How it works
Starting from your own dedicated customer console, deployment is as simple as downloading the deception artefacts and running the deployment script within your environment. From there, the AIM technology, breadcrumbs, and canaries are automatically deployed across your endpoints, perimeter, cloud, file repositories, and active directory.
Once deployed, a heartbeat script runs on your existing infrastructure that checks that every artefact is where it should be and the hash matches the expected value. This heartbeat continues every day, so you can track from your customer console if a deception artefact is ever altered or deleted, or better yet, we will let you know the moment that happens.
How detection works
Our deception artefacts are specifically placed to catch intruders when they get initial access, and are additionally layered across the credential access, discovery and lateral movement tactics of the attack chain. Not only that, but we utilise specific file type and directory locations that are statistically proven to be the earliest enumerated, so that our canaries fire before a threat actor finds anything real.
Once a threat actor attempts to use a canary, the alert goes straight to your SIEM, not our infrastructure. This means you are in control of your data and have one less console to manage, whilst threat actors miss out on the easiest way to identify canaries: via an external domain call.
Kill two threats with one bird
Book a demo today
A walkthrough of how it works, the research behind AIM Technology, and how it can protect your business from human and AI-enabled threats.