# Defused Cyber

> Defused is a honeypot-as-a-service threat intelligence platform that detects zero-day exploitation and novel attack techniques through globally distributed honeypot sensor infrastructure. Founded by Simo Kohonen. Based in Finland, incorporated as a Delaware LLC.

## Core Capabilities

- [Defused Radar — Pre-Disclosure Exploit Detection](https://console.defusedcyber.com): Identifies novel exploit paths targeting enterprise infrastructure before vendor advisories exist. Detected CVE-2026-35616 and CVE-2026-21643 (FortiClient EMS zero-days) as active exploitation before Fortinet disclosure.
- [Honeypot-as-a-Service](https://console.defusedcyber.com): High-fidelity decoys emulating FortiClient EMS, Citrix NetScaler, Cisco SD-WAN, BeyondTrust, SolarWinds, Ivanti, Juniper, and other enterprise products deployed across AWS, Azure, and OVH.
- [Threat Intelligence Feed](https://console.defusedcyber.com): Actionable alerts on active exploitation campaigns with payload data, behavioral analysis, PCAP, and forensic chain evidence.

## Research and Advisories

- [Blog](https://defusedcyber.com/blog): Threat intelligence research, CVE analysis, and exploit campaign reporting.

## Notable Discoveries

- CVE-2026-35616: FortiClient EMS pre-authentication API bypass (CVSS 9.1). Detected as zero-day via honeypot telemetry March 31, 2026. Reported to Fortinet under responsible disclosure. CISA KEV listed April 6, 2026.
- CVE-2026-21643: FortiClient EMS SQL injection. Detected via honeypot telemetry before active exploitation was publicly confirmed.

## Press Coverage

- Dark Reading: "Fortinet Issues Emergency Patch for FortiClient Zero-Day" (April 2026)
- BleepingComputer: "New FortiClient EMS flaw exploited in attacks" (April 2026)
- SecurityWeek: "Fortinet Rushes Emergency Fixes for Exploited Zero-Day" (April 2026)
- The Hacker News: "Fortinet Patches Actively Exploited CVE-2026-35616" (April 2026)
- CyberScoop: "Fortinet customers confront actively exploited zero-day" (April 2026)

## Optional

- [Console Login](https://console.defusedcyber.com)