Topic starter
12/06/2026 12:32 am
TL;DR: Deception technology can produce 100% true positives and deny 80% of attacker objectives across enumeration, credential access, lateral movement, privilege escalation and exfiltration, according to Acalvio’s Navy Cyber Challenge result. The lesson is that assume-breach defence now needs active disruption, not just faster detection.
Editorial analysis by NHI Mgmt Group, based on content published by Acalvio: “Acalvio’s Deception Technology Triumphs at Navy Cyber Challenge”.
By the numbers:
- Acalvio reports 100% true positives from every alert generated in the challenge.
- Acalvio reports 80% denial of attacker objectives during the challenge.
Key questions
Q: What breaks when assume-breach defence relies only on detection?
A: Detection-only assume-breach programmes often confirm activity after the attacker has already moved into credential access or lateral movement.
Q: Why does deception reduce attacker success in identity-heavy environments?
A: Deception works because many attackers depend on fast reconnaissance, reusable credentials, and predictable movement paths.
Q: How can teams evaluate whether deception is actually working?
A: Look for evidence that deception improves attribution, reduces investigation time, and exposes real attacker behaviour in identity-heavy paths.
Practitioner guidance
- Instrument deception at identity choke points Place decoys and lures where attackers are likely to touch credentials, directory objects, or adjacent service paths first, so hostile interaction is captured early.
- Measure control value by attacker delay Track how long deception forces adversaries to spend before they can enumerate, pivot, or escalate, and compare that delay with your current detection-only controls.
- Correlate deception alerts with identity telemetry Tie high-fidelity deception hits to authentication, directory, and privilege-change events so analysts can see whether the same actor is trying to expand access.
Bottom line: The article argues that assume-breach defence cannot stop at visibility when attackers can still enumerate, move laterally, and escalate privileges inside the environment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:48 am
Assume-breach is no longer a complete control model: Once defenders accept that attacker presence is plausible, the deciding question becomes whether the environment can still deny progress. Acalvio’s Navy Cyber Challenge result shows that active disruption is not a theoretical enhancement but a distinct control objective. For identity programmes, the implication is that visibility alone is insufficient when attacker movement can already traverse credential and privilege boundaries.
A question worth separating out:
Q: What does deception add to zero trust and segmentation strategies?
A: Deception adds verification of attacker behaviour after the first touch point. Zero trust and segmentation define who should move and where, but deception shows whether an intruder can still probe, pivot, or escalate inside those boundaries. That makes it a practical validation layer for the assumptions behind trust restrictions.
👉 Read our full editorial: Cyber deception exposes the limits of assume-breach security
This post was modified 1 day ago by NHI Mgmt Group