How it works

Static decoys get fingerprinted. krupiq’s decoy is never the same twice, and it gives nothing away when it is tested, so an intruder learns nothing useful from it.

Profile

The decoy is shaped to look like your network: hosts that answer, services that behave. You shape it from a description you control, starting from a preset or from your own devices, and the description never leaves the machine. The decoy contains no real record.

Morph

The values that shape the decoy’s appearance move in five-minute epochs, along a bounded walk drawn for each deployment: a few percent of their range at most in any one epoch, so the decoy keeps looking plausible while no two maps of it agree. The walk is fixed in advance. The decoy never reacts to being probed, because a reaction would tell the prober they had been seen.

Engage

An intruder who lands in the decoy sees hosts that answer, services that behave and data that looks real. You watch every move while nothing real is touched.

Prove

Every epoch carries one proof that its values were derived as published from the deployment’s key. You and your auditors check it offline with the public key. It is a proof about the decoy, not about your data.

What it costs the intruder

Time, tooling and credibility, spent on a network that does not exist. The cost on your side stays fixed.