Attackers rarely break in loudly. They sign in, look around and wait. LurkerLock watches every machine you run, sets traps an intruder can't resist, blocks them when they bite, and keeps the record on your own server. Your security data never leaves your hands.
One agent, six jobs
Password guessing and sign-ins from new places, new accounts and admin rights, new services and scheduled tasks, Microsoft Defender alerts, and connections to addresses on public threat lists. On Linux also SSH, sudo, kernel modules, and changes to SSH keys, sudoers, cron and systemd units.
Decoy login names nobody real uses, bait files with made-up passwords, and decoy network ports. Nothing legitimate touches them, so a touch is an intruder, reported with the program and the account that did it.
The address behind a password-guessing attack, a decoy hit or a known-bad connection goes into the firewall. Your own network, your management addresses and the machine itself are never blocked, and one switch removes every block.
Every finding, every block and every decision, with what, when and who, kept on the machine and on your server. A built-in doctor checks the whole setup in one command.
Email, text message or webhook (Slack, Teams), with quiet hours and daily caps, and a plain-English summary of what happened instead of an event number.
You run the server. No cloud account, no telemetry, nothing sent to us. A single machine can even run with no server at all and keep its findings to itself.
How it works
On each Windows PC or Linux server: one installer, or one package.
Every machine on one page, named users with two-factor sign-in, alerts, and one address list that blocks everywhere.
Monitoring and traps from day one; blocking when you are ready. It starts in a dry run that only records what it would do.
The part of LurkerLock that reads what attackers control runs with restricted rights. On Windows, a separate minimal service makes firewall changes, and checks every request against your own settings first.
Your data
Most security tools send what they see to someone else's cloud. LurkerLock keeps findings, records and alerts on machines you run. The only things it fetches are the public threat lists you choose, and you can turn even those off.
Built for
LurkerLock runs on Windows and Linux today. Early access for businesses and IT providers is opening.
LurkerLock