Self-hosted decoy infrastructure

Pretend
services.
Real clues.

Change what they encounter.
Understand what they leave behind.

Polymorph creates varied SSH and HTTP decoys on infrastructure you own, then connects their encounters to evidence you can investigate.

Engineering previewBy Valaris Studio
Unpack the idea

01 / A persona, not just a banner

Same purpose.
Different character.

One identical decoy is a pattern. A family of carefully varied personas gives you more ways to observe an encounter.

IdentityHostnames, versions and service banners
ContentCoherent fake files, users and pages
BehaviourTiming, responses and error dialects
BreadcrumbsMinted fake material with a recorded origin

02 / From contact to context

Make it.
Let it answer.
Keep the record.

  1. 01

    Generate & review

    Choose a seed and template. Inspect a versioned persona before you select it.

  2. 02

    Serve the decoy

    SSH and HTTP listeners answer with emulated responses. No real shell. No model in the live path.

  3. 03

    Capture & investigate

    Connect events to their source, session, persona version and serving build. Investigate in a browser or terminal.

Captured events are written to SQLite. Admission to the memory queue is not a durable write; capture health exposes that distinction.

03 / Reviewed rotation

Change the act.
Keep the conversation.

Prepare a new persona. Review it. Apply it when you’re ready. New sessions meet the new selection. Already-open sessions keep the persona they started with.

Already-open sessionVersion AStays with A
Next new sessionVersion BAfter reviewed apply
Try a reviewed change

05 / The operator stays in control

A new version.
On your terms.

There’s a deliberate pause between a candidate and a live selection. Try the sequence and watch which session changes.

Try the idea · illustrative fixture

Change the room. Keep the conversation.

Prepare a candidate, review its details, then apply it. Watch which session changes.

Candidate BNot prepared

The little room is waiting on the workbench.

Already-open sessionPinned for its lifetime
Version A
Next new sessionUses the current selection
Version A

Version A is selected. Prepare a candidate to begin.

This is a conceptual demo. In Polymorph, apply checks the selection revision; a stale revision returns a conflict.

06 / INVESTIGATE & EXPORTTHE EVIDENCE GOES WITH YOU

We bring the record.
You make the call.

Follow an encounter in the web console or terminal. Export indicators with evidence, confidence and expiry into the tools you already use.

JSONIP / CIDRWebhook

Polymorph supplies recommendations. Your downstream systems decide enforcement. Confidence is a score, not a probability of human malice.

ENCOUNTER RECORDIllustrative fixture
Session
demo-A
Persona
version-A
Disclosure
crumb-demo-7
Serving build
demo-build
CONTEXT THAT TRAVELS WITH THE CLUE

An honest engineering preview

Know what
you’re inviting in.

Built for hands-on security engineers and infrastructure owners. Start with a private local evaluation, then decide what fits your environment.

Your infrastructure. A new perspective.

Let’s make
something pretend.

Bring a project. Bring a question.
We’ll start with a conversation.