ZSCALER
DECEPTION
Detect sophisticated threats that bypass traditional defenses with the world's only zero trust platform with integrated deception capabilities
KuppingerCole named Zscaler a leader in Distributed Deception Platforms
Detecting the top 40 ransomware techniques with active defense
Read how active defense protects your enterprise by disrupting the 40 most common ransomware tactics.
What is deception?
Deception is a proactive defense approach that detects active threats by populating your environment with decoys: fake endpoints, files, services, databases, users, computers, and other resources that mimic production assets for the sole purpose of alerting you to adversary presence when they’re touched.
Since decoys are hidden from valid users unaware of their existence, any interaction with them is a high-confidence indicator of a breach. Security analysts and SOCs leverage deception-based alerts to generate threat intelligence, stop lateral movement, and orchestrate threat response and containment without human supervision.
Deploy decoys, lures and honeynets
Set up fake domain controllers, active directory servers, applications, and other enterprise resources.
Gain high-fidelity alerts and telemetry
Don't let unchecked SaaS applications be conduits for data theft, data exposure, or malware propagation.
Create false attack paths
Divert attackers with decoys and lures, shifting time back to your defenders.
Speed time to containment
Take precise action, driven by high-confidence alerts, to shut down active attacks.
Sophisticated threats bypass traditional defenses. But why?
Too many false positives, missed alerts
45% of alerts are false positives, and 99% of security teams say alert volumes are a problem. Analysts face a barrage of low-fidelity alerts every day, resulting in burnout and missed attacks.
Sophisticated attacks are stealthy
91% of incidents don’t even generate security alerts—that's part of why it takes an average of 280 days to detect and mitigate a breach. Advanced adversaries use purpose-built playbooks to bypass traditional defenses.
Advanced attacks are human-operated
68% of attacks aren't malware-based. Advanced attacks have human adversaries in the driver’s seat, which allows them to bypass defenses that only look for malicious code.
Boost your zero trust security posture with Zscaler Deception
Zscaler Deception further augments our comprehensive Zero Trust Exchange™ platform by proactively luring, detecting, and intercepting the most sophisticated active attackers.
Zscaler Deception leverages the Zero Trust Exchange to blanket your environment with decoys and false user paths that lure attackers and detect advanced attacks without operational overhead or false positives. Because our platform is cloud native, we can scale your deployment quickly and without disruption.
It’s the easiest way to add a powerful layer of high-fidelity threat detection to your entire enterprise.
What customers are saying
“Zscaler Deception has made our network hostile and unpredictable for attackers.” 
Information Security, Manufacturing
“Zscaler Deception has greatly improved our detection capabilities. It is easy to implement and has given us excellent ROI.”
Information Security Manager, Banking and Finance
“Zscaler helps us catch malicious actors that haven’t been detected by other security controls.”
Head of Information Security, Media Network
Cutting-edge, high-fidelity threat detection
Integrated into the Zero Trust Exchange, simple to deploy, easy to use, and exceptionally accurate, Zscaler Deception is a robust addition to any threat detection and zero trust strategy.
Least mature
Castle and moat
Traditional perimeter-based security allows unconstrained lateral movement.
Moderately mature
Zero trust
Directly connecting authorized users to the right applications eliminates the attack surface and lateral movement.
Most mature
Zero trust with active defense
Deception technology intercepts advanced attackers and detects lateral movement with zero false positives.
What can Zscaler Deception do for you?
Deliver pre-breach warnings
Get early warning signals when sophisticated adversaries like organized ransomware operators or APT groups are scoping you out. Perimeter decoys detect stealthy pre-breach recon activities that often go unnoticed.
Detect lateral movement
Catch attackers that have bypassed traditional perimeter-based defenses and are trying to move laterally in your environment. Application decoys and endpoint lures intercept these adversaries and limit their ability to find targets or move laterally.
Stop ransomware spread
Decoys in the cloud, network, endpoints, and Active Directory act as landmines to detect ransomware at every stage of the kill chain. Simply having decoys in your environment limits ransomware’s ability to spread.
Contain threats in real-time
Unlike standalone deception tools, Zscaler Deception integrates seamlessly with the Zscaler platform and an ecosystem of third-party security tools such as SIEM, SOAR, and other SOC solutions to shut down active attackers with automated, rapid response actions.
Detect compromised users
Decoy passwords, cookies, and sessions as well as bookmarks to decoy applications detect compromised users when an attacker uses one of these deceptive assets.
Identify abuse of stolen credentials
Decoy web apps—resembling vulnerable testbed applications and remote access services like VPNs—intercept attackers using stolen credentials to log in.
Top 10 in-the-wild real-world detections
From stopping a North Korean APT to flagging an imminent ransomware attack a month before the breach, here are 10 times Zscaler Deception detected targeted threats that had bypassed all other defenses.
Why Zscaler Deception?
Nothing to deploy
Zscaler Deception uses Zscaler Private Access® infrastructure to create, host, and distribute decoys. No additional VMs or hardware are needed.
Zero network configuration
Say goodbye to VLAN trunking, SPAN ports, and GRE tunnels. Zscaler Deception leverages zero trust policies to route malicious traffic to decoys.
Built for Zero Trust
Only Zscaler Deception delivers active defense built into a zero trust architecture. Our cloud native platform scales to fit any organization and benefits from our global threat visibility.
Get hands-on today
See how Zscaler Deception can detect the most serious threats targeting your organization.
Operationalize the MITRE Engage framework
Zscaler Deception delivers 99% of the capabilities covered in MITRE Engage, the leading objective industry framework for strategic deception and denial activities.
