ZSCALER
DECEPTION
Detect sophisticated threats that bypass traditional defenses with the world's only zero trust platform with integrated deception capabilities
Detecting the top 40 ransomware techniques with Active Defense
Read how Active Defense protects your enterprise by disrupting the 40 most common ransomware tactics.
What is deception?
Deception is a proactive defense approach that detects active threats by populating your environment with decoys: fake endpoints, files, services, databases, users, computers, and other resources that mimic production assets for the sole purpose of alerting you to adversary presence when they’re touched.
Since decoys are hidden from valid users unaware of their existence, any interaction with them is a high-confidence indicator of a breach. Security analysts and SOCs leverage deception-based alerts to generate threat intelligence, stop lateral movement, and orchestrate threat response and containment without human supervision.
Deploy decoys, lures and honeynets
Setup fake domain controllers, active directory servers, applications and other enterprise resources.
Gain high-fidelity alerts and telemetry
SaaS applications can be a conduit for data theft, data exposure, or malware propagation if left unchecked.
Create false attack paths
Attackers are diverted by decoys and lures, shifting time back to defenders.
Speed time to containment
Take precise action to shutdown active attacks, driven by high-confidence alerts.
Sophisticated threats bypass traditional defenses. But why?
Too many false positives, missed alerts
45% of alerts are false positives. 99% of security teams say alert volumes are a problem. Analysts face a barrage of low-fidelity alerts every day, resulting in burnout and missed attacks.
Sophisticated attacks are stealthy
91% of incidents don’t even generate a security alert, therefore it takes 280 days on average to detect and mitigate a breach. Advanced adversaries use purpose-built playbooks to bypass existing defenses.
Advanced attacks are human-operated
68% of attacks are not malware-based. Advanced attacks have human adversaries in the driver’s seat which allows them to bypass defenses that only look for malicious code.
Boost your zero trust security posture with Zscaler Deception
Zscaler Deception further augments our comprehensive Zero Trust Exchange platform by proactively luring, detecting, and intercepting the most sophisticated active attackers.
Zscaler Deception leverages the Zero Trust Exchange to blanket your environment with decoys and false user paths that lure attackers and detect advanced attacks without operational overhead or false positives. Because our platform is cloud-native, we can scale your deployment quickly and without disruption.
It’s the easiest way to add a powerful layer of high-fidelity threat detection to your entire enterprise.
What customers are saying
“Zscaler Deception has made our network hostile and unpredictable for attackers.” 
Information Security, Manufacturing
“Zscaler Deception has greatly improved our detection capabilities. It is easy to implement and has given us excellent ROI.”
Information Security Manager, Banking and Finance
“Zscaler helps us catch malicious actors that haven’t been detected by other security controls.”
Head of Information Security, Media Network
Cutting-edge, high-fidelity threat detection
Integrated into the Zero Trust Exchange, simple to deploy, easy to use, and exceptionally accurate, Zscaler Deception is a robust addition to any organization's threat detection and zero trust strategy.
Castle-and-Moat
Traditional perimeter-based security allows unconstrained lateral movement.
Zero Trust
Eliminate the attack surface and lateral movement by directly connecting the right users to the right application.
Zero Trust with Active Defense
Intercept the most advanced attackers and detect lateral movement with zero false positives.
What can Zscaler Deception do for you?
Deliver pre-breach warnings
Get early warning signals when sophisticated adversaries like organized ransomware operators or APT groups are scoping you out. Perimeter decoys detect stealthy pre-breach recon activities that often go unnoticed.
Detect lateral movement
Catch attackers that have bypassed traditional perimeter-based defenses and are trying to move laterally in your environment. Application decoys and endpoint lures intercept these adversaries and limit their ability to find targets or move laterally.
Stop ransomware spread
Decoys in the cloud, network, endpoints, and Active Directory act as landmines to detect ransomware at every stage of the kill chain. Simply having decoys in your environment limits ransomware’s ability to spread.
Contain threats in real-time
Unlike standalone deception tools, Zscaler Smokescreen integrates seamlessly with the Zscaler platform and an ecosystem of third-party security tools such as SIEM, SOAR, and other SOC solutions to shut down active attackers with automated, rapid response actions.
Top 10 in-the-wild real-world detections
From stopping a North Korean APT to flagging an imminent ransomware attack a month before the breach, here are ten instances when Zscaler Deception detected targeted threats that had bypassed all other defenses.
Why Zscaler Deception?
Part of the Zscaler Zero Trust Exchange
As the world's only active defense solution natively integrated with a zero trust platform, Zscaler Deception is designed for seamless integration with Zscaler and other parts of your security environment.
Cloud-native architecture
No appliances needed. Zscaler Deception is entirely cloud-delivered, immediately scalable, and requires minimal on-prem computing.
Managed threat hunting
Zscaler ThreatLabz uses the globally deployed Zscaler Deception decoy mesh to detect threats and enrich intelligence data. Our elite threat hunters catch the stealthiest, most advanced attacks.
World-renowned active defense expertise
Career red-teamers with decades of experience building deception, active defense, and Deception programs will help you build your active defense deployment plan.
Get hands-on today
See how Zscaler Deception can detect the most serious threats targeting your organization.
Operationalize the MITRE Engage Framework
Zscaler Deception delivers 99% of the capabilities covered in MITRE Engage, the leading-edge objective industry framework for strategic deception and denial activities.
