A decoy system with no production purpose, so that almost any interaction with it is a high-confidence indicator of an attacker.

Collects logs from firewalls, servers and endpoints and correlates them so that one attack spanning several systems produces a single prioritised alert.

Inspects HTTP requests for SQL injection and cross-site scripting, and can shield a known flaw until the developers release a fix.

Uses 802.1X to authenticate a device and checks its patch level and antivirus status before it is allowed onto the network, quarantining it if it fails.