See Exploits Land Before the Advisory Drops
Real-time honeypot intelligence. Pick a plan, start seeing attacks.
Defused TF and EX (External Threat Intelligence)
Defused TF
- ✔ Manual analysis & learning
- ✔ Non-operational research
- ✖ No API or integrations
Defused EX
- ✔ 10 always-on decoys
- ✔ Choose your Geolocation
- ✔ REST API access
- ✔ Webhook, syslog & SIEM integrations
- ✔ Radar anomaly detection
- ✔ Custom decoy branding & applications
Mix and match TF + EX
TF and EX are designed to complement each other. Use TF for broad internet threat telemetry across our shared sensor network, and add EX to deploy bespoke decoys that mirror your real infrastructure. Cross-reference TF's wide-angle data with EX's targeted signals to identify campaigns specifically probing your technology stack. Subscribe to both independently - no bundling required.
| Feature | Starter | TF Research | TF Pro | TF Enterprise | EX |
|---|---|---|---|---|---|
| Data Access | |||||
| Live honeypot streams | Rotating | 10 | 20 | Unlimited | - |
| Dedicated bespoke decoys | - | - | - | - | 10 |
| Custom decoy branding | - | - | - | - | ✔ |
| Geolocation selection | - | - | - | - | ✔ |
| PCAP collection | - | - | - | - | Add-on |
| Platform & Integrations | |||||
| Console dashboard | ✔ | ✔ | ✔ | ✔ | ✔ |
| REST API | - | - | ✔ | ✔ | ✔ |
| Webhook / syslog | - | - | ✔ | ✔ | ✔ |
| SIEM integration | - | - | ✔ | ✔ | ✔ |
| Radar anomaly detection | - | - | ✔ | ✔ | ✔ |
| Users & Support | |||||
| User seats | 1 | 1 | 3 | Unlimited | 5 |
| Support | Community | Priority email | Dedicated | Priority email | |
| Custom SLA | - | - | - | ✔ | - |
| License | |||||
| Research & education | ✔ | ✔ | ✔ | ✔ | ✔ |
| Internal defensive operations | - | - | ✔ | ✔ | ✔ |
| Commercial redistribution | - | - | - | ✔ | - |
| Pricing | |||||
| Monthly | Free | $50 | $299 | Custom | From $599 |
Coming Soon
Builder (coming soon)
Defused IB (Internal Breach Detection)
Defused IB
- ✔ IT, OT & identity decoys
- ✔ Unlimited decoy servers & Windows agents
- ✔ On-premise & cloud deployments
- ✔ Automated responses & SOAR integration
- ✔ Full API, SIEM & webhook integrations
- ✔ RBAC & multi-tenant governance
- ✔ Dedicated support & custom SLA
- ✔ Bespoke decoy tailoring included
Who is IB for?
Organizations with mature security programs that need to detect lateral movement, credential theft, and insider threats before damage is done. IB deploys deceptive infrastructure inside your network - decoy servers, honeytokens, and endpoint agents that generate high-fidelity alerts with near-zero false positives.
How it works
- 1. Scoping call to map your network topology and threat model
- 2. We design and deploy deceptive assets tailored to your environment
- 3. Ongoing monitoring, tuning, and triage by the Defused team