Company: Deception Check
CTO: Nicholas Carroll
Website: https://deceptioncheck.ai
About Deception Check
Founded in 2026 in Maryland, Deception Check builds adaptive honeypots and honeytokens for small security teams, service providers, and organizations responsible for operational technology. The founder is a former state government CISO who built election cyber infrastructure and a statewide security operations program before starting the company.
The decoys present believable services and bait files in places where routine business activity is not expected, so an interaction is a reason to investigate rather than one more alert to triage. They record what was sent and are designed to keep that record even when an attacker clears the host. Deployment runs as software or as a sealed appliance for sites that must work offline. Deception complements patching, access control, and a named responder; it does not replace them.
As a young security company we show our work. We run an internet facing research fleet and publish findings with methods and limitations. In August we were selected as a Black Hat Startup Spotlight Finalist. In October 2026 our decoys recorded the first PHP2Shell probe about 4 hours 51 minutes before the public advisories, and connected a later PHP request to delivery infrastructure already seen over HTTP, SSH, and telnet, which lets defenders widen an investigation beyond one web alert. Our canary research found that in 100 of 121 cases the first callback came from a different address than the retrieval, and explains why that alone does not identify who or what was involved.
Pilots are under way in healthcare and the commercial mid market. Our standard is not that a decoy fires; it is that someone receives the signal, knows what to check, and keeps the evidence.
Want to find out what TechRound can do for your business?
