Manage your moving target.
Every endpoint becomes a sensor, a decoy field, and a kernel-level attribution engine — rotating minute to minute so reconnaissance fails on every surface. The AMTD Portal is where you watch the fleet work.
Already a PacketViper customer? Sign in. New here? Talk to us about a license pack.
Static defenses get mapped. Yours won't.
Every breach starts with reconnaissance. Forty years of static defense has made mapping free, fast, and accurate. AMTD breaks that asymmetry.
Reconnaissance is free
Conventional firewalls, EDR, and honeypots all share one weakness: they sit still. An attacker who maps you Monday is still right on Friday.
Detection comes too late
Industry mean-time-to-detect for sophisticated intrusions is measured in months. By then the attacker has the map, the credentials, and the path.
The endpoint was the gap
Network-layer AMTD has solved the wire. But until now, the workstation always presented the same ports — and attribution stopped at IP and port, not process and user.
Single pane. Every agent. Every probe.
Agent-Enhanced AMTD turns each endpoint into a moving target. The portal turns the fleet into a single pane of glass.
Live agent fleet
Group endpoints by location, role, or any custom dimension. See online/offline state, decoys active, probes captured — at a glance.
Kernel-level attribution
Every captured probe ships with the process, user, and executable path that opened it. No more "an IP did something" — you know which binary on which host ran by which user.
Centralized rotation policy
Set rotation cadence, decoy profile sets, and federation rules once — the portal pushes them to the fleet. Every endpoint stays a moving target without per-host configuration.
REST API for SIEM & SOAR
Bulk telemetry submission, OpenAPI-documented, idempotent on retry, rate-limited per agent. Ship events to Splunk, Sentinel, Chronicle — or pull them yourself.
AMTD in production. Measured, not marketed.
From actual customer deployments — not lab benchmarks.
From install to attribution — in three steps.
Deploy the agent
Install the lightweight Windows or Linux agent. It enrolls with a one-shot token, registers with the portal, and starts surveying its host's port surface.
Decoys rotate, sensors fire
The agent binds rotating decoys on free ports — the surface changes minute to minute. Every probe gets captured with kernel-level process attribution.
Watch and act
Telemetry streams to your portal. Group, filter, contain — surgically, per host, per process. No subnet bans. No collateral damage.
Ready to make reconnaissance fail?
Sign in to manage an existing fleet, or talk to us about a deployment that fits your environment.