https://deceptiq.com/blog Insights on deception technology, threat detection, and cybersecurity strategy from the DeceptIQ team. en-us Mon, 27 Apr 2026 11:41:44 GMT https://deceptiq.com/blog/whats-in-a-good-honeytoken https://deceptiq.com/blog/whats-in-a-good-honeytoken Tue, 06 Jan 2026 00:00:00 GMT A good honeytoken gets used. Learn the principles that make adversaries validate credentials rather than skip past them. rad@deceptiq.com (Rad Kawar) strategy https://deceptiq.com/blog/pre-emptive-detection-without-prediction https://deceptiq.com/blog/pre-emptive-detection-without-prediction Tue, 30 Dec 2025 00:00:00 GMT Via negativa detection defines what should never happen rather than predicting attacks. When it fires, you've caught an attack you didn't predict. rad@deceptiq.com (Rad Kawar) strategy https://deceptiq.com/blog/getting-started-early-warning-honey-tokens https://deceptiq.com/blog/getting-started-early-warning-honey-tokens Sun, 28 Dec 2025 00:00:00 GMT A practical guide to deploying early warning honey tokens effectively. Learn the lifecycle, placement strategy, and best practices that make deception work. rad@deceptiq.com (Rad Kawar) best-practices https://deceptiq.com/blog/ntuser-man-registry-persistence https://deceptiq.com/blog/ntuser-man-registry-persistence Sat, 27 Dec 2025 00:00:00 GMT Explore NTUSER.MAN, an overlooked Windows profile mechanism that allows registry persistence without triggering CmRegisterCallback EDR monitoring. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/the-reflexive-game-deception https://deceptiq.com/blog/the-reflexive-game-deception Wed, 24 Dec 2025 00:00:00 GMT Deception operates on thinking adversaries who adapt to your moves. Understanding this reflexive dynamic between defender and attacker changes everything. rad@deceptiq.com (Rad Kawar) strategy https://deceptiq.com/blog/post-compromise-gap https://deceptiq.com/blog/post-compromise-gap Wed, 17 Dec 2025 00:00:00 GMT An insider's perspective on why current security products fail to stop modern red teams and sophisticated attackers, and what security teams need to know. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/deception-taxonomy https://deceptiq.com/blog/deception-taxonomy Tue, 16 Dec 2025 00:00:00 GMT A common language for deception operations. The vocabulary needed to discuss honey tokens, tripwires, and alert lifecycles with precision. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/detecting-unauth-aws-osint https://deceptiq.com/blog/detecting-unauth-aws-osint Sun, 14 Dec 2025 00:00:00 GMT Detect unauthenticated S3 bucket enumeration before attackers get inside. Tools like cloud_enum run freely without alerts - until now. rad@deceptiq.com (Rad Kawar) product-insights https://deceptiq.com/blog/macos-stealers-technical-analysis https://deceptiq.com/blog/macos-stealers-technical-analysis Tue, 02 Dec 2025 00:00:00 GMT Technical analysis of macOS information stealers using Banshee as a case study. How they phish passwords, decrypt Keychains, and exfiltrate browser data. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/windows-stealers-technical-analysis https://deceptiq.com/blog/windows-stealers-technical-analysis Tue, 02 Dec 2025 00:00:00 GMT Technical analysis of Windows infostealers using Sryxen as a case study. How they decrypt browser data via DPAPI and exfiltrate credentials. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/field-notes-on-malware https://deceptiq.com/blog/field-notes-on-malware Wed, 26 Nov 2025 00:00:00 GMT Modern C2 evasion techniques from BOFs to RISC-V emulation. Why malware developers haven't adopted certain capabilities and what defenders need to know. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/processing-cloudtrail-logs-s3 https://deceptiq.com/blog/processing-cloudtrail-logs-s3 Mon, 24 Nov 2025 00:00:00 GMT Process CloudTrail logs efficiently using S3's hierarchical structure. Learn discovery patterns and resumption strategies for organization trails. rad@deceptiq.com (Rad Kawar) engineering https://deceptiq.com/blog/psychology-effective-honey-tokens https://deceptiq.com/blog/psychology-effective-honey-tokens Wed, 19 Nov 2025 00:00:00 GMT Attackers validate credentials when type and context match their targeting. Understanding cognitive shortcuts determines honey token detection success. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/early-warning-detection-credential-theft https://deceptiq.com/blog/early-warning-detection-credential-theft Tue, 18 Nov 2025 00:00:00 GMT 57% of breaches discovered externally. Infostealer credentials evade EDR for years. Early warning honey tokens detect validation before lateral movement. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/eventbridge-pattern-matching-guide https://deceptiq.com/blog/eventbridge-pattern-matching-guide Mon, 17 Nov 2025 00:00:00 GMT Master AWS EventBridge pattern construction for security detection. Learn pattern expansion, nested logic, and common pitfalls with practical examples. rad@deceptiq.com (Rad Kawar) engineering https://deceptiq.com/blog/ai-orchestrated-attacks-honey-tokens https://deceptiq.com/blog/ai-orchestrated-attacks-honey-tokens Sun, 16 Nov 2025 00:00:00 GMT AI-orchestrated attacks automate 80-90% of tactical operations at machine speed. Early warning detection becomes critical when attacks move in milliseconds. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/early-warning-honey-tokens https://deceptiq.com/blog/early-warning-honey-tokens Tue, 11 Nov 2025 00:00:00 GMT Early warning honey tokens break the attacker's risk calculus. Learn how planting monitored credentials creates detection opportunities at validation time. rad@deceptiq.com (Rad Kawar) product-insights https://deceptiq.com/blog/launch https://deceptiq.com/blog/launch Mon, 10 Nov 2025 00:00:00 GMT Built by red teamers to catch adversaries. The deception technology platform we wish every organization we compromised had in place. rad@deceptiq.com (Rad Kawar) product-insights https://deceptiq.com/blog/from-phish-to-package-npm-supply-chain-attacks https://deceptiq.com/blog/from-phish-to-package-npm-supply-chain-attacks Sun, 20 Jul 2025 00:00:00 GMT Analysis of a recent NPM supply chain attack that deployed Scavenger malware through compromised packages, including a new overlooked phishing technique. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/understanding-your-adversary-cyber-deception https://deceptiq.com/blog/understanding-your-adversary-cyber-deception Sat, 05 Jul 2025 00:00:00 GMT Recognize attackers as goal-driven individuals to transform your defensive strategy. Simple, psychologically-grounded deceptions outperform complexity. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/threat-intelligence-cyber-deception-guide https://deceptiq.com/blog/threat-intelligence-cyber-deception-guide Fri, 04 Jul 2025 00:00:00 GMT How threat intelligence transforms cyber deception from guesswork into strategic planning - understanding what attackers actually do and why it matters. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/cyber-deception-maturity-model https://deceptiq.com/blog/cyber-deception-maturity-model Mon, 23 Jun 2025 00:00:00 GMT Assess your deception maturity with this framework. Includes KPIs, metrics, implementation guidance, and a self-assessment quiz for your organization. rad@deceptiq.com (Rad Kawar) industry-analysis https://deceptiq.com/blog/deception-fundamentals https://deceptiq.com/blog/deception-fundamentals Sun, 15 Jun 2025 00:00:00 GMT A deep dive into deception fundamentals, from military doctrine to cybersecurity. Learn why attackers avoid most honey tokens and how to build effective ones. rad@deceptiq.com (Rad Kawar) industry-analysis https://deceptiq.com/blog/rise-of-read-teaming https://deceptiq.com/blog/rise-of-read-teaming Sat, 07 Jun 2025 00:00:00 GMT An insider's perspective on why current security products fail to stop modern red teams and sophisticated attackers, and what security teams need to know. rad@deceptiq.com (Rad Kawar) threat-research https://deceptiq.com/blog/aws-honey-tokens-good-bad-ugly https://deceptiq.com/blog/aws-honey-tokens-good-bad-ugly Mon, 28 Apr 2025 00:00:00 GMT AWS honey tokens are powerful detection tools with hidden risks. Learn their benefits, technical flaws, fingerprinting vulnerabilities, and real-world implications. rad@deceptiq.com (Rad Kawar) industry-analysis