Skip to content Skip to navigation Skip to footer


FortiDeceptor, part of Fortinet SecOps Platform, detects and responds to in-network attacks such as stolen credential usage, lateral movement, man-in-the-middle, and ransomware. Adding FortiDeceptor as part of your cybersecurity strategy helps shift your defenses from reactive to proactive with intrusion-based detection layered with contextual intelligence.

Early, accurate attack detection (no false positives) reduces attacker’s dwell time

FortiDeceptor lures attackers into revealing themselves early at the reconnaissance stage by engaging with a wide range of deception assets distributed throughout your environment. The platform generates high-fidelity alerts based on real-time engagement with attackers and malware, providing attack activity analysis and attack isolation. This helps alleviate the burden on SOC teams inundated with false-positive alerts. FortiDeceptor also correlates incident and campaign activities and collects IOCs and TTPs, allowing SOC teams to make smarter, faster decisions.

Watch Now
fortideceptor ui

Automatically contains in-network attacks before they spread

When an attacker engages with deception assets, for example, fake files on an endpoint, or if malware tries to encrypt fake file, FortiDeceptor can neutralize the attack by automatically isolating any compromised endpoint. This prevents the attack from spreading and stops communication with a C&C server. This can be done using FortiDeceptor’s built-in, automated attack quarantine capabilities or by sending an alert to SIEM/SOAR for an orchestrated response.

Dynamic protection scales up as the threat level increases

To combat emerging threats and vulnerabilities, FortiDeceptor enables on-demand creation of deception decoys based on newly discovered vulnerabilities, or suspicious activity, providing automated, dynamic protection across OT/IoT/IT environments. Further, FortiDeceptor response capabilities go beyond SOAR evidence enrichment and automated host quarantine playbooks, by providing a SOAR playbook for on-demand deployment of deception assets in response to suspicious activity in your network.

Features and Benefits

Dynamic deception platform, with extensive support for IT/OT/IoT environments, diverts attackers from sensitive assets to shift the balance to the defender’s advantage.


Integrates with Fortinet Security Fabric and third-party security controls (SIEM, SOAR, EDR, sandbox)


Reduces dwell time and false positives, detects early recon & lateral movement to misdirect attacks


Captures and analyzes attack activities in real time, provides detailed forensics, collects IOCs & TTPs


Infected endpoints can be quarantined away from the production network


Operates in online/air-gapped (offline) modes and a ruggedized version is available


Asset-match decoys are automatically deployed with no impact on stability and performance

FortiDeceptor Use Cases

Network visibility and breach detection via passive footprint. Detects threats to assets that cannot provide their own telemetry.
Malware Protection
Early detection and response to ransomware attacks. Misleads malware to encrypt fake files, triggering automatic blocking of the infected endpoint.
Hybrid Workforce
Detects attackers early in the discovery phase and misdirects lateral activities to the decoy and away from real assets.
icon threat hunting
Enables in-network threat detection, tracks attack origin, gathers TTPs by observing attackers, provides intelligence for rapid response.
Secure Worker
Extensive decoys including SCADA systems, IoT sensors are available, plus the ability to upload your own decoys.

Enterprise Analyst Validation

ESG FortiDeceptor Showcase Report
ESG Economic Validation on Fortinet SecOps Fabric
Cover of ESG report titled Active Defense and Deception Technology: The Time is Now! Written by John Olsik, distinguished analyst and fellow, and published June 2023
Active Defense and Deception Technology: The Time is Now!
Security operations requirements, like threat detection and response, continue to grow more challenging each year. According to an Economic Validation report from TechTarget’s Enterprise Strategy Group, it can take 168 hours or more, on average, to identify threats, while many threats are never detected. Therefore, CISOs should consider deception technology for improving threat detection and response. Modern deception technology like FortiDeceptor combines the historical value of deception technology with ease of use, automation, and actionable intelligence—creating an active defense. These benefits are especially important for organizations with limited security staff and skills and those merging IT and OT.
View Report »
ESG Economic Validation: The Quantified Benefits of Fortinet Security Operations Solutions. Improved security team operational efficiency and reduced risk to the organization, each by up to 99%. Written by Aviv Kaufmann, Practice Director and Principal Economic Validation Analyst at Enterprise Strategy Group. July 2023
The Quantified Benefits of Fortinet Security Operations Solutions
As enterprises evolve, new technologies emerge, and cybercriminals introduce more sophisticated attacks, security leaders and their teams face a variety of challenges in securing the organization’s networks. This new report published by Enterprise Strategy Group details the benefits of using Fortinet Security Operations solutions, including improved operational efficiency and more effective risk management.
Download Report »

Case Studies

Chandler Unified School District
Chandler Unified School District
Proactively Protecting a Large School District and Its Ever-Growing Attack Surface
IT Solutions Partner
IT Solutions Partner
IT Solutions Provider Chooses FortiDeceptor to Detect and Block In-Network Attacks
Regional Hospital System
Regional Hospital System
FortiDeceptor Delivers Breach Protection for Critical Healthcare Services
Chicago-based MSSP Powers Diverse Security Use Cases With the Fortinet Security Fabric

Models and Specifications

FortiDeceptor is designed to deceive, expose, and eliminate external and internal threats early in the attack kill chain, and proactively block these threats before any significant damage occurs. It’s available as a hardware and virtual appliance and in a ruggedized version ideal for harsh environments.

View by:

Hardware Appliances

Form Factor
Desktop - fanless
Total Interfaces
6x 1GbE RJ-45 ports
Default RAID level
Power Supply Unit
24Vdc - 48Vdc input
Form Factor
1 RU Rackmount
Total Interfaces
4 x GE (RJ45), 4 x GE (SFP)
Default RAID level
Power Supply Unit
Dual PSU optional

Virtual Machines

The virtual appliance of FortiDeceptor can be deployed on VMware and KVM platforms.

6 virtual network interfaces


Analyst Reports
Data Sheets
Solution Briefs
White Papers
Deceive By Design: How To Protect Critical Infrastructure With Deception Technology
Deceive By Design: How To Protect Critical Infrastructure With Deception Technology »

Moshe Ben Simon makes the case and provides examples of how deception technologies can be used in OT systems. This can delay the attacker and give the defender more time to detect and respond to the attack before the attacker succeeds. Deception also provides a high fidelity signal since no one should access the deception device or system.

Security Automation Summit: How To Use Deception Technology To Protect Your OT/ IT Networks
Security Automation Summit: How To Use Deception Technology To Protect Your OT/ IT Networks »

In operational technology environments, safety and continuity are crucial considerations—but traditional security controls simply won’t protect OT infrastructure, much of which wasn't designed to combat today’s fast-evolving threats. With air gaps between IT and OT decreasing and OT/IT devices often deployed in the same segment, bad actors have increased opportunities to move laterally across IT/OT infrastructures.

How to Use Fortinet FortiDeceptor to Protect OT/IT Networks
How to Use Fortinet FortiDeceptor to Protect OT/IT Networks »

FortiDeceptor, Fortinet’s innovative, non-intrusive, agentless OT/IT/IoT deception solution is a force multiplier to current security defenses, providing early detection and response to active in-network threats. The FortiDeceptor decoys generate high-fidelity, intelligence-based alerts that result in an automated incident response to help stop zero-day attacks. In this session, VP Product Management, FortiDeceptor, Moshe Ben Simon, provides valuable tips and insights on how to use deception for early breach detection and protection against cyber threats across the IT/OT environment.

Deception Technology for IT/OT/IoT Environments
Deception Technology for IT/OT/IoT Environments »

Fortinet's FortiDeceptor is a Distributed Deception Platform (DDP), simulating various types of IT, OT, ICS, and IoT decoys, as well as critical applications (e.g. ERP/SAP, etc.).

A New Breach Protection Approach with FortiDeceptor
A New Breach Protection Approach with FortiDeceptor »

Verizon's 2018 DBIR reports two-thirds of breaches come from external attacks while the remaining are from insider threats. FortiDeceptor is built to deceive and redirect both external and internal attacks to a network of decoys. It exposes these reconnaissance attacks and eliminates them, disrupting the entire kill chain before it even begins.

Free Product Demo

Today's targeted attacks can originate from both external or internal to an organization. Advanced threat deception is key to providing early detection and response before an attack is allowed to complete its full lifecycle. This fully functional FortiDeceptor demo provides users the experience to centrally manage decoys and lures, with actionable visibility to threat campaigns, and the ability to easily integrate with FortiGates to block these attacks.