There is something comic about the most serious idea at Acalvio Technologies. Imagine breaking into a company and finding a password labeled like a prize, a server that looks neglected in exactly the right way, or a route toward a database that seems too useful to ignore. You touch it. Nothing valuable happens. Somewhere else, a security analyst gets an alert that is unusually easy to believe - because no employee had any legitimate reason to touch the fake thing.
That is cyber deception, the Santa Clara company’s specialty since 2015. Its ShadowPlex platform places decoys, false credentials, breadcrumbs and what Acalvio calls HoneyPaths across corporate networks, cloud accounts, identity systems and industrial environments. The aim is not to replace firewalls, endpoint protection or identity controls. It is to catch the intruder those layers missed, ideally while the intruder is still exploring rather than encrypting, stealing or sabotaging.
The distinction matters. Conventional detection asks whether activity on a real asset looks abnormal. Deception asks why anyone is interacting with an asset that has no real job. That changes the math of an alert. A login at 2 a.m. might be an attacker, a service account or a tired employee. A login with a fabricated service credential planted solely as bait has fewer innocent explanations.
A fake network without a warehouse of fake computers
Acalvio was founded by Ram Varadarajan, Raj Gopalakrishna, Sreenivas Gukal and Nat Natraj, security veterans with a taste for infrastructure problems. Varadarajan had already co-founded Arcot Systems, whose authentication work helped create Verified by Visa, before CA Technologies bought Arcot for $200 million in 2010. The group spent roughly two years in stealth and emerged in 2016 with $17 million in cumulative Series A and B funding.
The technical problem was not inventing a honeypot. Defenders had used fake systems for years. The problem was making deception believable, broad and maintainable inside enterprises with hundreds of network segments, several clouds, old industrial equipment and impatient security teams.
ShadowPlex’s answer is a central Deception Center plus lightweight sensors. Its patented Deception Farms architecture can project many decoys into different network zones without requiring a full physical or virtual machine for each one. A low-interaction decoy can answer a scan, then become richer if the attacker leans in. The platform studies the environment, recommends deception playbooks and seeds endpoints with false clues. It is agentless by design, often using existing endpoint tools or cloud APIs to distribute bait.
This architecture is the company’s chief point of difference. A canary token is a cheap tripwire. Acalvio is selling a managed fabric: autonomous placement, adaptive decoys, containment outside the decoy, attack-path telemetry and integrations with SIEM, SOAR, EDR and XDR systems. Its alternatives include dedicated products from Zscaler, Fortinet, CounterCraft and the businesses now folded into SentinelOne and Proofpoint. The wider competition is every security leader who decides existing endpoint, network and identity analytics are enough.
The first thing that failed was an assumption
An anonymized Acalvio customer story offers a less theatrical account of value. A digital-media company connected to its parent organization believed the parent had eliminated a malware incident. Compromised devices later began probing through a firewall into the media company’s environment. ShadowPlex saw the probing. The customer identified the affected devices and tightened its firewall policy.
What failed first was not a box or an agent. It was the belief that cleanup was complete. That is precisely where deception earns its place: behind preventive controls, in the awkward gap between “we handled it” and “we can prove nothing remains.” The media company went on to formalize a ransomware response workflow and considered using the system for proactive threat hunting.
Another customer pattern is expansion after a narrow deployment. Broadcom’s then-CISO Sean Oldham said the company recognized value quickly and broadened ShadowPlex coverage to detect lateral movement. A healthcare reference describes using the CrowdStrike integration to roll honeytokens into newly onboarded domains through an approval process. A global consumer-goods company deployed deception across more than 100 VLANs as workloads moved toward Azure.
The best public test arrived from the U.S. Navy’s Cyber Resilient Systems Advanced Naval Technology Exercise. Acalvio placed first overall in the FY25 challenge. The company later reported 100 percent true positives and 80 percent denial of attacker objectives. Those figures came from a competitive evaluation, not a universal customer benchmark, but they gave Acalvio something security vendors crave: evidence under hostile conditions rather than another immaculate product demo.
What it costs - and what the invoice omits
Acalvio does not post a universal price card. Its public AWS Marketplace offer provides one useful marker: $54,000 for a 12-month contract protecting 500 IPs. AWS infrastructure can cost extra, and larger deployments, additional modules and negotiated terms change the bill. An older product test put entry pricing at $1,000 a month, but the current public offer makes the intended buyer plain. ShadowPlex is enterprise software, not a weekend tool for a five-person startup.
The hidden expense is care. Deception must resemble the environment around it. Credentials, services and paths need sensible placement. Alerts need owners and response playbooks. Integrations must actually close the loop. A mature security operation can turn a rare, high-confidence alert into fast containment. A small team that cannot investigate immediately may buy an excellent smoke detector and leave the building without an evacuation plan.
The method also works poorly when bait goes stale or sits nowhere an attacker would look. A decoy that screams “decoy” provides little information. A deception layer scattered everywhere without reference to identity privileges, critical assets or likely lateral routes can become decoration. Acalvio’s automation is meant to reduce that burden, not abolish it.
AI changed the intruder, so Acalvio changed the lie
For most of its life, Acalvio sold a clean proposition: fake looks real. In 2026 it widened the idea into “360 Deception.” Fake assets still look genuine, but real assets can be made to appear deceptive, while intentionally suspicious artifacts create choices an attacker cannot safely dismiss. The goal is uncertainty. Human intruders lose time verifying. Automated attack systems lose confidence in the environmental signals used to choose credentials, targets and routes.
That shift reveals what changed Acalvio’s mind. AI-assisted attacks did not invalidate the old decoy. They made a single trap too narrow. An automated system can probe, classify and abandon questionable targets quickly. So Acalvio moved from waiting for one fake thing to be touched toward manipulating the decision process itself: what the attacker sees, trusts and acts upon.
Deception Guardrails, launched in July 2026, extends the thesis to tool-using AI agents. Traditional AI guardrails inspect inputs and outputs. A compromised agent may still misuse credentials, call tools or wander through infrastructure. Acalvio proposes honey skills in the files agents read, plus decoy Model Context Protocol servers, fake retrieval systems and decoy agents. If an agent reaches for one, the security team gets an early warning. It is classic tripwire logic wearing very new clothes.
The part a reader can copy
The portable idea is not “build an enormous fake company.” It is to create a small number of artifacts with no legitimate use, place them in the routes an intruder is likely to explore, and decide in advance what happens when one moves. A fake administrator credential near a real identity store is more useful than a random dummy server. A decoy secret in a cloud workload is more useful when its alert automatically reaches the team that can revoke access.
- Start with crown-jewel identities, service accounts and lateral paths, not maximum decoy count.
- Make each artifact fit its neighborhood: naming, operating system, protocol and apparent value matter.
- Route every tripwire into an owned response process with a clear first action.
- Refresh the fiction as real infrastructure changes, especially during cloud migrations and acquisitions.
Acalvio’s business rests on doing those four things across enterprises where manual upkeep would collapse. The company has raised about $58 million across reported rounds, including a $17.4 million Series D in 2022, and built distribution through AWS, Google Cloud, CrowdStrike, Microsoft, Honeywell, Booz Allen and Carahsoft. The model is subscription software sold directly, through marketplaces and partners, or delivered as a managed service.
Its place in the market remains specialized. Deception is an additional control for organizations that already possess valuable infrastructure and a functioning security operation. It does not patch the server, fix identity governance or respond to the incident by itself. What it can do is tell the team, with unusual clarity, that somebody has begun believing the wrong story. In cybersecurity, that may be the rare lie that leaves the defender better informed.