Nothreat CyberEcho

Nothreat CyberEcho is a US-patented deception technology from London-based Nothreat that uses digital twins of an organization’s services as decoys. These are working replicas of real systems (login pages, VPN portals, APIs, databases, IoT devices), not engineering simulations. Each twin mirrors the real system’s versions, responses and network position, unlike a generic honeypot.

Twins sit on unused IP addresses on a server, in the DMZ or inside a supported network switch, with no path to production. No legitimate user has reason to touch one, so any interaction counts as hostile; Nothreat reports under 1% false positives on twin alerts. Sessions are recorded from the first reconnaissance request, so an attacker can be stopped before any exploit; Nothreat calls this preemptive cybersecurity.

Indicators confirmed on twins feed Nothreat ThreatShield, a vendor-agnostic companion product that turns them into blocklists for existing firewalls (Nothreat names Cisco, Fortinet and Palo Alto Networks), so blocking needs no SOAR playbook. Opt-in Crowd Immunity, Nothreat’s shared-intelligence network, blocks an attacker confirmed at one participating customer for the others.

The main public example is ToolShell (CVE-2025-53770), the 2025 exploitation of on-premises SharePoint Server. Nothreat’s case study says SharePoint twins at a telecom customer logged reconnaissance on June 5, 2025, and that the attacker was blocked more than 40 days before Microsoft published the CVE on July 19. Eye Security later confirmed 396 compromised systems across 145 organizations in 41 countries.

CyberEcho is aimed at large organizations, including banks, telecoms and the public sector. It only sees attackers who touch a twin, so it complements patching, vulnerability management and EDR rather than replacing them. Nothreat is ISO/IEC 27001:2022 certified and holds SOC 2 Type I and HIPAA/HITECH Type 1 attestations.