AddDeceptionTechnology
toYourPortfolio.
Deploy realistic decoys across client networks to detect intruders, capture credentials, and map attacker behavior in real time. White-label ready for MSSPs and security vendors.
If someone touches a decoy, they are not a legitimate user. Zero false positives.
Try Mirage — Instant Access
Features
Not just honeypots. A complete deception platform.
Mirage combines Digital Twins, artificial intelligence, and threat intelligence to create an active defense layer that learns from attackers. Add it to your security stack and give clients visibility they never had.
Digital Twin Technology
14 pre-built device personas with pixel-perfect login pages: Windows File Server, Linux Web, NAS Synology, Printer, Domain Controller, ESXi, Proxmox.
AI-Powered SSH
Interactive SSH sessions powered by GPT-4o-mini that deceive attackers with realistic responses and log every command.
Real-Time Detection
Instant alerts when an attacker interacts with a decoy. Captures credentials, records sessions, tracks every move.
MITRE ATT&CK Mapping
Every event is automatically mapped to MITRE ATT&CK techniques, providing immediate tactical context on every attack.
Global Attack Map
Real-time Leaflet map showing the geographic origin of attackers with details on IP, ASN, and frequency.
Honeytokens & Canary Credentials
Fake credentials, API keys, and documents that trigger alerts when used. Canary credentials detect leaks on production servers.
Automated Monthly Reports
Auto-generated executive reports with recommendations, trends, statistics, and actionable insights for management.
Flexible Agent + Sensor
Lightweight Go single-binary agent for rapid coverage, or full-stack Docker sensor with AI for maximum fidelity. Deploy in minutes.
How it works
Three Steps to a Smart Trap.
Three steps to turn any network into an intelligent trap for attackers. Offer deception as a service to your clients in minutes.
Deploy Decoys
Distribute honeypots and sensors across the network in minutes. Go single-binary agent or full Docker stack.
Detect Intruders
Every interaction with a decoy generates instant alerts. Captures credentials, records sessions, maps ATT&CK techniques.
Respond & Learn
Analyze attacker behavior, generate reports, and continuously improve security posture.
Digital Twin
14 Digital Twins Ready to Deploy.
Every decoy faithfully replicates a real device: pixel-perfect login pages, authentic service banners, protocol-consistent responses.
An attacker scanning the network will see Windows servers, Synology NAS, and VMware hypervisors indistinguishable from the real ones. But every interaction is logged, analyzed, and mapped.
The more decoys you deploy, the more visibility you gain.
Windows File Server
SMB, RDP
Linux Web Server
SSH, HTTP, FTP
NAS Synology
DSM, SMB, FTP, SSH
Network Printer
HTTP, RAW, LPR
Domain Controller
SMB, LDAP, Kerberos, RDP
VMware ESXi
vSphere, SSH, HTTPS
Proxmox VE
Web UI, SSH, Spice, VNC
Database Server
MySQL, PostgreSQL, SSH
Mail Server
SMTP, IMAP, Webmail, SSH
VoIP PBX
SIP, Admin UI, SSH
Backup Server
Web UI, SSH, SMB
VPN Gateway
HTTPS, OpenVPN, SSH
Docker Registry
HTTPS, SSH
SCADA / HMI
Modbus, S7, HMI Web, SSH
Dashboard
The Dashboard in Action.
Every event, every attacker, every technique: all in one interface designed for operational clarity. Show your clients exactly what is happening inside their network.
Plans & Pricing
Plans & Pricing.
From experimentation to enterprise protection. Choose the plan that fits your reality. All plans are per-client for MSSP and vendor deployments.
Starter
One agent in your network to prove deception technology with real attack data.
Built for: SMBs who want to see deception in action, observe real attacks, and understand the value before scaling.
What's Included:
Not included:
Professional
Full deception with AI, honeytokens, attack map, and automated monthly reports.
Built for: SMBs that need active deception, early warning, and full visibility into attacker behavior.
What's Included:
Not included:
Enterprise
Enterprise deception with XDR integration, custom templates, REST API, and dedicated support.
Built for: Organizations with internal SOC, MSSPs, compliance requirements, and existing SIEM/XDR integration needs.
What's Included:
Comparison
Why choose Mirage?
Head-to-head comparison with the leading competitors on the market. See why vendors and MSSPs are adding Mirage to their portfolio.
| Feature | Securitix Mirage | Thinkst Canary | SecurityHive | T-Pot (OSS) |
|---|---|---|---|---|
| Annual price (entry) | €228/yr | $5,000/yr | €900/yr | Free |
| AI-Powered SSH | ✅ GPT-4o-mini | ❌ | ❌ | ❌ |
| Digital Twin templates | 14 + custom | ~15 | ~10 | 20+ (basic) |
| Realistic login pages | ✅ Pixel-perfect | ✅ | Partial | ❌ |
| MITRE ATT&CK mapping | ✅ Automatic | ❌ | ❌ | Partial |
| Live Attack Map | ✅ + Public | ❌ | ❌ | ✅ ELK |
| Monthly reports | ✅ Auto-generated | ❌ | ✅ | ❌ |
| XDR / SIEM | ✅ Wazuh native | Webhook/Syslog | In development | ELK built-in |
| Honeytokens | ✅ 4 types | ✅ 20+ types | Limited | ❌ |
| EU Data Residency | ✅ On-prem | ❌ AWS US | ✅ EU | ✅ Self-host |
| Self-serve demo | ✅ Instant | ❌ | 14 days | ❌ |
| Multi-tenant | ✅ | ❌ | ❌ | ❌ |
| SCADA/OT support | ✅ Modbus, S7 | ❌ | ❌ | Conpot |
| Setup time | 5 minutes | 5 minutes | 5 minutes | 1+ hours |
Data updated March 2026. Prices and features may vary. Thinkst Canary acquired by CrowdStrike (June 2025).
FAQ
Frequently Asked Questions.
Everything you need to know about deception technology and how Mirage protects your network.