranetDownloads its .env, which names a bucket.
  2. +4 sresource reference
  3. MovementS3 bucketLists it with what the .env said.Pace of an automated tool
  4. +7 minAWS credential
  5. MovementAWS keyFinds it inside a dump.Pace of a person reading
  6. +1 dayout-of-place use
  7. ExfiltrationProvenUses the key from another IP: they took something, not just got in.

01

NullDec proposes it

From your cloud, your identity and your surfaces, and it explains why it picks each decoy.

02

You approve it

You review it node by node on a canvas. Nothing is created without your approval, and the approval is logged.

03

It maintains itself

If a credential rotates and a bait stops leading anywhere, it moves it. If the attacker advances, it plants the next one in their path.

06 · Preemptive deception

The bait gets there before the attacker does.

NullDec doesn't wait for them to get in: it looks at what you expose, learns from what happens to organisations like yours and places decoys where the attacker is going to look.

01 Enterprise

Your exposure, with a decoy twin

It finds what your domains show the internet, from public sources only, and proposes a twin surface that watches it while you fix it.

02 Pro

Early warning

If an attacker touches organisations with your technology or in your sector and not you yet, you know first. Without naming anyone.

03 Enterprise

Autonomous placement

Within the limits you approve, NullDec plants the next bait in the attacker's path and retires the ones that expire.

A decoy has no legitimate use. That's why there's no threshold to tune: its activation is a fact, not a probability.

07 · Decoys for AI agents

Is it your agent, or an intruder?

Your agents read documents, configurations and tools, and act on what they read. Whoever fools them inherits their access. NullDec plants decoys right there.

Illustrative example · MCP configuration with a decoy server
{
  "mcpServers": {
    "github": { "command": "github-mcp" },
    "erp-finance": {
      "url": "https://mcp.example.com/erp",
      "headers": { "Authorization": "Bearer ••••" }
    }
  }
}

No legitimate workflow uses erp-finance. If an agent invokes it, that's a fact, not an anomaly to interpret.

1An agent uses the decoy: the MCP configuration, a RAG document or a fake tool.

Does it come from the network you declared for your agents?

Yes

Your agent, out of place

Possible prompt injection: check what it was asked and what it read before.

No

An intruder using AI

You get the fingerprint of the MCP client that invoked it: its name and version.

That address is set by the network, not by the caller: it's data, not a guess.

MCP configuration Pro Tool schema Pro RAG document Pro Decoy MCP tool Enterprise AI agent decoy SDK Enterprise

08 · Intelligence and response

Every activation is evidence, not a hypothesis.

One attack, one alert

The same IP on the same decoy within 24 hours is a single episode: the first alert goes out immediately and the rest arrives grouped.

Attacker techniques, with evidence

Every signal with its MITRE ATT&CK technique and tactic, telling what was observed apart from what was inferred.

Explainable score

From 0 to 100, with a breakdown of where every point comes from.

Cross-client correlation Pro

If the same fingerprint hits several clients, it gets grouped. Only attacker data is cross-referenced, never yours.

AI summary Pro

What happened and what to do, on every alert. Optional and labeled as AI.

Your SIEM Enterprise

An API with its own key from which your SIEM collects the signals, and your intelligence in STIX 2.1, by export or over TAXII 2.1.

Enterprise

From alert to containment, with what you already have.

A rule, or the campaign itself depending on how far the attacker gets, decides what to do: isolate the device in Defender, CrowdStrike, SentinelOne or Sophos, end their sessions in Entra ID or Okta, revoke the decoy credential, block the IP in Cloudflare or notify your SOAR.

  • Conditions on the alert: score, country, network, Tor or VPN, decoy, technique or actor.
  • The response escalates as they advance: block on entry, contain as they move, cut identities when they reach the end.
  • It starts in simulation, is switched on with MFA, and actions that cut something off wait for a person to confirm them.
Illustrative example · a rule
Ifthreat.score:>80 AND source.is_tor:true
ThenIsolate the device in Defender · End their sessions in Entra ID
ModeSimulation · switched on with MFA

Last 24 h · 1 match · would have isolated 1 device and ended 2 sessions from 203.0.113.42

09 · Plans

Start free. Scale up to collective intelligence.

Free for your own decoys. Pro adds collective intelligence. Enterprise adds Surfaces, Campaigns and integration with your SOC.

Free
€0

Open sign-up

  • 7 no-install decoy types
  • Up to 5 active decoys
  • Web console and your own alerts
  • Email and Telegram notifications
Create account
Recommended Pro
30 days free

No card required · when it ends, pick a plan or go back to Free

  • Decoy services with no cap (SSH, RDP, VNC…) and network share
  • Decoys for AI agents: MCP, tools and RAG
  • GitHub Actions, and AWS or Azure in our account or yours
  • Collective intelligence radar and AI narrative
  • Early warning and preemptive recommendations
  • Live alerts, Slack, and a PDF report for your auditor
Start 30-day trial
Enterprise
Let's talk

We'll propose custom plans within 24-48h

  • Everything in Pro, with a multi-client view for MSPs
  • High-interaction honeypots with AI, and Entra ID
  • AI agent decoy SDK
  • Surfaces and chained campaigns
  • Preemptive deception: plant the recommended decoys with one click
  • API, STIX and TAXII 2.1, and containment with your EDR and identity provider
  • SSO over OIDC, exportable audit log and SLA
  • NullDec Agent, in early access

Free never expires. The Pro trial lasts 30 days and needs no card.

MSPs and MSSPs

Managing security for several clients?

With Enterprise you see them all in a single view, deploy with guided packages, and each client's data stays isolated.

10 · Frequently asked questions

What people ask us before they start.

How is this different from my EDR or SIEM?

Your EDR and SIEM look for what seems odd among millions of legitimate events. A decoy has no legitimate use, so its alert is a fact. NullDec doesn't replace them: it feeds them high-confidence signals.

Can a decoy produce false positives?

A few, and well known: internet scanners, email link scanners and the cloud's own activity. NullDec separates them from the attack.

Will a vulnerable replica under my domain show up in external scans?

It can, because it's designed to be found. It holds no real data and nothing it receives is executed. Register it as a decoy in your asset inventory and any external finding on it will be identified as such.

What data leaves my network?

By default, none: we only receive the interaction with the decoy, and it's hosted in the EU. Integrations are optional, with minimal permissions you can withdraw. We never share your data with other clients.

Do you use AI? With what data?

To answer the attacker in high-interaction honeypots and, if you switch it on, to summarize each alert. Every generated text is labeled as AI.

How do I know my decoys still work?

The console checks the detection chain end to end and shows you how effective each decoy is. If one can no longer alert, you know before you need it.

What does a proof of concept include?

Scope, duration and success criteria agreed before we start. At the end we review the real signal and coverage together.

Plant your first decoy today.

Create a free account and deploy your first decoy in minutes.

Start for free

Let's talk Enterprise

Tell us about your case and we'll propose a custom offer. We reply within 24-48h.