Zscaler Deception

Zscaler Deception is a deception-based threat detection platform delivered as part of the Zscaler Zero Trust Exchange. This integrated capability uses decoys/honeypots to detect advanced in-network threats that have bypassed existing defenses. Organizations can use Zscaler Deception to detect compromised users, stop lateral movement, and defend against human-operated ransomware, hands-on keyboard threats, supply chain attacks, and malicious insiders.

What can Zscaler Deception do?

Detect pre-breach attacks - Get alerted when targeted threat actors are scoping out an environment before mounting an attack. Block these threats and use telemetry to correlate for presence of attacker activity in the environment.

Detect compromised users - Decoy passwords, cookies, sessions, and bookmarks to decoy applications to detect compromised users when an attacker uses one of these deceptive assets.

Identity use of stolen credentials - Decoy web apps resembling vulnerable testbed applications and remote access services, like VPN, intercept attackers using stolen credentials to log in.

Detect privilege escalation - Detect and block adversaries that have compromised the environment and are now enumerating Active Directory to find high value targets for privilege escalation.

Key Capabilities Include:

• GenAI Decoys: Uses decoy chatbots, decoys LLM APIs, adaptive decoys, and decoy agents to detect attackers targeting GenAI infrastructure in an environment.
• Threat Intelligence Deception: Uses internet-facing decoys to detect pre-breach threats specifically targeting the organization.
• Endpoint Deception: Plant a minefield to protect endpoints with decoy files, credentials, and processes.
• Cloud Deception: Detects lateral movement in cloud environments with decoy web and file servers, and databases.
• ThreatParse: Extracts insights from context-rich logs, and offers automated forensics and root cause analysis in two clicks.
• Application Deception: Deploys decoy server systems that host services like SSH servers, databases, and file shares.
• Active Directory Deception: Detects enumeration activity and malicious access with fake users in Active Directory.
• RDP Decoys: Offers deeper attack visibility in realistic, highly interactive decoy OS environments.