Send threat actorsfrom your network into ours.
Hoxey places decoys among your systems. A threat that goes for one lands in our network, where it can play our game.
- Near-zero false positives
- No pivot risk
- No supply-chain risk
- EU sovereign
It goes for your backup.It lands in ours.
A typical intrusion, step by step: from a compromised workstation into what appears to be your treasure. But it's a trap.
From a compromised workstation, a threat scans your network. Both decoys raise an alert.
Detection was built for analysts.Most companies don't have any.
Hoxey sends you the few alerts that matter, in plain language, where you already work. There is nothing to tune and nothing to run.
Every alert is a threat.
A decoy has no legitimate traffic, so what reaches you is real. Near-zero false positives, by design.
Seconds, on the tools you use.
Each person picks their channels, the severity worth waking up for, and their quiet hours.
Live in minutes. Then it runs itself.
We patch, rebuild and watch the decoys from our side. You read alerts, not dashboards.
Hoxey Security Alerts APP
[CRITICAL] SSH Successful Authentication Detected
- Description
- Login as
backupfrom 10.0.4.14 (ws-14) after 37 failed attempts. The session is on Hoxey's network. - Honeypot
- backup-01
- Severity
- CRITICAL
[CRITICAL] Command executed by root
root (UID 0): cat /etc/shadowOr straight into your security stack. Webhooks deliver every alert as JSON, with your own auth, headers and payload template.
The honeypot, rebuilt for the future.
Near-zero false positives, low cost, and threats deceived into wasting their time. Every honeypot offers that, with one asterisk: pivot risk.
Hoxey's one-way technology removes the asterisk and moves deception forward.
No way back in. Not even for us.
The decoy reaches your network through a one-way tunnel. No agent, no management channel, no credentials: no path in for a threat, for a supply-chain attack, or for us. Proven by source code you can audit, not “trust us”.
Complete systems, without the risk.
Convincing honeypots were always the dangerous kind: real systems a threat could pivot from. Ours are complete systems with plausible fake data, and the pivot risk is gone at the root, because they are not in your network.
Undetected, and always improving.
A decoy that gets fingerprinted is rebuilt and replaced for every customer in minutes. New templates reach everyone as they ship, whatever their plan.
Deployed against the threat.
Decoys go up in minutes, matched to what you are facing. Drive them from your own stack through our CLI, or let your AI agents do it over MCP.
Don't trust us.Verify us.
Trust is what you give a vendor when you can't check. We would rather be checked: every claim below comes with the way to prove it.
We don't publish a customer list. In deception, secrecy is the product: a list of who runs Hoxey is intel for threats targeting them.
We have no access to your network, under any circumstance. The device only connects out, refuses every inbound connection, and holds no key of ours.
We build as if we will be breached. Multiple coherent controls, designed to prevent a breach and to minimise its blast radius. A custom-built runtime monitor flags any deviation from the baseline workload.
5-minute RPO, 4-hour RTO. Disaster recovery is tested every month, not written down once and hoped for.
Our ISMS runs today, built to ISO/IEC 27001:2022. 74 of the 93 Annex A controls are fully implemented. The certification audit is planned for 2027.
Join The Hive
Threat intel from our own decoys, first-hand. Not another newsletter.
- Intel from our network. What our decoys catch: the credentials threats try, the tools they bring, the techniques that are new. First-hand, not recycled.
- Alerts, when it matters. When something we see is worth acting on, you hear it from us, with what to do.
- Attack stories. The story behind the intel: a real attack, narrated step by step from the offensive side.
Low volume, high quality.