Promotional Content · Labyrinth · Cyber Deception
Labyrinth Overview
Labyrinth's deception-based intrusion detection platform creates high-signal, low-noise alerts from decoys planted around your network. An AI agent enumerating your network, a stealth intruder, or a user poking around where they shouldn't be only needs to touch a decoy to set it off. Those alerts are accurate, real-time, and free of scoring, thresholds and behavioural models. It changes nothing about how your network runs, and it complements your other security measures when they fail or are bypassed.
Decoys Create High-Confidence Alerts
Nobody in your organisation has any reason to touch a decoy. So the moment something does, you have an alert that moves to the top of the queue for investigation. No scoring, no thresholds, just high confidence the alert is worth your time.
Standard tools work the other way round. They leave you sorting the wheat from the chaff, guessing, sampling, and hoping the alert you skipped was nothing. Perhaps your Jedi skills can tell you which is which, but that doesn't scale, and it interrupts lunch.
The question you need answered is how long somebody can move around inside your network before anything raises a genuine alert. A decoy answers it the first time one is touched.
Labyrinth is the platform you should use to run your cyber deception and decoys.
How Labyrinth Works
Labyrinth makes parts of your network look worth investigating, then watches who investigates.
- It plants assets that exist only to be found. Machines that look like file servers. Credentials that look valid. Documents that look worth taking. They are indistinguishable from the real estate around them.
- The decoys go where an intruder will look. A network intruder does not know your network, so they enumerate it. Shared folders. Credentials left sitting on disk. Whatever services answer on the internal subnets.
- Contact is the whole alarm. There is no scoring, no threshold, no behavioural model. Something touches the decoy. That is the alert.
- Your staff will never trigger it. Legitimate work never goes near these assets, so the alerts stay rare and stay meaningful.
- It sits alongside the network you already run. The deception layer does not stand in the path of production traffic and does not require the network to be redesigned around it.
- It assumes the breach already happened. It starts from the position that somebody got in, which is the scenario most organisations are least equipped to handle.
Why Automated Attackers Walk Into Decoys
An autonomous agent doing reconnaissance is fast and systematic. It enumerates everything it can reach, because trying one more thing costs it nothing. And it cannot see what is behind a door until it opens it.
That is what finds decoys. The speed and thoroughness that make an automated attacker hard to stop are the same qualities that walk it into the first fake credential in its path.
What Deception and Decoys Do and Don't Do
It will not keep anyone out. It does nothing at the perimeter, nothing on email, and nothing about the stolen credentials that started the incident. Preventing those belongs to other security controls. Labyrinth's deception-based intrusion detection platform assumes those controls have already failed or been bypassed.
What Labyrinth changes is the part after that. It shortens the time between somebody getting in and somebody finding out, and it does that with alerts a small team can actually act on.
Deception also tells you the moment something touches a decoy, and nothing about everything else moving across your network. That is why Labyrinth sits well beside a network detection and response tool such as Hyprfire's Firebug, which watches the traffic between your systems continuously.
Compliance Frameworks
Australian obligations increasingly assume that you can detect what is happening inside your own environment, not only at the perimeter.
- The ASD Information Security Manual calls for monitoring and event logging sufficient for malicious activity to be detected and investigated.
- Under the Notifiable Data Breaches scheme, an organisation must assess and report eligible breaches of personal information. That assessment starts with knowing an intrusion occurred.
- Entities covered by the Security of Critical Infrastructure Act carry duties to detect and respond to incidents, not only to prevent them.
Get Started with OneDot61
Decoys are cheap to place and they change nothing about how your network runs. Talk to OneDot61 about how Labyrinth and its cyber deception capabilities work in your environment. It is a conversation worth having.