Preemptive Cyber Defense

Time is yourgreatest enemy.

Attacks start with recon, not the breach. Divert turns your perimeter into a field of diversions that surface attackers at that first step, before they gain a foothold.

See how it works

Days, industry avg.
time to detect

Negative

Mean time to detect,
with Divert

Signal, every alert
is a real threat

<0m

From sign-up
to deployed

01 The Blind Spot

Recon used to be noise worth ignoring

Every attack opens with reconnaissance. For years there was little we could do with that signal, and little reason to act on it. So defenses were built one step later, after the foothold. That trade-off made sense once. Offensive AI broke it.

Was fine

Too noisy to act on

Perimeter recon looked like background internet noise. With no way to separate the one real probe from millions of scans, there was nothing actionable to chase.

Was fine

Nothing you could do

Even seeing the recon, you couldn't stop it. So defenses sensibly focused on the foothold and beyond, the moment you could finally take action.

Changed

Now the attack is won here

Offensive AI compresses recon-to-breach into minutes. The earliest phase is no longer something you can afford to ignore, it's where the outcome is decided.

02 Offensive AI

The attack timeline has collapsed

For decades, sophisticated attacks required rare expertise. AI now weaponizes new vulnerabilities in minutes, for less than the cost of a coffee.

<15m

To generate a working
exploit, AI-assisted

Anthropic research, 2025

~0%

Of exploits launched
within 24h of disclosure

DeepStrike, 2025

−1days

Median time-to-exploit,
2024 vulnerabilities

Mandiant M-Trends, 2025

Of leaders say AI is the top
driver of cyber change

WEF Outlook, 2026

Recon-to-exploit: the defender's head start has gone negative

ThenWeeks of lead time

Patched before exploitation

Now−1 day

Exploited before the patch exists

Disclosure / patch available

03 The Kill Chain

Your stack wakes up after the attacker is inside

Defenders must be perfect, always. Attackers need one mistake. Divert flips the odds, now they have to avoid every diversion, and you only need them to touch one.

Phase 01

OSINT

Org mapped from open sources. Passive and off your infrastructure, so no one can block it.

Phase 02

DNS Recon

Namespace enumerated. Subdomains and services cataloged. Divert engages here.

Phase 03

Active Recon

Exposed portals and endpoints probed for weakness, straight into the diversions.

Phase 04

Access

The attacker makes their move. On a diversion, it's caught and blocked before initial access. Traditional tools first engage here too.

Phase 05

Lateral

Where traditional EDR / XDR / SIEM finally wakes, once the attacker is already inside.

Phase 06

Impact

Data stolen or encrypted. The breach is now public.

◂ Divert blocks here, DNS recon through accessTraditional EDR / SIEM / XDR only wakes here ▸

04 The Solution

Turn your edge into a living minefield

Real asset Diversion Tripped, confirmed threat

Divert weaves interwoven decoy services and credentials into your DNS namespace, indistinguishable from the real thing. Attackers are drawn to them during recon. Every interaction is a confirmed, 100%-signal threat.

To succeed, they must avoid every diversion and execute perfectly. You only need them to make one mistake.

05 Scenarios

However they break in, they trip a diversion first

An external threat needs days of reconnaissance before it ever gets a foothold

Stage 1

Recon & Mapping

The attacker maps your external surface, DNS records, exposed services, employees, credentials, tech stack.

Divert detects

Stage 2

Weak Point Found

They probe for the softest way in: an exposed portal, a reused credential, an unpatched edge service.

Detects & blocks

Stage 3

Initial Access

The exploit fires or the stolen credential is used. The attacker establishes a quiet foothold on your edge.

No alerts fire

Stage 4

Foothold & Pivot

They move laterally toward real targets. Your EDR finally reacts, but the intruder is already inside.

EDR wakes up, too late

Divert's counter-recon diversions are woven across your external surface. The moment an attacker starts mapping it, they trip a decoy, you stop them in Stage 1, before any real foothold exists.

06 Signal vs. Noise

100% signal. Zero noise.

Diversions live where no legitimate user has any reason to go. So interactions aren't routine traffic to sift through, they're a high-fidelity signal worth acting on. Less noise, less triage, far fewer false positives.

The internetEdgeAssets

0 confirmed threats blocked0 false positives

Attacker, blocked at the edgeLegit traffic, passes throughDiversion, a decoy on your edgeReal asset, never touched

100%

Of alerts are confirmed, active threats

False positives to tune or triage

Auto

Blocked at the edge, in real time

07 Deployment

Protected in minutes, not months

Divert is cloud-native and stands up in minutes, no agents, no hardware, and no rip-and-replace.

Cloud-native, live in minutes

No agents to install, no hardware to rack, no VMs to manage. Divert is fully cloud-native and deploys in minutes, not months.

Complements your stack

Integrates with the SIEM, SOAR and tooling you already run via API, adding an earliest-phase layer without replacing anything you have.

Zero FTE to run

Once live, Divert runs autonomously and surfaces only confirmed threats, no tuning, no triage, no headcount to operate it.

08 Field Notes

Notes from the edge

Research, teardowns and field notes from operators who spent their careers breaking into the world's most targeted organizations.

Perspective · Assume Breach

Insider or Outsider, What's the Difference?

Assume breach treats insider and outsider as the same problem. But 80% of breaches start externally, and catching attackers during recon changes the math.

Gene Abramov·6 min read·Jun 2026

Read article →

Perspective · The Edge

The attacker's clock is already running.

Every day without Divert is a day attackers can enumerate your infrastructure undetected.