PentenAmio vs. HoneyWire

CBG Deception is an AI-powered cyber deception and threat engagement platform developed by PentenAmio for organizations protecting sensitive networks, critical infrastructure, and government systems. The software uses artificial intelligence to accelerate the creation of realistic decoy networks that attract, divert, and expose sophisticated cyber adversaries. Unlike conventional honeypots that primarily simulate individual systems or services, CBG Deception generates interconnected digital environments containing realistic users, documents, communications, and operational activities. Its Content and Behaviour Generator creates artificial personas with defined characteristics and patterns of life that resemble legitimate activity within an organization. Simulated users interact with applications and network resources by sending emails, reading documents, editing files, making calls, and communicating with other users. These activities provide contextual realism intended to make decoy environments more convincing to attackers investigating compromised networks. Intelligent workflow tools guide security teams through designing deception environments, configuring attack paths, planning scenarios, and deploying simulated infrastructure. The platform allows organizations to tailor digital artifacts, user behaviors, environmental characteristics, and deception objectives to their operational requirements. Its automated generation capabilities reduce the time and resources needed to construct realistic deception environments compared with manual configuration. CBG Deception can operate through cloud-based or on-premises deployments and integrates with supported third-party deception platforms to complement existing security operations.

Built entirely in Go, HoneyWire is an open-source, self-hosted deception engine that catches network intrusions and lateral movement. It strips away the heavy agents and bloat of legacy security software, allowing blue teams and sysadmins to drop distroless canary tripwires onto any Linux machine in seconds via an intuitive TUI wizard. The detection model is designed strictly around a zero false-positive philosophy. Every deployed sensor is a completely synthetic decoy with no real business purpose. Because no legitimate employee or internal system should ever touch them, a single connection attempt guarantees you are dealing with a live attacker, a rogue script, or a compromised CI/CD runner. The current out-of-the-box sensor suite includes: - TCP Tarpits: Bind to highly targeted ports to stall automated scanners and capture incoming payloads. - Admin Web Decoys: Fake router and management login interfaces designed to bait HTTP reconnaissance. - FIM File Canaries: Silent directory tripwires that fire the moment an adversary scrapes or reads fake sensitive files. - Network & ICMP Detectors: Uncover stealthy subnet mapping and ping sweeps long before your actual infrastructure is discovered. (Plus a growing library of upcoming sensors!) The architecture is entirely agentless. Your fleet of traps is managed centrally through the HoneyWire Hub a completely private, self-hosted control center. When a wire is tripped, the Hub instantly pushes high-fidelity alerts out via Syslog, Slack, Discord, Ntfy, or Gotify. This makes it trivial to plug HoneyWire directly into your existing SIEM or EDR workflows without ever sending your network telemetry to a third-party cloud.