DecoyNet

Building a one-command mesh of cloud honeypots and AWS canary tokens that lures attackers and fires a CloudTrail alert the instant a planted credential is used. An LLM classifies each attacker session into TTPs and streams a near-zero-false-positive threat-intel feed to a live attack map.