# 21. Deception Technology in 2026: Who's Left, What It Actually Does, and the Dozen Questions Worth Asking

A client conversation this week in financial services turned, as these things do, into a proper deception technology deep dive. Who's still standing, what the category actually means now, and what to ask before anyone signs anything. Figured it was worth getting down properly rather than letting it live in a Slack thread and a meeting deck nobody else sees.

The consolidation nobody quite announced

If you last looked at deception technology five or six years ago, most of the names you remember have changed hands.

Attivo Networks went to SentinelOne in 2022 and is now the identity and deception layer inside their platform. TrapX went to Commvault the same year. Smokescreen got picked up by Zscaler in 2021 and ships today as Zscaler Deception. Illusive Networks, probably the sharpest identity-deception play of that generation, went to Proofpoint in 2022 and now lives inside their identity threat protection line.

The pattern is consistent: deception stopped being a category you buy on its own and became a feature bolted onto whatever XDR, EDR or identity platform already has budget. That's not necessarily a bad outcome for customers, but it changes the conversation. The question used to be "which deception vendor do I pick." Increasingly it's "does the deception module inside the platform I already own actually do anything, or do I need a specialist bolted on for something that matters."

The specialists that are still independent and worth naming: Acalvio, a pure-play out of the US that's been at this since 2015 and holds a stack of patents in the space, CounterCraft out of Spain who partnered with CYBER RANGES in 2025 to pair deception with attack-emulation environments, Labyrinth out of Ukraine, CyberTrap out of Vienna running deception-as-a-service, and Penten in Australia with an AI-generated fake network angle leaning toward government and defence use cases.

One honourable mention with an asterisk: Cymmetria, whose MazeRunner and ActiveSOC products are technically still out there with no shutdown announcement, but headcount data has them down to roughly one person spread across three continents. That's not a company you put in front of a serious buyer, it's a name still on the lights with nobody home.

What "deception technology" actually covers

Worth untangling the jargon, because vendors use it loosely and it's not all the same thing.

The building blocks. Honeypots are the oldest form, whole fake machines standing in for a vulnerable system. Good for research, weak in production because attackers fingerprint them and someone has to keep them fed and current. Honeytokens are fake credentials, API keys, documents or database records planted purely to trip an alarm the second they're touched. Cheap, low noise, and about as unambiguous a signal as security gets: nothing legitimate should ever touch one. Decoys are the broader version of a honeypot, entire fake assets mimicking servers, databases, routers, even OT devices like PLCs, generated at scale rather than hand-built. Breadcrumbs sit on real endpoints, things like fake cached credentials in memory, designed to steer an attacker who's already inside toward a decoy instead of the crown jewels. Baits and lures round it out, deliberately misconfigured services designed to look like an easy win.

The layers. Network-layer deception is the classic decoys-on-the-wire approach. Endpoint-layer is breadcrumbs on real machines. Identity-layer is fake credentials and privileged accounts in Active Directory, which was Illusive's specialty and now lives inside Proofpoint. Cloud and hybrid deception, decoy S3 buckets, fake IAM roles, fake API keys, is where the newer investment is going, largely because that's where AI-driven attack automation is pointed too.

For anyone in financial services or a regulated industry, identity-layer and honeytokens are usually the sharpest fit. Credential theft and lateral movement into transaction systems is exactly the exposure, more than someone poking a fake industrial controller.

The dozen questions worth asking any vendor in this space

These hold regardless of who's sitting across the table, pure-play, bolted-on module, or a legacy name now wearing someone else's badge.

1. Show me a decoy compromise live, not in a slide. Realism claims are cheap. If they can't do a real-time attacker interaction against a decoy in the room, the "high-interaction" language is marketing.
2. What's your false positive rate, and how is it measured? Deception is supposed to be near-zero false positive by design, nothing legitimate should ever touch a decoy. Hedging on this number is the tell.
3. How does an alert reach my SOC, and in what format? Not "do you integrate," but does it land as a structured, high-fidelity event ready to action, or does it need triage first.
4. What's the actual maintenance burden, in analyst-hours per month? Static honeypots die because nobody maintains them. Ask who refreshes decoys, credentials and breadcrumbs, and whether that's automated or someone's Tuesday afternoon.
5. How do you keep decoys convincing against an attacker using AI to recon my environment first? Static decoys get fingerprinted fast by automated tooling. What's the adaptive story.
6. Where do you sit relative to my existing EDR/XDR's built-in deception module? Most platforms ship a basic deception feature now. There needs to be a real answer for why theirs is worth layering on top.
7. What's the blast radius if a decoy is compromised or misused? Can an attacker pivot from the decoy back into anything real, and what's the isolation guarantee.
8. Show me a customer reference in my actual industry, not a generic case study. A generic "we caught APT29" story tells you nothing about your own exposure.
9. What data leaves my environment, and where does it live? Deception platforms see attacker behaviour and sometimes real credentials in transit. Ask about telemetry, cloud versus on-prem, and data residency.
10. What's the time-to-value, and how do you define it? Push for a number they'll put in a contract, thirty, sixty, ninety days to first meaningful detection, not just "fast."
11. What happens to my deployment if you get acquired? Given how much of this market just consolidated, this is not hypothetical. Ask about product continuity commitments.
12. What can you detect that my existing controls can't, specifically? Force them past "early detection of lateral movement" into a concrete, named gap. If they can't name it, they haven't done their homework on the account.

A couple of these flex depending on who's presenting. Question six cuts one way against a pure-play and the opposite way against a vendor selling deception as a bolted-on extra. Question eleven bites harder against the independents still standing on their own balance sheet than it does against a vendor who's already been through the acquisition and can point at a finished integration.

The common thread across all twelve is the same one that applies to most of security tooling: force the vendor past the pitch and into a number, a live demo, or a name. That's true whether it's a fifteen-year-old pure-play or someone you've never heard of trying to get in the door.

Prepared collaboratively with: Chris Roberts, Sid and Claude (Anthropic)