Deception technology: companies, startups and research

Palo Alto Networks, CloudFlare, CrowdStrike, IBM and Oracle are among the organizations with recent deception-related activity in the data. Their presence does not establish that each sells a dedicated deception product: the organization list includes news activity and some publication records. Attivo Networks and Allure Security Technology also appear, while the sources do not provide product-by-product comparisons.

University of Dschang, Guangzhou University and U.S. Army Research Laboratory are listed as active research contributors, with 10, 18 and 8 documents, respectively, in the 24-month window. Their work includes GAN-based honeypots, attack-graph analysis and adaptive deployment strategies. These figures describe recorded activity, not a quality ranking of research programs.

The recorded totals are $20,539,326 across 13 grants since 2020 and $21,421,537,466 across 14 rounds. These figures are broad aggregates associated with the topic data, not verified totals for deception-specific products or companies. Listed transactions include research and infrastructure funding, so they should be treated as an imperfect indicator of capital directed to this technology.

Dynatrace, Radware, Management Analytics, British Telecommunications and Markus Nissl Consulting GmbH each have 2 recorded patents. The listed patent holders also include NEC Corp, Oregon State University and Raytheon Co., with 1 each. The figures reflect the patent-holder records in the data and do not establish the commercial scope or status of each invention.

Patent activity declined 10.5% in the defined last-12-month comparison, while the 24-month window contains 36 patents. By contrast, publications grew 48.3% in the last-year comparison. This suggests research momentum is stronger than recent patent growth in the recorded data, though the measures capture different kinds of activity and should not be treated as direct proxies for adoption.

Recent work includes Hive-AI, a multi-service honeypot framework for generative AI APIs published in October 2026, and CASSANDRA, a deception-driven cloud and identity defense framework published that month. PHANTOM, published in September 2026, explores contextually tailored honeytokens. These projects point toward more adaptive lures and deception used as an active sensing mechanism.

The five listed approaches are honeypots and service emulation, honeytokens and identity lures, network infrastructure decoys, endpoint and data decoys, and adaptive deception orchestration. Honeypots simulate systems; tokens and files act as tripwires; network decoys expose movement; orchestration coordinates changing lures. Each approach trades detection value and realism against operational effort, integration needs and the risk of disrupting legitimate activity.

The United States leads the recorded country distribution with 5,459 documents, followed by the United Kingdom with 1,379, China with 1,340 and India with 979. The data also lists Germany, Japan and France among active countries. These counts describe documents attributed to countries, not a direct measure of market size, deployment or technical leadership.

The listed applications include critical infrastructure and OT with 337 documents, government and defense with 324, and financial services with 299. Other application areas include enterprise IT networks, cloud and hybrid environments, and healthcare. These figures represent recorded documents for each area, not confirmed deployment counts or evidence that deception is equally mature across all sectors.