CounterCraft

CounterCraft builds a cyber deception platform that deploys synthetic, realistic-looking digital twins of an organization’s actual network — decoy credentials, fake documents, breadcrumb services — to lure attackers into an environment security teams control and observe. Unlike simple honeypots, the platform is designed to run automated, scalable deception campaigns across many assets at once and capture detailed telemetry on attacker tools and techniques once they engage with a decoy, turning detection into a source of threat intelligence rather than just an alert.

Founded in 2015 and headquartered in Donostia-San Sebastián in Spain’s Basque Country, the company has raised roughly $8-9 million across multiple rounds, most recently led by Adara Ventures with participation from eCAPITAL and Elewit, and counts In-Q-Tel — the CIA-affiliated strategic investor that only backs technology it has separately vetted for U.S. government use — among its investors. That relationship, along with customers described as spanning more than 20 Fortune 500 companies plus government and law enforcement agencies, gives CounterCraft a credible foothold in higher-security-conscious sectors.

Deception technology remains a smaller, more specialized category than mainstream detection tools like EDR or SIEM, and CounterCraft competes with a handful of other dedicated deception vendors as well as broader XDR platforms that have added lightweight decoy features, meaning its relevance depends on organizations valuing deception as a distinct detection layer rather than a checkbox feature.