01
Step 1 of 6
Deploy the trap
Decoy identities, credentials, documents and cloud keys are registered, approved by a second person and placed on real assets.
See how decoys are placed
Home TrapSignal
A 360CyberX product
Catch attackers the moment they touch a trap
TrapSignal places decoy identities, credentials, documents, cloud keys and canary tokens across your estate. When an intruder touches one, the signal is graded, correlated and in front of your SOC, with the investigation already under way.
6links in the chain, from a decoy to a verdict
11integrations that ship today
2people approve every decoy placement
4plans, priced by your estate, never by detections
Most detection asks
Is this activity unusual?
It needs a baseline to learn and thresholds to tune, and unusual is not always hostile.
TrapSignal asks
Did anyone touch this?
No baseline needed. Nobody has a reason to touch a decoy, so one touch is the signal.
Why deception
A decoy has no legitimate use, so every touch is worth a look
Attackers who are already inside go looking for credentials, file shares, cloud keys and documents worth taking. TrapSignal plants convincing ones that carry nothing real, so the first interaction becomes a high-confidence signal instead of one more alert in the queue.
Alerts you can trust
Real users have no reason to open a decoy, so a hit is rarely noise. Your team spends its time on intruders, not false alarms.
Decoys that stay alive
Every placement is approved by a second person, and scheduled checks confirm that placed decoys still work.
Your stack stays in place
Your SIEM and EDR keep doing their jobs. Detections flow to them, and their evidence flows back into the case.
How it works
Follow one decoy from placement to verdict
Six steps, one ingestion path, one permission model and one audit trail, so no tool or connector can skip a step. Each slide shows where the step happens in TrapSignal.
Screens show a demonstration investigation.
Use cases
Deception applied to the attacks you worry about
IdentityIdentity attacks and credential theftDecoy accounts and credentials tell you the moment someone tries stolen sign-in material.Read the use case 
RansomwareRansomware early warningDecoy file shares sit where ransomware operators look first, so the reconnaissance is caught before encryption starts.Read the use case 
Insider riskDocuments nobody should openGenuine Word, Excel and PDF decoys report when they are opened, with no click required.Read the use case 
CloudCloud credential leaksDecoy cloud keys look like the real ones and have no legitimate user, so any use of them is a finding.Read the use case 
Supply chainCode secretsDecoy API and SSH keys in repositories, configuration and pipelines catch anyone mining your code for secrets.Read the use case 
OperationsSOC efficiencyFewer, higher-fidelity alerts, with the investigation prepared before an analyst opens it.Read the use caseCapabilities
Everything between a decoy and a verdict
TrapSignal deploys the traps, captures the touch, grades and correlates the signal, alerts your SOC and opens the investigation. An Agentic SOC prepares the case, and a person decides it.
- DeceptionDecoy identities, credentials, documents, cloud and API keys, database records, file shares and canary tokens that report when they are touched.
- Detection and correlationOne pipeline for every source: deduplication, grading, rules, entity resolution and ATT&CK mapping, in an order nothing can skip.
- InvestigationsCases with a priority score, an attack story shown only where there is evidence for it, a graph and a merged timeline.
- Agentic SOCThe Agent opens and works the case and recommends a resolution. Every acting step waits for a person to approve it.
- CopilotAnswers computed from your own workspace, with their working shown. Proposals go to the approval queue, never straight into action.
- Automations and playbooksDeclarative automations that can never do more than the person who owns them is allowed to.
- IntegrationsMicrosoft Sentinel, Defender XDR and Entra ID, Splunk, CrowdStrike, Okta, ServiceNow, Jira and more, chosen by the job they do.
- GovernanceRole-based permissions, two-person approval for decoy placements and an append-only audit log of every change.
Integrations
Connect the tools you already run
Console sign-in uses Microsoft Entra ID. Connecting your other tools is optional, and everything they collect goes through the same pipeline as a canary hit. Integration credentials are kept in a managed secrets vault, never in the database.
- Microsoft Sentinel
- Microsoft Defender XDR
- Microsoft Entra ID
- Splunk
- CrowdStrike Falcon
- Okta
- ServiceNow
- Jira Service Management
- Microsoft Power BI
- Slack
- Webhook
These ship today. See what each one does on the TrapSignal platform page.
Plans
Priced by the estate you protect, never by detections
TrapSignal never charges by decoys, detections or investigations. Choose the plan that fits your estate, and the team prices it for you on request.
01
Essentials
For a single security team starting with deception: one production environment, a few hundred assets, and the core decoys, canary tokens and investigations.
02
Professional
For a SOC running deception across several environments, with the Agentic SOC, automation and every integration included.
03
Enterprise
For large or regulated estates: thousands of assets, many cloud accounts and premium support.
04
Custom
For very large or complex environments, with dedicated hosting available, custom retention, negotiated AI capacity, a premium SLA and a named technical account manager.
Want to try it first? Choose Start a trial on the pricing page and the TrapSignal team sets one up with you, with an agreed end date.
Questions
What security teams ask first
More detail is on the TrapSignal resources page, its security and trust page and its pricing questions.
Does TrapSignal replace our EDR or SIEM?
No. They stay in place. TrapSignal sends each detection to them and to your ticketing and chat tools, and brings their evidence back into the case.
What do we need to get started?
A Microsoft Entra ID tenant for console sign-in, and somewhere to place decoys, such as your directory, file shares, endpoints, repositories or cloud accounts. Connecting the tools you already run is optional.
Could a decoy ever be used against us?
Decoys carry nothing real. The platform refuses a decoy that contains a working secret, and decoy identities cannot sign in to anything.
Does the Agent take action on its own?
Only low-risk steps such as enriching an event run automatically, and they are audited. Any step that changes something stops at the approval gate until a person decides.
Who builds and supports TrapSignal?
360CyberX, the Dallas cybersecurity and IT firm behind this website. TrapSignal runs on its own platform at trapsignal.360cyberx.com, with its own sign in and security controls.
Get started
See the chain run on the parts of your estate that matter
A working session with the TrapSignal team: where decoys would sit in your environment, what fires, and how it reaches the tools your SOC already runs.
Demo requests, pricing and sign in continue on trapsignal.360cyberx.com, the TrapSignal site run by 360CyberX.