Detect what got in. Track what it touched. Disrupt it.

Detection

No signature to write, no baseline to learn, no patch to wait for.

Deception is not a side experiment anymore. The CSA and SANS briefing on AI-accelerated threats puts building a deception capability among its priority actions, because it is independent of the attack tool and the vulnerability. When the exploit is one nobody has seen yet, that independence is the entire point.

It stays rare because it has been a project. Decoys to design, infrastructure to run, a capture pipeline to maintain, and nobody whose job it is. We run all of that, so it arrives as a layer rather than a backlog item.

We treat the touch as the start of the record. Every interaction with a canary (a digital tripwire) is captured in full and classified before it reaches you.

Cloud Security Alliance and SANS, The AI Vulnerability Storm, 2026.

On every interaction

• JA4 TLS fingerprint. Computed from the ClientHello by the terminating proxy. Identifies the client stack, not the user agent string it claims to be.
• HTTP/2 fingerprint. Complements JA4 at the protocol layer.
• Device and browser. Extracted and normalized, not trusted.
• Network and geolocation. Including network type.
• Human or automated. Link-preview services, crawlers, and scanners are identified and separated from access by something that chose to look.
• Out-of-band alerting. Delivered on a channel separate from the one being watched.

Why now

AI attackers move faster than they can verify.

In a state-sponsored espionage campaign disclosed in 2025, an AI ran 80 to 90 percent of the operation across roughly thirty targets, making thousands of requests, often several a second, with human operators stepping in at only a handful of decision points. Anthropic's own account of that campaign records the model hallucinating credentials and reporting publicly available information as secret.

Speed at that scale is not careful. An attacker that cannot verify what it finds is an attacker deception works on, and every additional interaction is another chance to touch something that never should be touched. In testing across 21 models, AI attackers took the bait 78.5 percent of the time, more than twice the human rate. Not one of the 21 resisted as well as people did.

At the same time, the signal every other control depends on is thinning. 82 percent of detections last year involved no malware at all, and the fastest recorded breakout was 27 seconds. There is nothing to write a signature for, and no time to read about it afterwards.

The attackers becoming most common are the ones deception works best against.

Sources: Anthropic, November 2025. Honeyquest for LLMs, Horizon3.ai, June 2026. CrowdStrike Global Threat Report, 2026.

Deployment

What this looks like in your environment.

Request a demo

Pseudoscape

Decoys that do not wear off.

Most deception is planted once and left alone. Fake servers, fake credentials, fake files, set up in advance and static from then on.

That works on a human who stumbles into one. It works poorly on an AI agent, which probes methodically, notices what does not fit, and routes around it. Published testing puts numbers on this: deception planted in advance influenced fewer than four of the twenty steps an attacking agent took.

Pseudoscape does not plant and wait. It responds to what the agent is doing, building what it encounters next as it goes, and keeping that environment consistent as the agent explores it.

Blue Decoy places the canaries. Pseudoscape answers them.

Talk to us about Pseudoscape

AgentSnare, July 2026.

For individuals

The same thesis at individual scale.

Blue Decoy places canaries in an individual's communications and instruments anyone who reads them. Built for journalists, executives, legal teams, government personnel, and people leaving controlling relationships.

Limited availability Who else is reading your messages?