Why first contact matters more than alert volume.

The queue is the risk.

Security teams already have alert volume. Attackers count on that volume because the real signal can drown inside normal triage pressure.

The buyer problem is decision speed. A CISO may already have endpoint telemetry, SIEM correlation, vulnerability data, and managed detection reports, but still lack a clean way to separate possible events from attacker behaviour that deserves immediate action.

A decoy changes the evidence standard. It has no legitimate business reason to be touched, so interaction is not another statistical anomaly. It is contact that can be tested against the team's existing triage and escalation process.

What changes for leadership.

Senior stakeholders do not need another dashboard of possible events. They need confidence that the organisation can spot attacker behaviour early enough to act, and that the signal can travel through a real operating model.

That is why the Treacle i-Mirage pilot is framed around first contact, attacker interaction, and an executive read-out rather than broad tooling replacement.

What a pilot should measure.

A scoped pilot should measure where decoys can sit, what attacker-interaction evidence is created, who receives it, and how existing SOC or incident-response workflows use that evidence.

The useful output is not a generic demo. It is a short read-out of placement, signal quality, operational response, integration needs, and whether the environment justifies a wider deployment conversation.