How it works
Place a decoy. Hear only when it matters.
Most security tools watch your real systems and guess what is malicious. Kandaro places systems nobody should use, so every touch is worth reading. Your first decoy is running in about a minute.
14-day trial of Kandaro Deception
Four steps
From nothing to your first explained finding.
- 01
Place a decoy
Choose what it should look like in the Console, such as a file server, a printer or a database. Then run one Docker command on any Linux host inside your network.
- 02
Wait for a touch
A decoy has no users and no purpose. Nobody has a reason to scan it, log in or read its files, so anything that does is the signal.
- 03
Read what happened
Every event is explained in plain English. Related events become one incident with a narrative and a recommended action.
- 04
Act on it
The incident goes to email, Slack or your own systems, so the person on call can act without a specialist.
What runs where
A small sensor on your side. Everything else on ours.
You do not install agents on your servers or laptops, and you do not change your firewall for inbound traffic.
In your network
- One lightweight sensor in a locked-down container.
- Outbound HTTPS only. No inbound ports to open.
- It receives configuration as data, never code.
- Signed, pinned images. No silent updates.
At Kandaro, in the EU
- Events are stored in the EU, 90 days by default.
- The AI that explains them runs on our own EU infrastructure by default.
- Everything an attacker types is treated as hostile text.
- Your data is isolated from other customers in the database.
The full description of how we protect you is on the security page.
What a touch looks like
Silence, until something that should not be there moves.
A scan, a login attempt, a file being opened: each one is recorded the moment it happens, with the source and what was tried.
- 02:21:40smb.share_enum · nas-backup-01high
- 02:19:12login.password · nas-backup-01high
- 02:17:55mcp.tools_call · ai-gatewaycritical
- 02:16:03ssh.auth · nas-backup-01medium
- 02:14:07tcp.port_scan · nas-backup-01medium
- 01:58:31snmp.get · printer-3flow
- 01:42:10honeycred.used · finance-sharecritical
- 01:39:48mysql.query · db-replicahigh
- 02:21:40smb.share_enum · nas-backup-01high
- 02:19:12login.password · nas-backup-01high
- 02:17:55mcp.tools_call · ai-gatewaycritical
- 02:16:03ssh.auth · nas-backup-01medium
- 02:14:07tcp.port_scan · nas-backup-01medium
- 01:58:31snmp.get · printer-3flow
- 01:42:10honeycred.used · finance-sharecritical
- 01:39:48mysql.query · db-replicahigh
How it is explained
What happened, why it matters, what to do next.
Kandaro turns raw protocol data into a sentence your whole team understands, with the raw detail one click away.
{
"sensor": "nas-backup-01",
"profile": "nas",
"proto": "smb2",
"type": "login_attempt/ntlm",
"src": "10.20.4.77:51322",
"dst": "10.20.8.250:445",
"ntlm": {
"user": "backup-admin",
"domain": "ACME",
"workstation": "FIN-WS-114"
},
"result": "STATUS_LOGON_FAILURE",
"ts": "2026-10-08T02:19:12Z"
}Someone on the finance network tried to sign in to your backup NAS.
The workstation FIN-WS-114 (10.20.4.77) tried the account backup-admin on a decoy file share. This device isn't real, so no legitimate user or job should ever connect to it.
Recommended action
Isolate FIN-WS-114, then reset the backup-admin password and check where it is used.
Attacker-supplied text is fenced off from the AI's instructions, and a rule-based severity floor means the model can raise a severity, never lower it. If the AI is unavailable, you get a template summary rather than nothing.
Where it arrives
In the tools your team already uses.
Email
Readable incident emails to people or shared inboxes.
Slack
Incidents in the channel your team already reads, filtered by severity.
SIEM and webhooks
Connectors for Splunk, Elasticsearch and Microsoft Sentinel, and signed webhooks for any SOAR or ticketing tool.
API and export
A read-only API and MCP server for your own tooling, and a full export at any time.
Running a SOC, or using an MDR provider or an AI SOC platform? See Kandaro and your SOC for how the pieces fit.
What comes next
Then we attack you first.
Deception catches whoever gets in. Emulation will run realistic attacks against your own environment, continuously, and show what your defenses block, detect and miss. Same Console, explained the same way.
- 01
Select
Pick scenarios from the threat library, or build your own.
- 02
Attack
Emulation runs them against your own environment.
- 03
Verify
See what was blocked, detected and missed.
- 04
Improve
Close the gap, then re-run to prove the fix.
Put a decoy on your network today.
Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.
Card required · cancel before day 14 and pay nothing