Attackers have more than one trick up their sleeve.
Divert stops attacks before the breach
Attacks start with recon
All attackers need is your domain name (example.com)
time to detect
with Divert
is a real threat
to deployed
Recon used to be noise worth ignoring
Every attack opens with reconnaissance. For years there was little we could do with that signal, and little reason to act on it. So defenses were built one step later, after the foothold. That trade-off made sense once. Offensive AI broke it.
Too noisy to act on
Perimeter recon looked like background internet noise. With no way to separate the one real probe from millions of scans, there was nothing actionable to chase.
Nothing you could do
Even seeing the recon, you couldn't stop it. So defenses sensibly focused on the foothold and beyond, the moment you could finally take action.
Now the attack is won here
Offensive AI compresses recon-to-breach into minutes. The earliest phase is no longer something you can afford to ignore, it's where the outcome is decided.
The attack timeline has collapsed
For decades, sophisticated attacks required rare expertise. AI now weaponizes new vulnerabilities in minutes, for less than the cost of a coffee.
exploit, AI-assisted
within 24h of disclosure
2024 vulnerabilities
driver of cyber change
Your stack wakes up after the attacker is inside
Defenders must be perfect, always. Attackers need one mistake. Divert flips the odds: now they have to avoid every diversion, and you only need them to touch one.
OSINT
Org mapped from open sources. Passive and off your infrastructure, so no one can block it.
DNS Recon
Namespace enumerated. Subdomains and services cataloged. Divert engages here.
Active Recon
Exposed portals and endpoints probed for weakness, straight into the diversions.
Access
The attacker makes their move. On a diversion, it's caught and blocked before initial access. Traditional tools first engage here too.
Lateral
Where traditional EDR / XDR / SIEM finally wakes, once the attacker is already inside.
Impact
Data stolen or encrypted. The breach is now public.
Turn your edge into a minefield
Divert weaves interwoven decoy services and credentials into your DNS namespace, indistinguishable from the real thing. Attackers are drawn to them during recon. Every interaction is a confirmed, 100%-signal threat.
To succeed, they must avoid every diversion and execute perfectly. You only need them to make one mistake.
However they break in, they trip a diversion first
CVE Weaponized
A critical vuln drops. Within hours, mass scanning launches against every exposed instance.
Divert detectsScanner Hits a Decoy
Diversions look like real services. The scanner trips one, zero-noise, confirmed threat.
Detects & blocksAttribution Captured
Full attacker IP, tooling and behavior logged. You know who's scanning and what for.
Threat profiledReal Assets Untouched
Divert absorbs every attempt. Patch on your timeline, not the attacker's.
Never exposed100% signal. Zero noise.
Diversions live where no legitimate user has any reason to go. So interactions aren't routine traffic to sift through, they're a high-fidelity signal worth acting on. Less noise, less triage, far fewer false positives.
Protected in minutes, not months
Divert is cloud-native and stands up in minutes, no agents, no hardware, and no rip-and-replace.
Cloud-native, live in minutes
No agents to install, no hardware to rack, no VMs to manage. Divert is fully cloud-native and deploys in minutes, not months.
Complements your stack
Integrates with the SIEM, SOAR and tooling you already run via API, adding an earliest-phase layer without replacing anything you have.
Zero FTE to run
Once live, Divert runs autonomously and surfaces only confirmed threats, no tuning, no triage, no headcount to operate it.
Questions security teams ask
Is Divert a honeypot or a canary?
No. A honeypot is a sacrificial system to learn from. A canary is a tripwire. Both are dead ends that raise an alert, and both usually sit inside the network. A Divert diversion sits on the public edge, acts as a sensor, and leads to the next diversion in a maze. Divert then blocks the designated threat through the customer’s existing controls.
Does touching a diversion get a source blocked?
No. Divert does not block on first touch. Blocking follows activity-based designation: behavior such as reaching milestones in a maze or probing for a specific CVE. This is designed so business traffic is not broken.
What happens when an attacker rotates IP addresses?
Divert fingerprints adversaries across IP changes, so a designation follows the attacker and not only the address.
Does Divert replace EDR, SIEM, or XDR?
No. Those tools engage at or after initial access. Divert covers the recon phase before it and feeds blocks and threat intel into the existing stack.
What does deployment require?
Integration with the customer’s public DNS. No agents, no hardware, no internal seeding of traps. Typical time from sign-up to deployed is under 30 minutes.
Notes from the edge
Research, teardowns and field notes from operators who spent their careers breaking into the world's most targeted organizations.
Counter-Recon via Edge Deception
Divert's Counter-Recon scanned back at a threat that hit our decoys, exposing a vibe-coded secrets harvester, 180 valid secrets, and its Telegram operator.
Fourteen AI Models Against a Customer Edge. Divert Caught and Blocked Them First.
Recon Is No Longer Noise
Insider or Outsider, What's the Difference?
We Ignored the Edge for 20 Years. AI Just Made That Untenable.
The attacker's clock is already running.
Every day without Divert is a day attackers can enumerate your infrastructure undetected.