Frequently Asked Questions
The most common questions from buyers and security practitioners about PacketViper and preemptive network security.
What is Automated Moving Target Defense?
+
AMTD continuously shifts network characteristics like IP addresses, ports, and service banners so attackers cannot map a stable target. Unlike static defenses, it makes reconnaissance a cost rather than a free activity. PacketViper applies AMTD at the network layer, making it the only form of moving target defense that works in OT environments without touching the devices themselves.
What is the difference between preemptive security and detection-based security?
+
Detection-based security alerts you after an attacker is already in your environment. Preemptive security acts at first contact, before an attacker can complete reconnaissance or reach target systems. The difference is not just speed, it is philosophy. One assumes you will catch the attacker. The other assumes the attacker will try and makes sure they fail at the first step.
Does PacketViper require agents on endpoints?
+
No. PacketViper is completely agentless. It operates at the network layer, which means it protects every device on the network including legacy OT equipment, PLCs, and embedded systems that cannot run security software.
How does PacketViper protect OT and ICS environments?
+
PacketViper sits transparently on the network without touching the devices it protects. It monitors all traffic, deploys deceptive responders to engage and expose attackers, applies AMTD to continuously shift the attack surface, and enforces inline blocking without disrupting operations. It supports OT protocols including BACnet, DNP3, Modbus, and S7COMM.
What is inline enforcement and why does it matter?
+
Inline enforcement means the security solution sits in the actual traffic path and can block threats at wire speed. Most security tools are out-of-band, meaning they see traffic but cannot stop it without sending an alert to a separate system. Inline enforcement eliminates that gap. The test to ask any vendor: does it enforce inline, or only alert?
Can PacketViper replace our existing firewall?
+
PacketViper complements and extends what a firewall does. Firewalls start blocked and open up. PacketViper starts open, profiles what is normal, and narrows in. It sees what the firewall never told you, specifically the attempts and behaviors that happen within permitted traffic. Most customers run PacketViper alongside their existing firewall.
What is a deceptive responder?
+
A deceptive responder is a fake service that appears real to an attacker. When something unauthorized interacts with it, PacketViper captures the behavior, engages the attacker to waste their time and reveal their tools, and triggers enforcement actions. Unlike traditional honeypots, deceptive responders are purpose-built for network-layer AMTD and work at scale across IT and OT environments.
How does PacketViper handle lateral movement inside the network?
+
Once PacketViper has profiled normal network behavior, any east-west movement that falls outside that profile triggers sensors and deceptive responders. Rather than waiting for an attacker to reach a crown jewel asset, PacketViper exposes and blocks lateral movement at first contact within the environment.
What environments does PacketViper support?
+
PacketViper protects IT networks, OT/ICS/SCADA environments, hybrid IT/OT convergence zones, air-gapped networks, data centers, and critical infrastructure including energy, water, manufacturing, healthcare, and government networks.
How long does deployment take?
+
Most deployments are measured in hours, not weeks. Because PacketViper is agentless and transparent to the network, there is no endpoint rollout, no device configuration, and no operational disruption. It sees traffic from day one.
Still Have Questions?
Talk directly with someone who knows the product cold. No slides, no pressure.