The ThreatDefend Deception and Response Platform is designed to make the entire network a trap and to force the attacker to have to be right 100% of the time or risk being discovered.

The solution combines distributed, high interaction deception lures and decoys designed to provide early visibility into in-network threats, efficient continuous threat management, and accelerated incident response. The solution is based on six pillars, which include visibility, real-time detection, malware and phishing analysis, forensic reporting, incident handling, and response.

These engagement-based alerts include the substantiated attack detail required for incident handling and response and can be used for attack information sharing and forensic reporting. Attack details can be viewed within a threat intelligence dashboard with actionable drill-downs or through a variety of forensic reports, while 3rd party integrations provide automated blocking, quarantine, and threat hunting to accelerate incident response.

The Attivo ThreatStrike Endpoint solution, part of the modular ThreatDefend Platform, provides early and accurate detection of targeted attacks on endpoints and servers. Customizable and non-intrusive, this agentless deception technology places bait and breadcrumbs that lead to an engagement server, where an alert is raised, attacks are analyzed, and actions to quarantine the infected system are activated.

To reach sensitive network data, attackers will compromise computers to steal passwords and hashes that can then be used to move laterally within the network and escalate privileges to advance their attack. The ThreatStrike solution is an agentless technology that dynamically plants deception credentials, lures, and deception network drives for ransomware detection.

ThreatPath™ Attack Path Vulnerability Assessment

The Attivo ThreatPath™ solution, part of the modular ThreatDefend™ Platform, provides continuous attack path vulnerability assessment of likely lateral movement avenues that an attacker would take to compromise a network.

The solution exposes and provides visual graphs to the paths an attacker would traverse through the internal network based on misconfigured systems and misused or orphaned credentials. Integrations with workflow and incident management systems like Service Now and JIRA can be activated inside the dashboard and used for automating remediation notifications and processes.