01 / STRATEGY
Deception in your network
- Lures: where to place them in your network.
- Detection: intruder reconnaissance and lateral movement.
- Strategy: how deception complements existing defenses.
LURES / LATERAL MOVEMENT / DETECTION
Let the attacker
make the
first mistake.
Deception Technology and honeypots for SOC and IT teams.
I help detect intruders using decoy accounts, data and systems that draw them away from real assets.
Book a call with me ↗15 minutes · Google Meet
13 CVEIn security since 2015
Piotr MadejCEO TrapTech · Deception & Honeypot
TRAPTECH / DECEPTION MAPILLUSTRATIVE DIAGRAM
- 01Lure
A decoy account, password or document attracts an intruder’s attention.
- 02Honeypot
Clues lead to a decoy system instead of real data.
- 03Alert
An interaction with the trap reveals suspicious activity and signals the need to respond.
DETECTION THROUGH DECEPTION
Interaction with a trap → a signal to actIllustrative interaction with a decoy asset
DECEPTIONTRIGGERED
Offensive experience.
A defender’s perspective.
A defender’s perspective.
OSCEOSCPCISSPCISACISM
Since 2015 in IT security
From challenge to use case
What can we
talk about?
Your infrastructure, your challenges. Together, we’ll explore where deception can strengthen your detection capabilities.
02 / TECHNOLOGY
Honeypots in practice
- Decoy assets: applications, services and data.
- Honeypots: choosing traps for your environment.
- TrapTech: the platform’s practical capabilities.
HONEYPOT / DECOY / TRAPTECH
03 / FIRST STEP
Plan a pilot
- Use case: what you want to detect.
- Scope: which part of your environment to include.
- Evaluation: how to assess whether the pilot delivers value.
SCOPE / USE CASE / NEXT STEPS
Facing a similar challenge?
Book a 15-minute call ↗Let’s discuss it in a 15-minute Google Meet call.
See how it works
From a lure
to a security alert.
Lures on workstations and servers guide an intruder toward decoy assets. See how the TrapTech Cyber Minefield works.
What does the video show?
The video introduces the TrapTech Cyber Minefield: lures on workstations and servers guide an intruder toward decoy assets. Interaction with a trap generates a signal for the security team to investigate.
A lure points the way, while a honeypot is the decoy destination. This approach complements existing detection; it does not replace security controls or incident investigation.
Piotr Madej
Ethical hacker. Vulnerability researcher.
I know the attacker’s path.
I design their dead ends.
Connect with me on LinkedIn ↗I design their dead ends.
Certifications
- OSCPOffensive Security Certified Professional
- OSCEOffensive Security Certified Expert
- CISSPCertified Information Systems Security Professional
- CISACertified Information Systems Auditor
- CISMCertified Information Security Manager
Experience backed by evidence
My discoveries
make a difference.
My research and reports span 13 CVE.
- Vulnerability types: remote code execution (RCE), authentication bypass, memory corruption and SQL injection.
- Vendor products: Microsoft, VMware, Oracle, F5, Dell, HPE, Hitachi and ALPS ALPINE.
- Experience for your defense: at TrapTech, I turn offensive knowledge into convincing lures and decoy environments that reveal an intruder’s actions.
13CVE
Since 2015in IT security
Microsoft / Windows Print Spooler
CVE-2021-1675
Research into a remote code execution vulnerability in the Windows Print Spooler component.
Read the Microsoft advisory ↗My research: the full CVE list13 CVE
- MicrosoftInternet Explorer · Memory Corruption
- VMwarevRealize Log Insight · Authentication Bypass
- HitachiCommand Suite · Information Exposure
- HitachiCommand Suite · CSS Injection
- OracleWebLogic Server · Denial of Service
- Hewlett Packard EnterpriseOnboard Administrator · Cross-Site Scripting
- ALPS ALPINETouchpad driver · DLL Hijacking
- MicrosoftEdge · Memory Corruption
- F5BIG-IP AFM · SQL Injection
- DellEMC NetWorker · Improper Certificate Validation
- MicrosoftWindows Print Spooler · Remote Code Execution
You’ll talk to a practitioner who has found vulnerabilities in real products and uses that experience to make an attacker’s job harder.
Let’s get specific
Your next move?
A conversation.
In 15 minutes, we’ll discuss your challenge and decide whether to explore a detection use case, a demo or a pilot.
15 minutes · Google Meet
Choose a meeting time ↗TrapTech sp. z o.o. is the controller of the data provided when booking. The data is used to arrange and conduct the meeting. Booking takes place in Google Calendar. Privacy policy ↗
01
Pick a convenient time
Choose a time for a 15-minute call. You’ll receive a Google Meet link after booking.
02
Bring a question or a challenge
You don’t need a deployment specification to get started.
03
We agree on the next steps
A detection use case, a demo or the scope of a pilot.
Before we meet
Who is this conversation for?
For security leaders, SOC and IT teams, and partners exploring deception and honeypots. Bring a specific scenario or join to learn how this approach works.
Do I need to prepare anything?
A general overview of your environment and the problem you want to solve is enough. Details of your current detection capabilities and visibility gaps will help guide the discussion.
How does deception complement existing security?
It introduces decoy assets that legitimate users should not interact with. Contact with a lure can signal an intruder’s presence and provide a starting point for incident investigation. Learn more about the platform at traptech.pl ↗.
How does deception complement EDR and SIEM?
Deception adds signals from interactions with lures and decoy assets. EDR monitors endpoint activity, while SIEM helps collect and correlate events. How deception signals are used depends on the environment and the incident response process.
How can you evaluate a deception pilot?
Define the scenario and scope. Check whether the lure leads to a decoy asset, whether it produces a clear alert and whether the team knows how to respond. Report results together with the test conditions: one scenario does not demonstrate detection of every attack.
