Ecosystem map

15 September 2026

This map uses categories and relationships. Its counts come from published catalog records and represent editorial coverage, not worldwide market share.

The current selection contains 132 records: 13 products, 11 services, 38 papers, 49 open projects, 9 field stories, 8 datasets, 2 frameworks and 2 community resources. Coverage remains open: a record describes its reviewed source and does not itself establish performance, regional availability or global adoption.

Institutions and frameworks

MITRE Engage organizes deception, denial and adversary engagement. MITRE D3FEND provides a knowledge base of defensive techniques. The UK NCSC investigates operational effectiveness through trials with organizations and suppliers. These actors contribute vocabulary, classification and evaluation in different ways.

Open software

Some tools focus on a protocol, such as Cowrie. Others are multi-protocol, like OpenCanary, or combine deployment and analysis, like T-Pot. Language-model honeypots are an emerging line represented by Galah. The catalog records licenses and maintenance signals when sources support them.

Providers and services

Products such as ShadowPlex, The Platform and Zscaler Deception describe commercial capabilities across different surfaces. A product-provider link does not establish managed-service availability in every region. Service offerings are added with their own sources.

The second review adds deception features within InsightIDR and Defender for Identity, plus Proofpoint Shadow and managed offerings such as ECCA. Guardicore is classified as a segmentation product with a related capability; its primary purpose is distinct from a dedicated deception platform.

Research and experience

Surveys classify techniques; experiments study deployment and measurement; field stories highlight adoption. The Riot Games/Tracebit story is vendor-published. The NCSC trials offer an institutional perspective. The interface links cases to tools and identifies who published results.

Adversary observations in simulated environments published by Proofpoint and IBM X-Force help study behavior; vendor-published customer stories remain labelled accordingly. Open records such as CTU-HONEY-LLM-2 and DICOMHawk support reproducibility, with data limitations noted at the source.