Endpoint Deception Distributed by Cyberdis Active Endpoint Deception that turns malware’s own evasion tactics against it - ransomware aborts before it ever runs.
Cyberdis is a value-added distributor of Deceptive Bytes, selling through channel partners with engineer-led evaluation, deployment and support.
What it does
Deceptive Bytes in short.
Deceptive Bytes is an Active Endpoint Deception platform that prevents ransomware and other evasive malware by turning the attacker’s own evasion techniques against it. Rather than detecting attacks after they execute, it makes the endpoint look hostile and unworthy to malware: it generates the signals of an analysis environment that malicious code checks for before detonating, so the attack aborts itself before execution.
The agent runs in user mode with a footprint under 1.5 megabytes, needs no reboots and no signature database, and covers Windows and Linux. The company reports a prevention rate above 99.9 percent with up to 90 percent fewer alerts sent to SIEM.
Malware’s greatest strength is also its weakness: before it runs, it carefully checks whether the environment is real, unmonitored and worth attacking. Deceptive Bytes answers those checks with the wrong answers - prevention that needs no prior knowledge of the threat and runs alongside the endpoint stack a customer already owns.
Capabilities
What you get.
-
Preemptive deception
Creates the artifacts of a hostile analysis environment on every endpoint. Malware performing reconnaissance concludes it is being watched - and terminates itself before executing.
-
Evasion-technique coverage
Built around the 1,000+ techniques malware uses to fingerprint its target before detonating - the checks that make threats evasive become the tripwire that stops them.
-
High-fidelity alerts, less noise
Threats reveal themselves during reconnaissance, so alerts carry intent, not noise - the company reports up to 90 percent fewer alerts reaching SIEM and downstream systems.
-
Featherweight, stack-friendly agent
User mode, under 1.5MB on disk, no reboots, no threat database to update. Deploys alongside EDR, EPP and XDR platforms without conflicts - on Windows and Linux (Ubuntu, Debian, RHEL, SLES).
Why through Cyberdis
The vendor is theirs. The deployment is ours.
- 01
A PoC where malware decides
We run live ransomware samples in a controlled evaluation environment and let the buyer watch them refuse to execute. Deception is a claim on a slide until malware aborts in front of the customer.
- 02
Deployed in days, not quarters
A user-mode agent with no reboots removes the usual rollout drama. Cyberdis engineers plan the deployment, tune the deception policy to the fleet and hand over a working installation.
- 03
The cleanest add-on sell in the portfolio
Deceptive Bytes does not replace the customer’s endpoint stack - it hardens it. Resellers get a complementary line to open in accounts that already bought EDR, with Cyberdis engineers carrying the technical story.
FAQ
Frequently asked questions about Deceptive Bytes
What is Deceptive Bytes?
Deceptive Bytes is an Israeli endpoint security company, founded in 2016 in Holon and named a Gartner Cool Vendor in 2019, whose Active Endpoint Deception platform prevents ransomware and evasive malware by making the endpoint appear hostile and unworthy of attack - so malware aborts before executing.
How is endpoint deception different from antivirus or EDR?
Detection tools must recognize a threat to stop it. Deceptive Bytes inverts the model: it exploits the fact that malware inspects its environment before running, and feeds that reconnaissance the wrong answers. No signatures and no prior knowledge of the threat are needed - and the platform runs alongside existing AV and EDR rather than replacing them.
Will Deceptive Bytes conflict with our existing endpoint stack?
No. The agent runs in user mode with a footprint under 1.5MB, requires no reboots and no threat database, and is designed to operate alongside EDR, EPP and XDR platforms. It also cuts the alert load those tools generate - the company reports up to 90 percent fewer alerts sent to SIEM.
Does Deceptive Bytes support Linux?
Yes. Active Endpoint Deception launched on Windows and has been available for Linux since 2023, extending the same preemptive deception model to Linux servers and workloads.
Who distributes Deceptive Bytes?
Cyberdis is a value-added distributor of Deceptive Bytes, selling through channel partners and resellers with pre-sales engineering, proof-of-concept execution, deployment and post-sale support included.
Weighing approaches? Read: Endpoint deception vs detection-based security: confuse the malware, or recognize it?
New to the category? Start with: What is endpoint deception?What is deception technology in cybersecurity?What is sandbox evasion?
See it running
See Deceptive Bytes on your own terms.
A demo tailored to your environment, or a full proof of concept - run by a Cyberdis engineer.
End customer rather than reseller? Ask anyway: we bring the right partner into the deal and stay on it as the engineering team.