Platform 03 · Active Defence
Cyber Deception
SHOOL.Adaptive Cyber Deception Platform
- Cyber Deception
- Digital Twin
- AI Threat Intel
- Honeypots
- On-Premise
- 06
- Modules
- 09
- Capabilities
- 00
- Foreign deps
01Overview
AI-driven deception and digital-twin honeynets for classified defence networks.
Why SHOOL exists.
The problem
Conventional security stacks are passive and reactive. Static honeypots suffer fidelity drift, scripted responses that fail under skilled interrogation, unstructured logs, and weak correlation across multi-vector campaigns — leaving defence networks blind to sophisticated, persistent adversaries.
The SHOOL answer
SHOOL keeps a digital-twin honeynet continuously synchronised with the real defended network, uses multi-agent LLMs for session-adaptive deception responses, and automatically turns attacker interactions into structured, shareable threat intelligence — without external cloud dependency.
Asset → decoys → trapped intruder
SHOOL in action.
01 · Module 01
Digital Twin Network
Read-only twin of production topology and services — high fidelity for adversaries, zero write-back risk to live systems.
02Key capabilities
9 capabilities
What it does in the field.
- 01
Continuously synchronised Digital Twin Network (read-only, zero production impact)
- 02
Multi-agent LLM Threat Intelligence Engine with on-premise GPU inference
- 03
Hybrid deterministic + LLM deception response architecture
- 04
Session-specific honeytoken attribution that survives post-disconnection
- 05
Automated STIX 2.1 / TAXII export into CERT and partner ecosystems
- 06
Self-updating anomaly detection ensemble with safety-gated model updates
- 07
Hardware-isolated honeypot mesh across forward, garrison, and HQ tiers
- 08
Central Command Dashboard for campaign visualisation and operator control
- 09
Air-gap and classified enclave deployment profiles
03Platform modules
6 subsystems
Inside SHOOL.
The major subsystems that make up SHOOL — each deployable inside your perimeter.
Digital Twin Network
Read-only twin of production topology and services — high fidelity for adversaries, zero write-back risk to live systems.
Honeypot Mesh
Hardware-isolated decoys spanning forward, garrison, and headquarters tiers with consistent identity and service personas.
Agentic LLM Deception Engine
Session-adaptive conversational and protocol responses that keep skilled attackers engaged while harvesting TTPs.
Honeytoken Attribution
Unique tokens and breadcrumbs that attribute activity even after the adversary leaves the honeynet.
Threat Intelligence Factory
Converts raw interactions into structured STIX 2.1 / TAXII packages for CERT sharing and internal hunting.
Central Command Dashboard
Unified operator view for campaigns, engagement quality, model safety gates, and escalation workflows.
04Deployment
How it deploys.
- Fully on-premise / air-gapped classified enclaves
- GPU nodes for on-premise LLM inference
- Hardware-isolated honeypot VLANs / appliances
- Optional STIX/TAXII egress only through approved CERT gateways
- Integrates with existing SIEM / SOC without requiring foreign SaaS
05Mission outcomes
What changes.
- Earlier detection of sophisticated and persistent adversaries
- Higher-fidelity deception that survives skilled interrogation
- Actionable, structured threat intelligence for CERT sharing
- Reduced blind spots versus passive, reactive controls alone
- Sovereignty preserved — no foreign deception SaaS dependency
06Built for
Who runs SHOOL.
- Defence Networks
- Classified & Air-Gapped Environments
- Critical Infrastructure Operators
- National CERT Ecosystems
- Strategic SOC / Cyber Command Units
Explore the stack
Other platforms.
Deploy SHOOL
See SHOOL inside your perimeter.
We'll walk your team through an on-premise SHOOL deployment profile shaped to your network, classification level, and mission.