Evidence is not identity
IP addresses, fingerprints, automation traits, and graph proximity can increase confidence; none of them proves who a person is.
One event plane
From the first decoy touch to a reviewable outcome.
HNPT joins deception evidence with network, browser-automation, velocity, and identity context—then keeps every response scoped, expiring, and explainable.
What the platform is designed to deliver
Each capability carries an explicit delivery state. We do not present a roadmap item as a deployed control.
- Signal intake
Tenant-scoped observations from decoys, endpoints, edge controls, and approved integrations enter one typed event plane.
Contract available - Correlation and discovery
Portable PostgreSQL and CockroachDB records preserve observations, correlations, discoveries, evidence, reviews, and outcomes.
Contract available - Session timeline
A replay-oriented view joins decoy interactions and bounded artifacts without putting attacker-controlled bodies into telemetry labels.
In development - Analyst workbench
Customer and organization views will explain why a case exists, what is leased, when it expires, and who may release it.
In development - Automated response policy
Typed state transitions can propose challenges and quarantine leases; irreversible punishment always requires a separate policy decision.
Roadmap
Effects stay at the boundary.
Pure correlation and policy decisions produce typed commands. Network, database, edge, and quarantine executors apply them idempotently and record the result.
Outcomes are durable
Every proposal, lease, executor attempt, review, release, and outcome remains queryable and portable across PostgreSQL and CockroachDB.
Build with us
Start with a bounded, observable pilot.
Define what may be observed, what a quarantine can affect, how it expires, and who reviews the evidence before connecting a production system.