CounterCraft's fake networks waste hackers' time and hand defenders their playbook

Honeypots — decoy systems set up to detect and study intruders — have existed in cybersecurity for decades, but building and maintaining a convincing web of them was specialist work most organizations never attempted. CounterCraft, a Spanish startup, productized the idea: its platform automates the layout of breadcrumbs, honeynets and decoys designed to draw attackers into convincing facsimiles of a client's critical networks.

The payoff showed weeks before Russia invaded Ukraine, when hackers accessed a financial institution's computers and set them up to launch a cyberattack on Ukrainian government websites. Every step happened inside a fake network CounterCraft had built as a detection environment: the client's real computers stayed untouched, and the startup shared what it learned with US authorities. 'Being weeks ahead of the actual window of attack was a very useful place to be,' said cofounder and chief strategy officer Dan Brett.

Inside the labyrinth, defenders can analyze intruders' behavior, engage with them to extract more information, and map out potential future targets in real time — turning an intrusion from a crisis into an intelligence operation. Fast Company ranked CounterCraft No. 35 on its 2023 list of the World's 50 Most Innovative Companies.

Detection beats prevention when an attacker only needs to be right once.

Manual honeypots were too labor-intensive for most teams; automation made deception deployable.

A convincing facsimile keeps intruders engaged long enough to reveal their techniques.

Real-time engagement converts a defense scenario into intelligence collection.

Deception beats blocking when observation is the goal: let attackers succeed somewhere that isn't real, and they'll teach you their next move.

Fast Company placed CounterCraft at No. 35 on its 2023 World's 50 Most Innovative Companies list. The source does not record later client outcomes.