Sharpen your skills with interactive cyber security training In-Person or Live Online. Learn more.


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Hunting with Cyber Deception and Incident Response Automation

  • Wednesday, January 18, 2017 at 1:00 PM EST (2017-01-18 18:00:00 UTC)
  • Gadi Evron


  • Cymmetria

You can now attend the webcast using your mobile device!



In this webcast, we will explore how to effectively use cyber deception to hunt advanced threat actors and other threats. We will discuss the use of incident response automation, and specifically how deception orchestration can be used to deploy successful deception campaigns.

Starting from the initial reconnaissance phase, cyber deception technology takes advantage of the critical stages through which all attackers must pass (infiltration and lateral movement) and creates a controlled path for them to follow. The most effective cyber deception solutions allow the organization to create deception stories and realistic environments for hunting cyber attackers.

Deception orchestration takes this to the next level by integrating incident response automation into the existing deception platform.

We will also introduce Cymmetria's community edition of their deception solution, MazeRunner, freely available for download. Webcast attendees will come away with an understanding of what cyber deception is, how to effectively use it to hunt threats, how MazeRunner can be effectively deployed, as well as how deception orchestration integrates with incident response automation.

Speaker Bio

Gadi Evron

Gadi is the Founder and CEO of Cymmetria. Prior to founding Cymmetria, he was VP of Cybersecurity Strategy for Kaspersky Lab, led PwC's Cyber Security Center of Excellence (located in Israel), and was CISO of the Israeli government's Internet operations. Gadi is widely recognized for his work in Internet security operation and global incident response, and is considered the first botnet expert. He is currently Chairman of the Israeli CERT.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.