The Defender Has a Vote
If reconnaissance in force is becoming the AI mode of attack – learning at machine speed from the environment it encounters – the implications for cyber defense are clear.
The OpenAI/Hugging Face incident makes the case. An autonomous agent made roughly 17,600 attacker actions, more than a third discovery-related: finding paths, exploiting weaknesses, harvesting credentials and moving through infrastructure without a human directing each step.
The Cloud Security Alliance's post-mortem reached an important conclusion: “Agents find a way.”
Its recommendations include stronger runtime containment and isolation, behavioral detection, and the use of deception environments and honeypots to expose autonomous-agent behavior.
There is a larger strategic idea running through those recommendations:
The defender has a vote, too.
If an AI attacker learns by interacting with the environment, why should we give it an honest environment from which to learn?
Why should every IP address, service, route and response faithfully tell the attacker something useful about the real network?
Instead, make reconnaissance encounter things that should never legitimately be touched.
Make some paths lead nowhere. Make hostile interaction reveal the attacker rather than the network. Make discovery consequential.
On D-Day, the Allies dropped hundreds of dummy paratroopers, “Ruperts,” behind German lines, accompanied by devices that simulated the sounds of combat. German units reacted to airborne landings that did not exist, diverting forces from the real fight.
The paratroopers were fake. The German response was real.
Cybersecurity continues its preoccupation with trying to observe what the adversary does and determine what it means.
Ridgeback is designed to reverse that relationship: shape what the adversary encounters, rather than simply observe what it does.
Its synthetic Phantom resources occupy unused address space within production subnets, putting deception directly in the path of reconnaissance. The attacker encounters a network shaped by the defender—not just a map of real assets.
Ridgeback can deny unauthorized access at first contact and isolate the affected host to prevent lateral movement. Discovery becomes an opportunity to deceive, disrupt and contain—not merely generate another alert.
The adversary gets a vote. With Ridgeback, the defender casts one at contact.
Deceive what it discovers. Disrupt where it can move. Deny its next step.