Frequently asked questions.

Kandaro is a security platform built in the EU. Its products share one Console. Deception is live and catches attackers who are already inside your network. Emulation is in development and will attack your environment continuously to show what your defenses miss. Two more are in development as well: Investigation, an AI SOC that will investigate the alerts from your security tools and recommend a response, and Protection, which will carry a response out. Each product has one job: detect, test, decide, act. Every finding is explained in plain English.

Deception means placing decoys in your network: fake file servers, printers, databases, credentials and AI tool servers that look real but have no purpose. Legitimate users and systems never have a reason to touch them, so when something does, it is almost certainly an attacker, malware or a rogue AI agent. That is why a decoy produces so few false alarms.

A SIEM and an EDR watch your real systems and have to tell normal activity from malicious activity, which takes tuning and produces noise. Deception does not watch real systems at all. It only watches things nobody should use, so there is nothing to tune. It works alongside the tools you already have and sends its alerts to email, Slack, your SIEM or your own systems.

Yes. Deception delivers incidents to Splunk, Elasticsearch and Microsoft Sentinel through SIEM connectors, in the OCSF format with MITRE ATT&CK techniques. For anything else there are signed webhooks and a read-only API, and Slack and email are built in. Read-only EDR connections for Emulation are planned but not available yet.

Today Deception detects and explains; it does not block anything. Kandaro Protection is in development and will be the product that acts: when a decoy is touched, or when you approve a response in Investigation, it will stop the session of a hijacked AI agent, isolate a machine or disable an account through your own security tools. You will choose whether Kandaro alerts, asks first or acts on its own. It is not available yet.

It is in development. Kandaro Investigation will be an AI SOC: it will investigate the alerts from your EDR, SIEM, identity and cloud tools together with Kandaro’s own, and explain each verdict. It is not available yet. If you already have a SOC or an MDR provider, Deception feeds it today through your SIEM, a webhook, the API or a read-only MCP server. See Kandaro and your SOC.

You run a lightweight sensor inside your network, choose what it should look like, and your first decoy is running in about a minute. The deployment guide walks through it.

Yes. Sensors only ever receive data, never code, so nothing we send can make a sensor execute anything in your network. Sensor images are signed and pinned, with no silent updates, and everything an attacker types into a decoy is treated as hostile text. The security overview has the details.

It is the idea behind Kandaro Emulation, also known as continuous purple teaming. Instead of testing once a year, you run realistic attacks against your own environment on a schedule and check, step by step, whether your controls blocked them, detected them or missed them. Then you fix the gaps and run the same attacks again. The result is a current view of how your defenses hold up, not a report that is out of date within weeks.

A penetration test is a point-in-time engagement: it shows where you were exposed during a fixed window, and your environment keeps changing afterwards. Emulation is designed to run continuously, so a detection that breaks after a change is caught in days rather than at next year’s test. It complements a manual pentest; it does not replace the creativity of a human tester.

Many simulation tools replay a known attack tool and check whether its signature is caught. Emulation is being built to reproduce the underlying technique, including how it behaves on an endpoint, so your detections keep working when an attacker switches tools. It will also check both outcomes for every step: whether the attack was prevented, and whether it was detected.

Emulation is in development and we have not announced a date. Join the waitlist on the Emulation page and we will invite you to early access and tell you about pricing before launch.

In the EU. Kandaro is built and hosted in the European Union, events are kept for 90 days by default, and the AI that explains findings runs on our own EU infrastructure by default.

Kandaro Deception is €95 per decoy per month, or €495 per month for unlimited decoys, with a 14-day free trial. Paying yearly saves 20%. See pricing for the details. Emulation pricing will be published at launch.