The most dangerous credential is the one you don't know has been stolen. For security teams, the window between a password appearing on a dark web forum and an attacker logging into a corporate VPN is a race against an invisible clock. Paris-based MokN is building traps to turn that race into a controlled ambush.
Its core product, Baits, creates decoy authentication portals that are indistinguishable from a company's real VPN, webmail, or single sign-on pages. When attackers attempt to use stolen credentials against these fake systems, MokN captures the attempt in real time, alerting defenders and providing the compromised credentials for immediate revocation. The company calls this approach "active identity recovery," positioning it as a step beyond passive monitoring [PERPLEXITY SONAR PRO BRIEF].
The technical wedge
MokN's bet is that detection must happen before exploitation. Traditional security tools might alert after a suspicious login or block an IP after an attack begins. Baits aims to intercept the attack during the credential validation phase, a moment when the attacker believes they are probing a real asset.
The service is delivered as a SaaS platform, with decoy environments hosted on MokN's cloud to avoid changes to a customer's existing infrastructure [PR Times, October 2026]. The company claims a first deployment can be live in three minutes [MokN, retrieved 2026]. Once active, the system integrates with security orchestration platforms like SIEM and SOAR tools, forwarding detailed event data including usernames, passwords attempted, and source IP addresses [Sekoia Documentation, retrieved 2026].
Traction and a landmark round
MokN has moved quickly from concept to commercial deployment. As of May 2026, the company reported protecting more than 1 million users across more than 35 enterprise and mid-market customers in sectors like finance, retail, and healthcare [Vestbee, May 2026] [BusinessCloud, May 2026]. This traction helped secure a $15 million Series A round led by GV, the venture arm affiliated with Alphabet, in May 2026 [SecurityWeek, May 2026]. The round brought MokN's total disclosed funding to approximately $18 million and marked GV's first investment in a French startup [EU-Startups, May 2026].
| Round | Date | Amount | Lead Investor |
|---|---|---|---|
| Seed | October 2025 | $2.8 million | Moonfire [Tech Funding News, October 2025] |
| Series A | May 2026 | $15 million | GV [SecurityWeek, May 2026] |
Notably, the Series A included participation from Datadog, a signal of potential strategic alignment with a major observability platform [Tech.eu, May 2026]. The company had 18 employees as of 2026 [PitchBook, retrieved 2026].
Founders from the SOC frontline
The founding team built MokN from direct experience managing security operations centers (SOCs). CEO Gautier Bugeon previously built and managed the SOC for Eramet, a French mining multinational, where he encountered the operational grind of responding to credential-based breaches [SVTR, retrieved 2026]. Co-founder Antoine Coudoux brings over a decade of experience designing SOCs and leading penetration testing teams [linkedin.com, retrieved 2026]. CTO Alexis Georges and Lead Developer Adrien Casteleiro also have cybersecurity backgrounds from Eramet [Alexis Georges LinkedIn, retrieved 2026] [Adrien C. LinkedIn, retrieved 2026].
This background shapes the product's focus on reducing analyst fatigue. "Baits filters noise and alerts only when valid credentials are used against systems," the company states, aiming to cut through the alert overload that plagues modern SOCs [MokN, retrieved 2026].
The competitive landscape
MokN operates in the deception technology market, competing with established players like Thinkst Canary and Acalvio, as well as newer entrants like Tracebit. Its specific wedge is external, credential-focused decoys, whereas some competitors offer broader internal network deception. The participation of a strategic investor like Datadog could become a differentiator, offering a path to integration within a broader security and observability workflow.
The company's early growth suggests it has found product-market fit, but scaling a security product requires navigating a crowded market with well-funded incumbents. Enterprise sales cycles are long, and the value proposition must clearly demonstrate a return on investment beyond what existing endpoint detection and identity management tools provide.
What could go wrong at scale
Deception technology is not a new concept, and its effectiveness hinges on realism and maintenance. If decoy portals are easily fingerprintable by sophisticated attackers, the entire premise fails. MokN must continuously update its deception templates to stay ahead of adversary reconnaissance techniques.
Operationally, the platform's utility depends on smooth integration. Security teams will not adopt a tool that creates more manual work. The promised integrations with SIEM and SOAR platforms must be robust and reliable out of the box. Furthermore, as the customer base grows, managing thousands of unique decoy instances without performance degradation or configuration drift becomes a significant engineering challenge.
The $15 million war chest provides a long runway, but the road ahead is about execution. MokN must prove its platform can operate reliably at the scale of a global Fortune 500 company, where a missed alert or a false positive carries real consequences. If it can, it has a chance to define a new standard for preemptive credential defense.
Sources
- [BusinessCloud, May 2026] MokN raises $15M Series A to grow identity theft protection platform | https://tech.eu/2026/05/29/mokn-raises-15m-series-a-to-grow-identity-theft-protection-platform
- [EU-Startups, May 2026] MokN raises €12.9 million to combat credential theft as GV makes its first investment in a French startup | https://www.eu-startups.com/2026/05/mokn-raises-e12-9-million-to-combat-credential-theft-as-gv-makes-its-first-investment-in-a-french-startup/
- [Gautier Bugeon LinkedIn, retrieved 2026] CEO profile | https://linkedin.com/in/gautierbugeon
- [MokN, retrieved 2026] The smartest way to end credential threats | https://www.mokn.io/
- [PERPLEXITY SONAR PRO BRIEF] Product and market overview
- [PitchBook, retrieved 2026] Company information | https://app.dealroom.co/companies/mokn_io
- [PR Times, October 2026] MokN Baits service description | https://prtimes.jp/main/html/rd/p/000000001.000001234.html
- [Sekoia Documentation, retrieved 2026] MokN integration guide | https://docs.sekoia.io/cti/connectors/mokn/
- [SecurityWeek, May 2026] MokN Raises $15 Million for Phish-Back Platform | https://www.securityweek.com/mokn-raises-15-million-for-phish-back-platform/
- [SVTR, retrieved 2026] Founder background article | https://svtr.fr/article/gautier-bugeon-mokn
- [Tech Funding News, October 2025] MokN raises €2.6M to outsmart credential theft | https://techfundingnews.com/mokn-raises-2-6m-to-outsmart-credential-theft/
- [Vestbee, May 2026] MokN raises $15M Series A led by GV to expand active identity recovery platform | https://vestbee.com/insights/articles/mok-n-raises-15-m