Send threat actorsfrom your network into ours.
Hoxey places decoys among your systems. A threat that goes for one lands in our network, where it can play our game.
- Near-zero false positives
- No pivot risk
- No supply-chain risk
- EU sovereign
It goes for your backup.And lands in ours.
A typical intrusion, step by step: from a compromised workstation into what appears to be your treasure. But it's a trap.
From a compromised workstation, a threat scans your network. Both decoys raise an alert.
Detection was built for analysts.Most companies don't have any.
Hoxey sends you the few alerts that matter, in plain language, where you already work. There is nothing to tune and nothing to run.
Every alert is a threat.
A decoy has no legitimate traffic, so what reaches you is real. Near-zero false positives, by design.
Seconds, on the tools you use.
Each person picks their channels, the severity worth waking up for, and their quiet hours.
Live in minutes. Then it runs itself.
We patch, rebuild and watch the decoys from our side. You read alerts, not dashboards.
Hoxey Security Alerts APP
[CRITICAL] SSH Successful Authentication Detected
- Description
- Login as
backupfrom 10.0.4.14 (ws-14) after 37 failed attempts. The session is on Hoxey's network. - Honeypot
- backup-01
- Severity
- CRITICAL
[CRITICAL] Command executed by admin
admin (UID 1000): cat /etc/passwdOr straight into your security stack. Webhooks deliver every alert as JSON, with your own auth, headers and payload template.
Detecting threats is just the beginning.With Hoxey, you shape their behaviour.
Hoxey is not a point solution. It is one coherent deception platform, orchestrated via CLI or MCP, that adapts in real time to trick and funnel threats into our network.
“Deception, at its full potential”
From Breadcrumbs on your endpoints to a fully interactive network of honeypots, designed to deceive both humans and AI-driven threats.All on our side, with no way back to yours.
01 Lure
Breadcrumbs
Tripwires and baits planted on your endpoints. A tripwire fires the moment someone looks; a bait leads them to a decoy. No agent to install.
02 Trap
Fully interactive honeypots
Complete, real systems from a catalogue of ready templates, deployed in seconds and matched to what you are facing. They look local and run on our network.
03 Hold
A network of honeypots
Behind every decoy, more targets to work on, none of them yours. Every minute spent there is a minute away from your systems.
Our stance on AI
We don't embed a model, and we believe doing so is a mistake.
A model inside every tool only ever sees its own slice. Hoxey is built to be driven by your model over MCP, with the full context of your infrastructure and security stack, inside your compliance boundaries.
Our stance on access
We have no access to your network, under any circumstance.
This is enforced by code on your side, not by policy on ours. Read the security model
Don't trust us.Verify us.
Trust is what you give a vendor when you can't check. We would rather be checked: every claim below comes with the way to prove it.
We don't publish a customer list. In deception, secrecy is the product: a list of who runs Hoxey is intel for threats targeting them.
We have no access to your network, under any circumstance. The device only connects out, refuses every inbound connection, and holds no key of ours.
We build as if we will be breached. Multiple coherent controls, designed to prevent a breach and to minimise its blast radius. A custom-built runtime monitor flags any deviation from the baseline workload.
5-minute RPO, 4-hour RTO. Disaster recovery is tested every month, not written down once and hoped for.
Our ISMS runs today, built to ISO/IEC 27001:2022. 74 of the 93 Annex A controls are fully implemented. The certification audit is planned for 2027.
Join The Hive
Threat intel from our own decoys, first-hand. Not another newsletter.
- Intel from our network. What our decoys catch: the credentials threats try, the tools they bring, the techniques that are new. First-hand, not recycled.
- Alerts, when it matters. When something we see is worth acting on, you hear it from us, with what to do.
- Attack stories. The story behind the intel: a real attack, narrated step by step from the offensive side.
Low volume, high quality.