Divert attack simulator
An interactive 3D walkthrough of attacks on a company's internet-facing edge, from the first reconnaissance to the breach attempt. Each scenario plays twice: once with Divert's diversions in place, and once without them.
Single attacker
The standard walkthrough.
Single attacker, with Divert
Attacks start with recon
All attackers need is your domain name (example.com). Looking costs almost nothing and carries little risk, so attackers look at everyone.
Your attack surface is mapped
Public sources give attackers a map of your internet presence. Search engines, certificate logs and DNS history list your hostnames without a single packet reaching you.
Entrypoints are highly visible
Internet scan data already lists the services each host exposes. Attackers strategize their breach using the map they hold, still without touching you.
Entrypoints are visited
The attacker visits your entrypoints for the first time. Some of them are Divert's diversions, chained together to form mazes.
The attacker can’t tell them apart. Diversions are real infrastructure, built to blend in with their surroundings.
Divert: First contact with your edge. Divert is watching from here on.
A diversion is touched
The attacker touches a diversion, and we size them up. No legitimate user has a reason to be there, so every touch is recorded and their tools and skill are assessed.
Divert: First touch on a diversion. No block yet, but Divert starts recording everything this attacker does.
Divert: Every probe leaves artifacts. Divert collects them and sizes up what this attacker can do.
From attacker to threat
One wrong move inside a maze and the attacker becomes a threat. It is behavior no legitimate user would show.
Divert sends a block signal to your enforcement points, the security controls you already run.
Shields go up and your attack surface disappears, real assets and diversions alike.
Divert: Designated a threat. No legitimate user tries that login.
Divert: Block signal sent to the controls you already run.
Divert: Shield up. For this threat, your edge no longer exists.
Threat blocked, then studied
Divert studies the threat in return, turning the reconnaissance around.
Artifacts and markers are gathered for better detection, and passed to the tools you already use.
Retried attempts fail, even when they switch IPs, because their markers follow them.
Divert: Counter-reconnaissance. Divert now studies the threat in return.
Divert: Artifacts and markers go to your tools. Retries keep failing, even from a new IP address.
Single attacker, without Divert
Attacks start with recon
All attackers need is your domain name (example.com). Looking costs almost nothing and carries little risk, so attackers look at everyone.
Your attack surface is mapped
Public sources give attackers a map of your internet presence. Search engines, certificate logs and DNS history list your hostnames without a single packet reaching you.
Entrypoints are highly visible
Internet scan data already lists the services each host exposes. Attackers strategize their breach using the map they hold, still without touching you.
Entrypoints are visited
Now the attacker visits your entrypoints for the first time. Every one of them is real.
Nothing tells you who is looking. Their probes blend in with the noise of the internet.
Defender: Sees nothing unusual. Probes look like internet noise.
An entrypoint gives way
The attacker works on an unpatched VPN gateway. Every failed attempt is free.
One weakness is all it takes. The attacker has a foothold, and nothing has told you.
Defender: Foothold gained. Nothing has told the defender.
From attacker to intruder
From the foothold they move toward what matters, one system after another.
Most security tools first engage around here, after the attacker is already in. The industry’s mean time to identify a breach is 183 days (IBM, 2026).
Defender: Still unaware while the attacker spreads.
AI & Humans
More attackers working in parallel, at machine speed.
AI & Humans, with Divert
Attackers now come in swarms
AI agents now attack alongside human operators. Each works tirelessly against a target in parallel.
Recon takes seconds
What took a person days, an agent does in moments. Your whole edge is mapped before anyone could react.
Wider and deeper probes
Probes hit endpoints with precision and often go undetected as they blend in with real traffic and background noise.
Diversions cut through the noise
Diversion infrastructure blends in with the real stuff. The first agent to move into a maze is designated a threat and blocked in seconds.
The rest follow, one after another. Divert works at the same speed the attackers do.
Blocked at machine speed
Every attacker, human and AI, is shut out before reaching a real weakness. Speed is no longer their advantage.
AI & Humans, without Divert
Attackers now come in swarms
AI agents now attack alongside human operators. Each works tirelessly against a target in parallel.
Recon takes seconds
What took a person days, an agent does in moments. Your whole edge is mapped before anyone could react.
Wider and deeper probes
Probes hit endpoints with precision and often go undetected as they blend in with real traffic and background noise.
A weakness is found in minutes
One agent finds an unpatched VPN gateway and exploits it. From first look to foothold took minutes, not weeks.
Breached at machine speed
The others follow the first one in. By the time a person reads the first alert, the attackers are already moving inside.
Bots vs Threats
Telling harmless scanners apart from a real attacker.
Bots vs Threats, with Divert
Background scanning never stops
This makes honeypots ineffective. Crawlers, scanners, and bots touch public surfaces all day.
Bots are always on a mission
Automated scanners and tooling sweep your edge and brush diversions along the way. Divert watches them but is selective about threat designation.
Attackers might seem like bots
An attacker might behave like a bot at first, but soon enough, any real attacker will diverge in behavior.
Behavior gives them away
The attacker who comes back to a diversion and proves capability by supplying correct credentials, exploiting a vulnerability, or demonstrating skill is a dead giveaway.
Bots keep on while threats get blocked
Threats identified by their behavior lose access to your public surfaces while bots remain.
Bots vs Threats, without Divert
Background scanning never stops
This makes honeypots ineffective. Crawlers, scanners, and bots touch public surfaces all day.
Bots are always on a mission
Automated scanners and tooling sweep your edge, one touch per door. Your logs fill up with it.
Attackers might seem like bots
An attacker might behave like a bot at first. In the logs, their probes are a few lines among thousands.
Lost in the noise
The attacker keeps working on one gateway while the scanners keep everyone busy. Nothing separates the two.
The one that mattered got in
The attacker has a foothold. It looked like a bot right up until it was too late.
Critical Vulnerabilities (CVEs)
A new flaw gets exploited before you can patch it.
Critical Vulnerabilities (CVEs), with Divert
A critical flaw goes public
A new vulnerability is announced in a product you run. One of your gateways or servers is affected and not patched. Maybe it’s unpatchable?
The exploit arrives before the patch
Working exploits now appear within hours of disclosure. Attackers start hunting for anything that answers.
They probe for that one flaw
Attackers check assets on your edge for it. Regardless of the diversion, each doubles as a sensor detecting the latest flaws.
The probe itself is the tell
A real exploit probe on a diversion is not background noise. Divert designates a threat on the ones that matter.
The block signal goes out to your enforcement points.
Blocked before the exploit
The shield stands in the way of the attacker as they continue searching for unpatched services.
Time to patch
Divert gives back the time the shrinking attack timeline took away. You patch the real flaw on your own schedule.
Critical Vulnerabilities (CVEs), without Divert
A critical flaw goes public
A new vulnerability is announced in a product you run. One of your gateways or servers is affected and not patched. Maybe it’s unpatchable?
The exploit arrives before the patch
Working exploits now appear within hours of disclosure. Attackers start hunting for anything that answers.
They probe for that one flaw
Attackers check assets on your edge for it. One of them is yours, and it is still unpatched.
The exploit lands
It works on the first real attempt. The attacker is inside before your patch window has even opened.
Patched too late
The fix goes onto a system the attacker already controls. Meanwhile, they're always well into your network with multiple footholds.