Detect attackers
before they succeed
Claymore Decoys look like the weaknesses attackers hunt for in Active Directory. The moment one is touched, you get an alert, and the attacker's access is cut off.
13
Attack paths covered
Seconds
To alert
Zero
Tuning required
Why It Works
Detection without the tuning
Conventional tools try to tell attacks apart from normal activity, so they need constant tuning. A decoy has no normal activity. Anyone who touches one has already given themselves away.
Modeled on real attacks
Every Claymore Decoy imitates something attackers actually hunt for, tailored to your environment. To anyone scanning your directory, the harmless decoys are indistinguishable from real vulnerabilities.
Placed where attackers look first
Attackers follow predictable routes to domain admin. Claymore puts its decoys directly on those routes.
Contained in seconds
Certificate requests are denied, tampered decoys repair themselves, and optional containment disables the account responsible before anyone reads the alert.
Products
Built for Active Directory
Deceive
Claymore Deception Platform
Claymore Decoys in Active Directory and certificate services that turn an intrusion into one clear alert.
- 13 attack paths across Active Directory and certificate services
- Optional automated containment
- One lightweight agent, live in an afternoon
Assess
Claymore Exposure Assessment
Automated, continuous pentesting of Active Directory that finds the real weaknesses and shows you how to close them.
- Finds the real misconfigurations attackers exploit
- A ready-to-run fix for every finding
- Read-only, scheduled or on demand
- Credential theft in Active Directory
- Kerberoasting, AS-REP Roasting, DCSync, Shadow Credentials, RBCD, and legacy computer accounts.
- Certificate services abuse
- 7 certificate template escalation paths. The request is denied as you are alerted.
- Near-zero false positives
- Nothing legitimate touches a decoy, so there is nothing to tune.
- Alerts where you work
- Slack, email, Splunk, Microsoft Sentinel, your PSA, or any webhook.
How It Works
Running in an afternoon
- 01Install the agent
- 02Place your Claymore Decoys
- 03Get alerted
Partners
Delivered by the providers you trust
Claymore is available exclusively through managed service and security providers. Partners get a multi-tenant console, per-client alerting, and PSA integration built in.
Stop tuning. Start catching.
Claymore is delivered through managed service and security partners. Bring it to your clients, or let us connect you with a partner who already runs it.