Network deception platform
Dupplio plants lean, measurably believable decoys across your network. An intruder who scans, probes or uses a stolen password touches one first, and you get evidence, not a hunch. Built to run on an air-gapped site exactly as it runs online.
No internet, DNS or NTP required
Firecracker microVM per trap
PCAP, session recording, signed chain
Sensors never accept a connection
Why Dupplio
Most decoys are spotted by the first serious scan. Dupplio treats believability as a number the product computes, and refuses to deploy anything that does not clear the bar.
A built-in fingerprinting lab attacks every trap with the tools a real attacker uses: nmap, p0f, JA4 and HASSH, timing analysis, protocol edge cases. Each trap gets a 0 to 100 score against recordings of real devices. Below 70, it never goes live.
Hostnames, users, files and decoy passwords are derived cryptographically from a secret per-site seed. Every lure carries a hidden tag, so when a stolen credential shows up anywhere, Dupplio knows it is a decoy and which workstation it was taken from. No database lookup, no cloud.
One signed package, one local analytics stack, one interface. On an isolated network you update from a file; on a connected one the same package is pulled outbound. Nothing in the critical path depends on an external service or a language model.
How it works
The system does not ask how many traps you want. It asks what coverage you want, then works out where traps earn the most.
A Sensor listens passively to ARP, DHCP, LLDP, mDNS and NetBIOS and profiles each segment: address ranges, vendors, operating systems, naming scheme. Active scanning is opt-in and off by default on OT networks.
Core runs thousands of simulated attacker paths over the network graph and proposes a deployment: which templates, how many, at which addresses. You see the coverage probability per segment and what each extra trap adds.
Core signs a manifest. The Sensor clones microVM snapshots, assigns MAC, hostname, banners and content from the seed, and brings the traps up. The Seeder places the lures that point at them.
The credibility lab scans each new trap from outside the segment and returns its score, because the local network changes timing. Anything under threshold is held back and flagged.
Every connection to a trap, and every use of a lure, becomes a signed event with PCAP, a recorded session and context: who, from where, and which lure led them there. Core groups events into one incident.
The incident goes to your SIEM or SOAR, appears in the console, and is stored as an evidence bundle your IR team can use as is.
Architecture
Each component installs and replaces independently. There is no permanent agent on endpoints; lures are placed through GPO, Intune or a one-time script, and all detection happens on the network.
Trap catalogue, site seed, deployment policy, credibility lab, correlation, console and API.
Runs 1 to 200 microVM traps across several VLANs, answers ARP, ICMP and TCP handshakes at the right latency, captures PCAP.
Generates and distributes credentials, files and AD or DNS records by policy, then verifies they are in place.
Trap catalogue
Each trap is a single process inside its own Firecracker microVM, a few tens of megabytes, emulating a protocol precisely up to authentication. No full operating system, nothing for a scanner to recognise, and nothing for an intruder to pivot from.
Windows 10/11, Server 2012 R2 to 2022 by version profile. SMB shares, NetBIOS. A "correct" stolen password disconnects and raises a critical alert.
Pass-the-Hash · share enumerationDepartmental shares and backups with a seeded folder tree. Reading or downloading a decoy document reports back.
document hunting · data stagingInternal web and backup hosts. SSH with a limited shell, HTTP with an internal site.
stolen credentials · tool downloadPostgreSQL and MySQL with decoy schemas and read-only queries.
data theft · user-table searchSiemens PLC, Modbus gateway, HMI. Full protocol with registers that change according to a simulated process.
identification reads · register writes · CPU stopPACS and imaging devices. DICOM C-ECHO and C-FIND, HL7, with synthetic metadata.
patient queries · retrieval attemptsIP cameras, printers, managed switches. Web and Telnet with vendor default passwords, SNMP.
default logins · config changesAD service accounts, DNS and SPN records. No physical trap; detection comes from the AD logs.
Kerberoasting · LDAP enumerationVariety comes from the seed, not from the number of families. Two traps from the same template never look alike: different hostname, vendor MAC, software version, users, files and uptime history. Traps rotate on a 90-day cycle with a fresh identity, and a trap that has been exposed is replaced at once.
Deployment
You manage everything from the browser. There is no access to the operating system of any component, and no need for it.
Security of the product itself
Every trap runs in its own microVM under Firecracker's jailer and seccomp. It sees only its VLAN through a dedicated tap, with no path to Core, the Sensor or other traps. Outbound traffic goes to a rate-limited sinkhole.
Minimal OS with a read-only root, Secure Boot and dm-verity, no open SSH. The Sensor's identity key is generated in the TPM and never leaves it.
Sensors receive derived sub-keys per segment and period. A stolen Sensor does not expose lures anywhere else.
Reproducible builds, an SBOM per release, a signature on every package. An offline customer verifies updates against the public key received at install.
Every event is Ed25519-signed and chained to the previous one. Tampering breaks the chain, and the chain is what you hand to IR.
Three roles, local TOTP multi-factor, and a signed audit log for every administrative action.
Air-gapped and connected
| Capability | Air-gapped | Connected |
|---|---|---|
| Install | One OVA/ISO for Core, one for Sensor, all dependencies included | Same |
| Licensing | Signed licence file with expiry and Sensor cap. No network check, no lock-out on expiry | Same file, renewed automatically |
| Catalogue & software updates | Signed package on USB or file, imported in the console and verified before it applies | Same package, pulled outbound from the update server |
| Threat intelligence | All analytics local. ATT&CK mapping from the package, STIX 2.1 export to file | STIX export to your TAXII server. No data shared with us without explicit consent |
| Time | Internal NTP or Core clock; drift is recorded in the event chain | Internal or external NTP |
| Help & documentation | Built into the console | Same |
Get in touch
A demo takes forty minutes: we deploy a segment, run the credibility lab in front of you, then walk a stolen credential into a trap and show the incident that lands in your SIEM.
Write to us at hello@dupplio.com
