From managed detection to managed deception

Over 56 days, JODOR placed sensors and deception systems inside Saudi Arabia and recorded 450,908 requests from 22,924 addresses. Of those visitors, 2,207 showed clear hostile intent. That number on its own was not the surprise, because the internet is full of attackers. The surprise came from a simple question we asked next: how many of them were already known?

Public lists miss half the picture

We checked every attacker against 34 public blocklists, the same lists many organisations rely on to decide who to stop and who to let through. Of the 2,207 attackers, 1,102 were on none of them, which is roughly half. When we looked only at attackers hosted inside Saudi Arabia, 194 of 220 were on no list at all, which is 88%.

The reason becomes obvious once you think about how those lists are made. A public list is built from attackers that somebody else saw, somewhere else, some time ago. The attacker aiming at you today may be new, or may change address quickly. In our data, 76% of attackers appeared on a single day and then moved on. A list that reaches you one day late can be late enough.

And attacks do not wait

Of the 173 attackers who used a known exploit, 146 used it within ten seconds of arriving. Those who went looking for passwords and keys typically asked for them 0.75 seconds after their first request. That is machine speed, not the speed of a person at a keyboard. On the other side, a survey published in 2026 found that a typical security operations centre leaves 28% of its alerts uninvestigated. The gap between how fast attackers move and how much a team can follow up is exactly where intelligence gets lost.

The idea: let the attacker introduce himself

Deception means building fake systems that look easy to break into: a staff login page, an API, a configuration file that seems to have been left on a server by mistake. No genuine user has any reason to visit them, so anyone who touches them is almost certainly an attacker. That is an unusually clean signal, because it needs no guesswork and no long analysis to know the visitor is not a lost customer.

More importantly, the deception systems in this service carry your organisation's name and look. An attacker who approaches them is not only sweeping the internet at random; he is looking for you. Every touch reveals his address, his tools and his intent before he reaches any of your real systems.

From managed detection to managed deception

Traditional managed detection means an outside party watches your network, your systems and your logs. That model has its place, but it needs access, installation and integration, and it is an activity that licensing bodies regulate. We chose a different path. JODOR does not watch your network, does not touch your logs and takes no action inside your environment. We operate the deception systems on JODOR infrastructure in Saudi Arabia, we give you the intelligence, and you decide what to do with it.

The service starts with a short workshop in which we learn who targets your sector and your services. We then design deception systems with your name and look, on domains JODOR owns, with your written approval. They carry fake weaknesses and fake passwords only, and nothing real is ever placed in them. AI agents watch everyone who approaches them around the clock and match each attacker against threat lists, and a JODOR analyst reviews everything that needs a human eye.

The agents were tested on a live platform

This service was not designed on paper. Over 15 days of live operation on a JODOR-operated platform, 6,168 alerts were raised, and the AI agents settled 82% of them without needing a person. When the firewall had already denied every request from an attacker, that attacker reached the block list within about five minutes, and the fastest decision came just 15 seconds after the first request. The same agents now watch the deception systems that carry your name.

We do not claim that speed is enough on its own. Of the 1,906 blocks applied during the test, 102 were later undone, about 5%. Automatic safety checks reversed 87 of them, and the rest were reversed after a person reviewed them. Most of those mistakes hit administrators, content delivery networks and real search engines. That is why your attacker list always starts from your list of trusted addresses, so that a friend never ends up on it by accident.

What you actually receive

First, you receive your own attacker list, with addresses, fingerprints and other signals that your firewall or security operations centre can load directly. You receive a priority alert whenever someone tries a fake password that exists only in your deception systems, because that means someone is targeting you right now. You also receive detection rules written from what attackers actually did, ready for your security tools, and a monthly report that explains who targeted you, how, from where, and what to do next.

Had you been a subscriber during our test, your list would have shown you 261 attackers who hunted for passwords and keys, 173 attackers who used a published software flaw that has had a fix for a long time, and one visitor who sent 152 requests while posing as a well-known search engine's robot, from a network that search engine does not use, and whom no blocklist knew.

How to start

The simplest start is a 45-minute briefing on what is attacking organisations like yours today. If you would rather see the result for yourself, start a free 30-day pilot with deception systems in your name, which ends in a report ready for your board. In both cases you install no software and give us no access to your network.

The full detail is in the report attached to this article. Readers who want technical depth will find YARA rules and MITRE ATT&CK techniques in our article on machine-speed attack TTPs, and readers who want to know how the system works inside will find it in "Inside JODR aMDR".

Sources: JODOR sensors and deception systems in Saudi Arabia, 29 August to 23 October 2026, collected by JODOR and not published in raw form. JODOR AI analysis and response data from a 15-day live test. Prophet Security, State of AI in the SOC 2026, published 3 August 2026; a survey of security operations teams that gives a general indication rather than a measurement of any one organisation.