MazeRunner

Cymmetria MazeRunner is a cyber deception and lateral movement defense platform designed to detect, track, and disrupt sophisticated cyber adversaries inside corporate enterprise networks. Grounded in the premise that motivated attackers will eventually penetrate perimeter defenses, MazeRunner focuses on intercepting attackers during their lateral movement phase before they reach crown-jewel assets. The platform automates the deployment of deceptive elements—including decoy endpoints, realistic breadcrumb credentials, synthetic SSH keys, fake database connection strings, and bogus Active Directory records—across enterprise workstations and production servers. When an intruder or insider scans the network or attempts to use discovered decoy credentials, MazeRunner immediately redirects the adversary's connection into an isolated, instrumented decoy server running inside a secure sandbox. The platform records all attacker interactions, including keystrokes, commands executed, tools downloaded, and targeted endpoints, without alerting the attacker that they are trapped in a decoy environment. MazeRunner maps the attacker's activities to the MITRE ATT&CK framework and exports forensic telemetry and indicators of compromise (IOCs) directly to enterprise SIEM and firewall systems, allowing security teams to contain active breaches and neutralize targeted cyber attacks.