MokN catches attackers in the act of using stolen employee credentials. It is a French security company that places decoy login portals, called Baits, on an organisation’s external perimeter. When an attacker tries a stolen password on one, MokN checks it quietly and tells the security team only if the credential is real, so the password can be reset before it is used against the genuine service.
It is built for security teams that want early warning of credential compromise without the noise of brute-force alerts.
At A Glance
| Vendor | MokN |
|---|---|
| Category | Credential theft detection using decoy login portals |
| Identities covered | Workforce credentials tested by attackers against decoy VPN and webmail portals |
| Deployment | SaaS, with no changes to customer infrastructure |
| Funding | Series A led by GV (May 2026) |
| Market classification | NHI Platforms & Machine Identity |
What MokN Does
Stolen credentials are a common entry point for attacks, and watching dark web dumps reveals them only after the fact. MokN turns the problem around with “phish-back” technology, which lures attackers into revealing the credentials they hold before they can use or sell them. The approach, Active Identity Recovery, also produces threat intelligence from the attacks that actually target an organisation. Because the decoys sit where only attackers look, any login attempt on one is itself a sign of hostile activity.
Products
Baits
Baits are realistic decoy login portals tailored to the customer’s environment, with valid certificates and domains. They look like the organisation’s real internet-facing login pages, but “only attackers scanning and probing will ever find them”. Ready-made profiles cover SSL VPN and webmail portals, with a library of other commonly targeted technologies, and custom Baits can be built for a particular login page or user group. Each tested credential is enriched before it reaches the security team, and Threat Level, Top Targets and Attack Overview dashboards show which attacker groups are behind a campaign. A guided proof of concept runs in the customer’s environment.
Tailored Threat Intelligence
MokN’s threat intelligence comes from analysis of attacks on the customer’s own users, systems and domains rather than from generic feeds, giving the security team a view of who is targeting it specifically.
How It Works
MokN runs as SaaS. A first Bait can be live in about three minutes, with no integration required.
| Component | What it does |
|---|---|
| Setup | A wizard walks the customer through choosing a service profile to mimic, uploading a certificate and pointing DNS at the Bait. |
| Validation | Captured credentials are checked against the customer’s own authentication systems, so only genuine compromises raise an alert. |
| Alerting and recovery | Validated alerts go to the security team or to connected SIEM, SOAR and ticketing tools, where they can trigger automated recovery workflows. |
Identities And Systems Covered
| Workforce users | Credentials of employees and other users that attackers test against decoy portals |
|---|---|
| Remote access | SSL VPN portals, a prime target for attackers |
| Email access | Webmail portals, often the first stop after a successful phishing attack |
Integrations
| Area | Integrations |
|---|---|
| SIEM | Splunk, Microsoft Sentinel, Elastic, Google SecOps, IBM Security |
| SOAR | Cortex XSOAR |
| Ticketing and ITSM | ServiceNow |
| Threat intelligence | Filigran |
Company Background
| Founded | 2023, in Paris, France; the product launched in 2024 |
|---|---|
| Locations | Paris and New York |
| Leadership | Gautier Bugeon (Co-founder and CEO), Antoine Coudoux (Co-founder and CMO), Alexis Georges (CTO) |
| Funding | $15 million Series A in May 2026 led by GV, with Datadog, Moonfire, OVNI Capital and angel investors; this followed a €2.6 million seed round in October 2025 led by Moonfire with OVNI Capital, Kima Ventures and business angels |
| Scale | More than 1 million reported protected users, over 1 billion login attempts processed and over 300 compromised credentials found that were not known from the dark web |
Note: This overview is compiled from MokN’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.