Know who’s casing
your perimeter.

Attackers probe between pentests, not during them. Sentinel decoys record who touches your perimeter — block reviewed sources at Cloudflare.

Open AISECSet up Sentinel
ReconnaissanceMapping your exposed paths
Exploit probesTrying known attack patterns
Repeat sourcesThe ones who keep coming back
Sentinel

Every hit, on record

  • Source and request
  • Target and timing
  • Repeated activity
Block with CloudflareAfter review and setup
No legitimate user touches a decoy. Detects activity on active decoys, not every application request.

Live in minutes.
DNS untouched.

Canary decoys run on an AISEC-managed hostname. Your production traffic never moves, and nothing sits in its path.

Compare plans

  1. Add a canary

    Create a decoy in your project’s Sentinel page — one click, nothing to deploy.

    Check

    Its hostname appears in the deployment.

  2. Activate protection

    Arm the deployment and link its hostname from a location you control.

    Check

    Verify setup shows what is active or needs attention.

  3. Check the feed

    Use Test fire and look for the labeled event.

    Check

    This tests the feed, not public reachability or blocking.

See it first.
Stop it when ready.

Sentinel never blocks on its own. You review the evidence, then push hostile sources to a Cloudflare block rule.

Review in AISEC

Only confirmed or repeated hostile sources from your own project make the list.

  • Test events are excluded.
  • Other customers’ observations are excluded.

Block in Cloudflare

Connect a scoped token, a dedicated IP list and a blocking rule.

Verify the rule in Cloudflare.

A list update alone does not block traffic. Each approved push replaces the dedicated list.

Running a pentest? Pause Sentinel first.

Your own test traffic looks hostile by design. Keep it out of the threat feed and the blocklist.

  1. Before the run

    Notify your team. Pause the project’s deployments and review existing edge blocks.

  2. During the run

    Keep Sentinel paused for that project.

  3. After the run

    Restore protection and run Verify setup.

Pausing Sentinel does not remove existing Cloudflare blocks.

They probe daily. Now you’ll know.

Open AISEC

Sentinel requires a supported workspace plan. It is not included in Single Pentest. Compare plans