Loading HoneyMesh...
Loading HoneyMesh...
Explore a guided dashboard tour. The tour is illustrative; review the separate proof of concept for measured federation results.
Interactive Product Tour
Hover over the dashboard on desktop, or tap any highlighted region on mobile, to explore how HoneyMesh observes, correlates, and enforces in real time.
This is the operator control plane for the node. It presents mode, license, and cluster state in one view.
HoneyMesh Features
HoneyMesh combines local observation, operator decisions, and optional trusted mesh coordination. Its scope follows the hosts and interfaces you configure.
Instead of waiting for attackers to find your real systems, HoneyMesh puts realistic traps in front of them. It runs actual services on common ports like SSH, HTTP, FTP, and Redis that look and behave like the real thing.
Interactions can give operators useful signals for review and local policy. Detection quality should be measured in the customer's own environment.
When policy or an operator creates a source-IP ban, HoneyMesh can apply it through eBPF/XDP on selected interfaces, dropping matching ingress packets before the normal network stack handles them.
The three-node PoC measured selective enforcement, not throughput or overhead. Test performance with representative production traffic.
HoneyMesh does not chase signatures or blocklists that go stale overnight. It watches real attacker behavior: how they probe, what they send, and how they move.
Traps and correlation can surface behavior that a static blocklist alone would not describe. False-positive rates require a separate evaluation.
The local dashboard presents observed events, source information, service context, and ban state for operator review.
From the dashboard, you can manually block anything on the spot or let the system handle it automatically.
A Pro node can send a signed ban signal to approved peers. Each receiving node applies its own trust policy before taking local action.
Do not already have trusted peers? Operators can opt in from the app, discover other HoneyMesh networks through the Exchange, and decide exactly how much to trust them before sharing intelligence.
Operators select the interfaces where HoneyMesh runs and choose Test, Enforce, or Lockdown mode. Check driver and interface compatibility during deployment.
You can attach or detach protection without restarting services.
Flexible Operating Modes
Test Mode
Watch everything and block nothing. Ideal for initial deployment and visibility-first rollout.
Enforce Mode
Automatic kernel-level blocking based on what HoneyMesh observes in real traffic.
Lockdown Mode
Heightened deception and stricter response when conditions turn hostile.
Built for Real Operations
The dashboard is designed for real operators: clean metrics, straightforward controls, and direct access to the threat stream without bloated menus or unnecessary complexity.
If something looks off, you can jump in immediately, inspect what is happening, and take action without working through layers of abstraction first.
Exchange Discovery In The App
HoneyMesh keeps the Exchange lightweight. It helps admins discover other networks, review cluster IDs, and opt in to receive attack intelligence, while actual mesh trust and enforcement still stay under local control.
