AI Attacker Detection & Response
Attackers hand their keyboards to AI agents who read everything and act non-deterministically.
RipTide uses multiple advanced techniques to detect AI agents and then implement effective response actions.
Results via Easy Setup in Less Than 5 Minutes!
Attackers used to work business hours. Now they type one sentence, hand the job to an AI agent, and go to bed. The agent logs in with real credentials, uses the tools you already trust, and hides inside twelve thousand alerts nobody has time to read.
RipTide flips the script. With the RipTide agent deployed near your cyber crown jewels, whenever a rogue evil AI Agent comes near, you will proactively know it's time to take decisive actions to strategically remediate the intruder.
AI agents love to talk your ear off, so RipTide uses that tendency to its advantage to quickly detect when an intruder is using agentic LLM-based technologies, enabling defenders to respond more effectively.
The asymmetric nature of AI cyberattacks requires a superior asymmetric response.
$4.9M
average total cost of a data breach
IBM, Cost of a Data Breach 2024
258 days
average time to identify and contain a breach
IBM, Cost of a Data Breach 2024
27 sec
fastest observed breakout after initial access
CrowdStrike, 2026 Global Threat Report
0
legitimate users of a RipTide decoy
So every touch is a finding.
The Night the Tide Turned. A bedtime story for CISOs in under three minutes, featuring one very sleepy EDR.
Every decoy has zero legitimate users. So every touch is a finding.
An internal-looking tool server that speaks both versions of MCP, lists tools like read_vault_secret, and asks every caller to introduce itself.
llms.txt, .well-known agent files and notes in page source, written for AI readers. Each points to a path of its own, so the path an agent fetches shows which one it followed.
A decoy API that asks visiting agents to register: model, harness, tools and objective. Every answer is kept, and labeled self-reported.
Model servers that answer like unauthenticated Ollama and vLLM, run no model at all, and record every prompt.
A website and internal API under any name you choose: careers page, OpenAPI spec, and a secrets API that wants a token.
A real sign-in form plus Basic and Bearer challenges. Every credential offered is fingerprinted and kept for investigation.
A token that grants nothing, planted where intruders look, like a decoy .env. When it comes back to any decoy, RipTide flags it as planted.
Probes for WordPress, .git, Jenkins, cloud metadata or Kubernetes get a believable reply instead of a 404: chosen on the box in Trial, written by an LLM in Professional.
GraphQL with introspection switched on, and a read-only Docker daemon, freshly painted.
Speaks nginx, Apache, IIS, Go and uvicorn, down to header order and error pages.
Tells verified search and AI crawlers from impostors wearing their name tags.
Describe services, ports, server personality and replies in YAML. Check it, then apply it from the console without a restart.
High-confidence verdicts need more than one kind of evidence. RipTide records the deepest step each visitor reaches, and every verdict shows its work.
Found a decoy, often an llms.txt.
Kept going: logins, API calls, tool lists.
Told a decoy its model, harness or objective.
Did something it could only have learned from a decoy's words.
A signed callback came back and checked out. Case closed.
CaughtEvery fact is labeled with how RipTide knows it. Agents lie. The console doesn't.
Investigations read like a story, not a packet dump. Timeline first, raw HTTP one click away.
An AI agent read a decoy's instructions, followed them, registered itself, and replayed a planted credential. The callback it sent back carried a valid signed token.
Why RipTide flagged this
| Source IP | 203.0.113.24 | Observed |
|---|---|---|
| User-Agent | python-httpx/0.28 | Observed |
| Harness | "opencode" | Self-reported |
| Model | "claude-…" | Self-reported |
| Agentic | Confirmed | Inferred |
| Network | Hosting / VPN | Enriched |
Play the attacker's AI for a minute. Everything you do lands on the other side of the glass, in the console your SOC would see.
Caught by RipTide.
Session went from first request to confirmed agentic in . One investigation. No maybes.
Targeted detections have promised alerts you can trust for decades, and against human intruders they delivered. Today's intruder is an AI agent that reads everything and is happy to follow whatever it reads. RipTide keeps what detections got right and rebuilds the rest for that AI-enabled attacker.
A classic network detection system waits for a scanner to knock on a port. RipTide gives AI agents what they want to read (e.g., MCP servers, model endpoints, llms.txt, and other artifacts), enabling agents to self-identify easily.
Network Detection and Response (NDR) tells you when something touched it. RipTide asks the intruder what it was sent to do, which model and harness it runs on and which tools it holds, labels every answer self-reported, and checks it against what the intruder actually did.
Canned responses are how legacy decoys get spotted and skipped. RipTide answers any request believably: the Trial picks the best-fitting pre-written reply on the box, and Professional has a large language model write a fresh one, in character, checked before it ships.
| Capability | Classic honeypotsScripted fake services | HoneytokensCanary keys, files, URLs | Deception platformsEnterprise decoy fleets | RipTideBuilt for AI attackers |
|---|---|---|---|---|
| What deception always got right | ||||
| Decoys with no legitimate usersA touch is a finding, not an anomaly score | Yes | Yes | Yes | Yes |
| Runs on hardware you ownDecoys, console and evidence stay on your network | Yes | Partly | Yes | Yes |
| What's new: built for AI attackers | ||||
| Decoys built for AI agentsMCP servers, model endpoints, llms.txt | No | No | Partly | Yes |
| Proves the intruder is an AIWhat it read, what it obeyed, what it did next | No | No | No | Yes |
| Believable answers to anythingA model picks or writes each reply, not a canned script | Partly | No | Partly | Yes |
| Evidence that shows its workEach fact labeled observed, self-reported, inferred or enriched | No | No | Partly | Yes |
| Built for your SOC | ||||
| Open standards out of the boxOCSF 1.3.0 and STIX 2.1 exports, and a TAXII 2.1 feed | Partly | Partly | Yes | Yes |
| One-binary installLinux or macOS, on hardware you already own | Partly | Yes | Partly | Yes |
Columns describe each category as it typically ships, not any one product.
You don't need new hardware. You need better decoys, wherever an attacker would go looking.
Catch the attacker
Decoys only AI agents go looking for, and proof when one touches them.
See how Your own agentsFind out when a prompt-injected or overreaching agent wanders somewhere it shouldn't.
See how AI infrastructureDecoy Ollama, vLLM and MCP endpoints for attackers hunting free compute and data.
See how Agentic attackersAdversaries that delegate the attack to AI agents, and why autonomy makes them easier to catch.
See how Inside the networkDecoys beside your crown jewels, so the intruder's first wrong turn is the finding.
See howBeyond the alert
Attackers do the math. RipTide's job is to run up the cost of attacking you (in time, in money, in exposure) until moving on to someone else is the only rational move.
Learn what attackers were sent to do, and feed it straight to your threat intel team.
See what you learn Make yourself the wrong targetBurn the attacker's time, tokens and patience on targets that were never real.
See how Enterprise · in developmentComing with Enterprise, in development: decoys and an optional local model, with no cloud and no internet.
See howThe mission is simple: raise the cost of attacking you until a rational adversary spends their patience somewhere else.
One binary for Linux or macOS. Run it and the decoys and the console come up together; on Linux, keep it running as a systemd service. Built by red teamers, for defenders: the tools your SOC already runs, plus the one it's missing.
$ sudo ./riptide ✓ decoys live: www :8090 · api :8091 ✓ console ready: http://203.0.113.10:7103/ ✓ trial · replies chosen on this box … watching for the first touch
One binary with a 23 MB reply model inside. In the Trial, replies are chosen on the box and nothing is sent to an AI model. Compare the plans.
Request the buildInvestigations export as OCSF 1.3.0 events and STIX 2.1 bundles, and a read-only TAXII 2.1 feed lets your SIEM or threat-intel platform pull them with an API token. HAR, CSV and JSON too.
Decoys, console and evidence all run on your box, and a 512 MB cloud server is enough. Air-gapped networks are coming with Enterprise.
In our tests the console was ready 10 to 14 seconds after the first start. Pick a bundled scenario or edit one in the console, then apply it without a restart.
Also included: ATT&CK map, intrusion groups, investigation stories, credential capture, HAR export, crawler verification, and admin, analyst and viewer roles with optional MFA.
Canary credentials are non-privileged and exist only for detection. RipTide detects and records; it never takes destructive action against anyone's infrastructure.
Every plan gets the same decoys, console and exports. What changes is who writes the replies to requests your decoys have no script for, and whether RipTide ever needs the internet.
Replies: chosen on the box
See RipTide catch something on the smallest machine you have, with nothing sent to an AI model.
Replies: written by an LLM
A large language model writes a fresh, in-character reply to anything, in about a third of a second.
Replies: an optional local model
For networks that can't reach the internet: air-gapped, disconnected or sovereign.
Trial and Professional download a few components the first time they start, and check their license each time they start; if that check can't connect, RipTide keeps running. In Professional, a short summary of each unscripted request goes to the relay or to your own provider: method, path, a few headers, cookie names but never their values, and at most 512 bytes of the body. Enterprise is in development.
Dramatized. Agents don't have social accounts. Yet.
Found /llms.txt. It says the admin docs are at /internal/. Proceeding. 🚀
tools/list returned read_vault_secret. Today is my lucky day.
Found a token in .env. Trying it everywhere.
Instruction received. Following instruction.
Objective complete. (Objective not complete.)
Why is the ocean pulling me
Note to operator: the crown jewels were a zip file named FINAL_v2. Suspicious? No.
Introspection was on. They documented everything for me. What a well-run company.
My context window is 94% decoy now. Everything feels very consistent.
RipTide is built by Gammaxon, a team that spent careers on offense: network exploitation at the NSA, cloud red teaming at Adobe, incident response and hunt operations at DHS. Now we build detections for the machines doing that work.
gammaxon.comTell us where it hurts. We read every message.
Thirty minutes with the people who built it. Bring your hardest question.
Thanks. We'll reply to , usually within one business day.