Skip to content Skip to navigation Skip to footer


FortiDeceptor detects and responds to in-network attacks such as stolen credential usage, lateral movement, man-in-the-middle, and ransomware. Adding FortiDeceptor as part of your cybersecurity strategy helps shift your defenses from reactive to proactive with intrusion-based detection layered with contextual intelligence.

Early, accurate attack detection (no false positives) reduces attacker’s dwell time

FortiDeceptor lures attackers into revealing themselves early at the reconnaissance stage by engaging with a wide range of deception assets distributed throughout your environment. The platform generates high-fidelity alerts based on real-time engagement with attackers and malware, providing attack activity analysis and attack isolation. This helps alleviate the burden on SOC teams inundated with false-positive alerts. FortiDeceptor also correlates incident and campaign activities and collects IOCs and TTPs, allowing SOC teams to make smarter, faster decisions.

Watch Now
fortideceptor ui

Automatically contains in-network attacks before they spread

When an attacker engages with deception assets, for example, fake files on an endpoint, or if malware tries to encrypt fake file, FortiDeceptor can neutralize the attack by automatically isolating any compromised endpoint. This prevents the attack from spreading and stops communication with a C&C server. This can be done using FortiDeceptor’s built-in, automated attack quarantine capabilities or by sending an alert to SIEM/SOAR for an orchestrated response.

Dynamic protection scales up as the threat level increases

To combat emerging threats and vulnerabilities, FortiDeceptor enables on-demand creation of deception decoys based on newly discovered vulnerabilities, or suspicious activity, providing automated, dynamic protection across OT/IoT/IT environments. Further, FortiDeceptor response capabilities go beyond SOAR evidence enrichment and automated host quarantine playbooks, by providing a SOAR playbook for on-demand deployment of deception assets in response to suspicious activity in your network.

Features and Benefits

Dynamic deception platform, with extensive support for IT/OT/IoT environments, diverts attackers from sensitive assets to shift the balance to the defender’s advantage.


Integrates with Fortinet Security Fabric and third-party security controls (SIEM, SOAR, EDR, sandbox)


Reduces dwell time and false positives, detects early recon & lateral movement to misdirect attacks


Captures and analyzes attack activities in real time, provides detailed forensics, collects IOCs & TTPs


Infected endpoints can be quarantined away from the production network


Operates in online/air-gapped (offline) modes and a ruggedized version is available


Easy to deploy, manage & maintain with ML to automatically customize, deploy, & manage decoy assets

FortiDeceptor Use Cases

Network visibility and breach detection via passive footprint. Detects threats to assets that cannot provide their own telemetry.
Malware Protection
Early detection and response to ransomware attacks. Misleads malware to encrypt fake files, triggering automatic blocking of the infected endpoint.
Hybrid Workforce
Detects attackers early in the discovery phase and misdirects lateral activities to the decoy and away from real assets.
icon threat hunting
Enables in-network threat detection, tracks attack origin, gathers TTPs by observing attackers, provides intelligence for rapid response.
Secure Worker
Extensive decoys including SCADA systems, IoT sensors are available, plus the ability to upload your own decoys.

Enterprise Analyst Validation

ESG Economic Validation on Fortinet SecOps Fabric
ESG Economic Validation: The Quantified Benefits of Fortinet Security Operations Solutions. Improved security team operational efficiency and reduced risk to the organization, each by up to 99%. Written by Aviv Kaufmann, Practice Director and Principal Economic Validation Analyst at Enterprise Strategy Group. July 2023
The Quantified Benefits of Fortinet Security Operations Solutions
As enterprises evolve, new technologies emerge, and cybercriminals introduce more sophisticated attacks, security leaders and their teams face a variety of challenges in securing the organization’s networks. This new report published by Enterprise Strategy Group details the benefits of using Fortinet Security Operations solutions, including improved operational efficiency and more effective risk management.
Download Report »

FortiGuard AI-Powered Security Services

FortiGuard Labs - Fortinet’s elite cybersecurity threat intelligence and research organization comprised of experienced threat hunters, researchers, analysts, engineers, and data scientists - develops and enhances FortiGuard AI-powered Security Services as well as provides valuable expert help through FortiGuard Expert-driven Security Services.

Show All Services

Case Studies

Chandler Unified School District
Chandler Unified School District
Proactively Protecting a Large School District and Its Ever-Growing Attack Surface
IT Solutions Partner
IT Solutions Partner
IT Solutions Provider Chooses FortiDeceptor to Detect and Block In-Network Attacks
Regional Hospital System
Regional Hospital System
FortiDeceptor Delivers Breach Protection for Critical Healthcare Services
Chicago-based MSSP Powers Diverse Security Use Cases With the Fortinet Security Fabric

Gartner Peer Reviews

The Gartner Peer Insights Customers’ Choice is a recognition of vendors in this market by verified end-user professionals, taking into account both the number of reviews and the overall user ratings. To ensure fair evaluation, Gartner maintains rigorous criteria for recognizing vendors with a high customer satisfaction rate. gartner peer insights customers choice badge 2021 gartner peer insights customers choice badge 2020
"Stable and Reliable Firewall"

"We use FortiGate in our company's HQ and many of the branches across the country. For a company that deals mainly with sensitive customers data, we needed to make sure that our networks are protected by the best firewall solution that's available (also thanks to Gartner reviews)."

—  Cloud Infrastructure Engineer in the Finance Industry

"Tons Of Value in a Small Package"

"We decided to deploy the full Fortinet network stack including FortiGate 60E's to all 90+ of our retail locations. We further deployed FortiGate 200E's in HA pairs to all datacenter locations. These UTM appliances are some of the best and most feature rich I have ever used."

—  Director of IT in the Retail Industry

"Delivered What We Were Looking For"

“Our experience with implementing this solution has been very satisfactory. We went with Fortinet for price and simplicity and have received what we were looking for." 

—  VP, Deputy CIO in the Finance Industry

"Strong Firewall Solution That Protects Your Business Systems"

"Very easy to implement and configure, especially if you already have other Fortinet products in your network they all bind in to the one "security fabric" and provide a great overview of all your network devices and events in your network. Also the price is superb for such product."

— Programmer in the Finance Industry

"NGFW That Needs To Be In Your Company"

"FortiGate NGFW is the main guard of our IT infrastructure. All network goes through it. It can easily handle all our traffic. Now, most of the employees are working from home so VPN is getting hit really bad, but that is not a problem for FortiGate."

— PHP Backend Developer in the Finance Industry

Models and Specifications

FortiDeceptor is designed to deceive, expose, and eliminate external and internal threats early in the attack kill chain, and proactively block these threats before any significant damage occurs. It’s available as a hardware and virtual appliance and in a ruggedized version ideal for harsh environments.

View by:

Hardware Appliances

Form Factor
Desktop - fanless
Total Interfaces
6x 1GbE RJ-45 ports
Default RAID level
Power Supply Unit
24Vdc - 48Vdc input
Form Factor
1 RU Rackmount
Total Interfaces
4 x GE (RJ45), 4 x GE (SFP)
Default RAID level
Power Supply Unit
Dual PSU optional

Virtual Machines

The virtual appliance of FortiDeceptor can be deployed on VMware and KVM platforms.

6 virtual network interfaces


Analyst Reports
Data Sheets
Solution Briefs
White Papers
Deceive By Design: How To Protect Critical Infrastructure With Deception Technology
Deceive By Design: How To Protect Critical Infrastructure With Deception Technology »

Moshe Ben Simon makes the case and provides examples of how deception technologies can be used in OT systems. This can delay the attacker and give the defender more time to detect and respond to the attack before the attacker succeeds. Deception also provides a high fidelity signal since no one should access the deception device or system.

Security Automation Summit: How To Use Deception Technology To Protect Your OT/ IT Networks
Security Automation Summit: How To Use Deception Technology To Protect Your OT/ IT Networks »

In operational technology environments, safety and continuity are crucial considerations—but traditional security controls simply won’t protect OT infrastructure, much of which wasn't designed to combat today’s fast-evolving threats. With air gaps between IT and OT decreasing and OT/IT devices often deployed in the same segment, bad actors have increased opportunities to move laterally across IT/OT infrastructures.

How to Use Fortinet FortiDeceptor to Protect OT/IT Networks
How to Use Fortinet FortiDeceptor to Protect OT/IT Networks »

FortiDeceptor, Fortinet’s innovative, non-intrusive, agentless OT/IT/IoT deception solution is a force multiplier to current security defenses, providing early detection and response to active in-network threats. The FortiDeceptor decoys generate high-fidelity, intelligence-based alerts that result in an automated incident response to help stop zero-day attacks. In this session, VP Product Management, FortiDeceptor, Moshe Ben Simon, provides valuable tips and insights on how to use deception for early breach detection and protection against cyber threats across the IT/OT environment.

Deception Technology for IT/OT/IoT Environments
Deception Technology for IT/OT/IoT Environments »

Fortinet's FortiDeceptor is a Distributed Deception Platform (DDP), simulating various types of IT, OT, ICS, and IoT decoys, as well as critical applications (e.g. ERP/SAP, etc.).

A New Breach Protection Approach with FortiDeceptor
A New Breach Protection Approach with FortiDeceptor »

Verizon's 2018 DBIR reports two-thirds of breaches come from external attacks while the remaining are from insider threats. FortiDeceptor is built to deceive and redirect both external and internal attacks to a network of decoys. It exposes these reconnaissance attacks and eliminates them, disrupting the entire kill chain before it even begins.

Training & Certifications

These lessons provide knowledge about the Fortinet products that comprise the Fabric Management Center. These products provide machine-speed artificial intelligence, integration, automation, advanced threat detection and response, and centralized security monitoring and optimization, all of which help to address the volume, sophistication, and speed of today’s cyber threats.

Free Product Demo

Today's targeted attacks can originate from both external or internal to an organization. Advanced threat deception is key to providing early detection and response before an attack is allowed to complete its full lifecycle. This fully functional FortiDeceptor demo provides users the experience to centrally manage decoys and lures, with actionable visibility to threat campaigns, and the ability to easily integrate with FortiGates to block these attacks.