FortiDeceptor — Agentless Deception Platform to Detect and Stop In-Network Attacks
FortiDeceptor is a non-intrusive deception security platform that deploys fake assets across your network to lure, expose, and isolate attackers — delivering zero false-positive alerts with no network topology changes required.
Key Performance
- Zero false-positive alerts
- Eight built-in forensic intelligence engines
- Supports up to 20 Deception VMs
- Up to 128 network VLANs
- One-day deployment, no network changes required
Hardware Variants
- FortiDeceptor 1000G — 1RU rackmount appliance, 20 Deception VMs, 128 VLANs, redundant PSU
- FortiDeceptor 100G — Desktop appliance, local or DaaS managed, 128 VLANs
- FortiDeceptor Rugged 100G — Industrially hardened desktop, 8 Deception VMs, 48 VLANs, DC power, IP40 rated
- FortiDeceptor VM — Supports VMware, KVM, Hyper-V, AWS, Azure, GCP
- FortiDeceptor-as-a-Service (DaaS) — SaaS-hosted, cloud-managed deception with FortiDeceptor 100G Edge appliance
Deception Capabilities
- Decoys simulate IT, OT, IoT, ICS, medical, SCADA, POS, ATM, ERP, SAP, and more
- Breadcrumb tokens (fake credentials, files, network shares) placed on real endpoints
- Fake network traffic generation to appear in attacker reconnaissance scans
- Bring-your-own decoy (BYOD) golden image support
- Automatic asset discovery and optimised decoy placement recommendations
Security Features
- Instant detection of lateral movement, credential theft, ransomware, and MITM attacks
- Automatic endpoint isolation and quarantine on threat detection
- Zero-day protection via auto-deployed vulnerable decoys from FortiGuard Labs outbreak alerts
- On-demand decoy deployment triggered by SOAR playbooks for active threat hunting
- Integrates with SIEM, SOAR, and the Fortinet Security Fabric
Networking & Deployment
- Operates in online and air-gapped environments
- Agentless and non-intrusive — zero impact on production systems
- Decoys run on unused IP addresses with no impact on network availability
- Layer 2 tunnel with built-in authentication, encryption, and SSL/TLS for DaaS deployments
- Supports all levels of the Purdue Model for OT environments
Management
- Centralised FortiDeceptor console for full lifecycle management
- Automated deception deployment, evidence analytics, and attack quarantine
- FortiDeceptor Central Management license for multi-device oversight
- No highly skilled analysts required — low-friction automation throughout
view data sheet: FortiDeceptor Data Sheet
