Decoys an attacker can’t tell from the real thing.
Klaxon plants sensors across the network that impersonate your real devices: login pages, services, credentials, right down to the wrong-password screen. They sit silent. The instant anyone touches one, the alert is real, because nothing legitimate ever has a reason to.
If it trips, it’s real.
Prevention hunts for known‑bad.
Klaxon waits for
anyone to touch what nothing legitimate should. Then it fails
loud, on purpose.
01How it works
Three moves to a trap that earns its keep the first time it fires.
Drop a sensor
A hardened node on each segment: a small board, VM or container. It reaches the console over an encrypted tunnel. Zero agents on your production hosts.
Wear a real disguise
Each sensor clones a live target over the wire: a firewall or NAS login, decoy services, planted credentials, AD honey-accounts. Port-faithful, TLS and all.
Read the footstep
A scan, a login, a reused secret: every contact becomes a precise, attributable alert. No tuning, no noise, no false positives to chase.
02The platform
Real hosts and silent decoys, on one fabric you control.
Sensors enroll over an encrypted tunnel from anywhere, including segments the console can never reach directly. They sit beside your real devices, indistinguishable on the wire, and stay quiet until contact. Detections leave even locked-down networks over a covert path, so a trap fires home where ordinary egress is blocked.
-
Hardened sensors over WireGuardLocked-down nodes, signed updates, a minimized surface. A trap an attacker cannot turn into a foothold.
-
One multi-tenant consoleRun your whole book from a single pane, every client isolated, with roles and audited support hand-off built for MSSPs.
-
Instant, attributable alertsThe first footstep reaches you over DNS, webhook, push or SIEM, wherever your team already watches.
The console the moment a decoy is touched: one verdict, no noise.
03Capabilities
Everything an attacker expects to find, and nothing they should ever touch.
Indistinguishable logins
Pixel-faithful clones of your firewalls, NAS, cameras and gateways: the real login page, and the real error on a wrong password.
Nothing to pivot through
Locked-down nodes over WireGuard, signed updates, a minimized attack surface: a trap an attacker can’t turn into a foothold.
The moment of contact
DNS, webhook, Pushover and SIEM. The first footstep reaches you wherever you already watch.
04Why Klaxon
An alert you can trust at 3 a.m.
A footstep, not a guess
A decoy has no legitimate reason to be touched. Every alert is a footstep, not a heuristic, a maybe, or a tuning exercise.
There is no tell
Cloned over the wire, port-for-port, down to WebSocket consoles and the genuine “wrong password” screen. An attacker cannot pick the trap.
Live before the coffee
Deploy a sensor, choose a disguise, done. The trap is live in minutes, then stays silent until the moment it matters.
05Editions
Start free. Scale to your whole book.
Community is the full detection engine, self-hosted and free for up to three sensors, with zero false positives by design. Enterprise adds the distributed fleet, multi-tenant operations and integrations a managed provider runs on.
One console, local sensors, real alerts. Everything you need to set the first trap.
- Up to 3 sensors, free. More on request.
- Clone any device’s login into a decoy
- Alerts via DNS, Pushover & webhooks
Full feature list
- One self-hosted console from a single signed installer
- Local Docker sensors
- Core decoy personas for firewalls, hypervisors, servers and IoT
- Decoy services: SSH, SMB, HTTP, databases & more
- Credential tripwires & planted breadcrumbs
- Mandatory 2FA with TOTP & passkeys
Everything that makes security a service you can sell: the fleet, the tenancy, the integrations.
- Everything in Community, plus…
- Distributed sensor nodes over WireGuard across every segment & site
- Multi-tenant console, every client isolated in one pane
- Active Directory honey-accounts
Full feature list
- SIEM forwarding with CEF syslog
- Email (SMTP) alerting
- Priority support from the team that builds it
Want a specific Enterprise feature for your homelab? Reach out with how you would use Klaxon in your homelab.
Get started
Set the trap.
See Klaxon run on your own network. Request access, or step straight into the console.