Catch exploitation before a CVE even exists
If it hits a decoy, you see it first. huntback captures exploitation of unknown and unpatched flaws the moment it lands, because a decoy has no legitimate traffic to hide in.
No signature required
A decoy does not need to know the CVE. Any interaction is hostile, so a never-seen payload against your emulated product is caught and scored as novel on arrival, days or weeks before a CVE id and a patch exist.
When a payload lands that matches no known signature, huntback keeps the full request, links the session across IP rotation and scans the source infrastructure, so your team has the exploit, the actor and the next hop before an advisory is written.
- No signature needed to detect
- Novel payloads scored on arrival
- Full chain kept for analysis
- Attacker infrastructure scanned back
POST /api/v4/provision novel · interest 72
no CVE · no signature · you saw it first
How we deliver it
Novelty scoring
Never-seen entry vectors float to the top of the queue.
Full capture
The exploit payload preserved for your researchers.
Instant alerts
Paged when something new hits several sensors at once.
Questions about block 0-days
Can a decoy detect a zero-day without a signature?
Yes. A decoy has no legitimate users, so any interaction is hostile by definition. A payload nobody has seen before is captured and scored as novel on arrival, without needing a CVE id or a detection rule.
What do I get when a novel exploit hits a decoy?
The full request and payload, the session linked across IP rotation, any stage-2 loader the attacker tried to pull, and a scan of the attacker's own infrastructure.
How fast can I deploy?
Minutes. Pick the products you run, deploy decoys that emulate them, and captures start as soon as attackers find them.