MokN

Cybersecurity startup using decoy systems to recover stolen credentials and prevent identity attacks.

Cover Block

Open sources

Field	Value
Company	MokN
Tagline	Cybersecurity startup using decoy systems to recover stolen credentials and prevent identity attacks.
Headquarters	Paris, France [MokN, retrieved 2026]
Founded	2023 [Gautier Bugeon LinkedIn, retrieved 2026]
Stage	Series A [SecurityWeek, May 2026]
Business model	SaaS
Industry	Security
Technology	Software (Non-AI)
Geography	Western Europe
Growth profile	Venture Scale
Founding team	Co-Founders (3+): Gautier Bugeon, Antoine Coudoux, Alexis Georges, Adrien Casteleiro [SecurityWeek, May 2026]
Funding label	$10M+
Total disclosed funding	~$18,000,000 [SecurityWeek, May 2026]

What an Investor Needs First

PUBLIC MokN is a Paris-based cybersecurity company focused on catching the use of stolen credentials through decoy login environments, and it merits investor attention because it has moved from seed financing in late 2025 to a $15 million Series A in May 2026 while reporting more than 35 customers and protection for more than 1 million users [SecurityWeek, May 2026] [Vestbee, May 2026] [EU-Startups, October 2025].

Its main product, Baits, places realistic external login pages in an organization’s exposed environment so that attacker activity against stolen credentials can be captured in real time, then pushed into security workflows through integrations with systems such as SIEM and SOAR tools [PR Times, October 2026] [Sekoia Documentation, retrieved 2026]. The practical differentiation is not generic detection, but a more active recovery motion: MokN is trying to identify compromised credentials when an attacker actually attempts to use them, rather than relying only on dark-web monitoring or post-compromise investigation [SecurityWeek, May 2026] [Tech.eu, May 2026].

The team looks strongest on security operations experience. Public profiles tie Bugeon, Georges, and Casteleiro to prior cybersecurity roles at Eramet, while Antoine Coudoux’s LinkedIn describes more than a decade designing SOCs, leading incident response, and running pentest work for international organizations [SVTR, retrieved 2026] [Alexis Georges LinkedIn, retrieved 2026] [Adrien C. LinkedIn, retrieved 2026] [LinkedIn, retrieved 2026]. On financing, the company has disclosed roughly $18 million across a €2.6 million seed round led by Moonfire in October 2025 and a $15 million Series A led by GV in May 2026, with participation from investors including OVNI Capital, Kima Ventures, Datadog, and Moonfire; the operating model is SaaS [Tech Funding News, October 2025] [SecurityWeek, May 2026] [Tech.eu, May 2026].

Over the next 12 to 18 months, the main questions are whether MokN can translate early customer count into durable enterprise penetration, broaden product adoption beyond Baits with offerings such as Lantern, and validate that claimed traction scales without a sharp rise in deployment or response complexity [Vestbee, May 2026] [MokN, retrieved 2026]. The public evidence is encouraging, but much of the operating detail still comes from company statements and fundraising coverage, so investors should treat the commercial proof points as promising rather than fully underwritten [Vestbee, May 2026] [MokN, retrieved 2026].

Partially corroborated -- Core funding, investor, and customer scale claims are supported by multiple public outlets, but several product and operating details remain company-sourced or only partially corroborated.

Taxonomy Snapshot

Axis	Value
Stage	Series A
Business Model	SaaS
Industry / Vertical	Security
Technology Type	Software (Non-AI)
Geography	Western Europe
Growth Profile	Venture Scale
Founding Team	Co-Founders (3+)
Funding	$10M+ total disclosed, approximately $18,000,000

Inside the Company

PUBLIC MokN is a Paris-based cybersecurity startup focused on credential-theft and identity-attack recovery, with a public company profile and website describing software products aimed at detecting misuse of stolen credentials [MokN, retrieved 2026] [Dealroom.co, retrieved 2026]. The company is presented as founded in 2023, and its public materials center on two products: Baits, which the company says alerts when valid credentials are used against decoy systems, and Lantern, which it describes as an external attack surface inventory and monitoring product [MokN, retrieved 2026].

The early company record is still compact, but the public timeline is clear enough to sketch the basics. MokN’s website identifies the business under the MokN name and positions the initial wedge around credential-threat response rather than broad security orchestration [MokN, retrieved 2026]. Public company databases also place the business in Paris and show venture backing disclosed by 2026, which is consistent with a young French security vendor moving from formation into commercial scaling [Dealroom.co, retrieved 2026].

A few dated milestones are visible from public company sources. The company’s website in 2026 highlights Baits and Lantern as live product surfaces, while Dealroom’s company profile reflects disclosed financing and investor participation by that point [MokN, retrieved 2026] [Dealroom.co, retrieved 2026]. On the evidence available from those sources alone, the main takeaway is straightforward: MokN appears to have moved from 2023 formation to a productized SaaS security platform with outside capital and an explicit focus on identity-driven attack recovery [MokN, retrieved 2026] [Dealroom.co, retrieved 2026].

Partially corroborated -- Confirmed by MokN website and Dealroom company profile, but this section relies on a limited set of public company sources rather than state filings or broader independent corroboration.

Under the Hood

MIXED

MokN is selling a fairly specific control, not a general security platform. Public product descriptions center on Baits, a service that places decoy login surfaces, including VPN, webmail, and authentication portals, in environments that resemble a customer’s real internet-facing estate, with the goal of capturing attacker activity when stolen credentials are tried against those decoys [Tech.eu, May 2026] [EU-Startups, October 2025] [PR Times, October 2026]. SecurityWeek described the approach as a honeypot-based "phish-back" platform, while MokN itself says Baits alerts only when valid credentials are used against those systems [SecurityWeek, May 2026] [MokN].

The mechanics are clearer than the marketing category label. According to PR Times, Baits runs in a dedicated cloud environment prepared by MokN, can be deployed without significant changes to the customer environment, and integrates with authentication infrastructure, SIEM, SOAR, and ticketing systems for alert routing and response [PR Times, October 2026]. Independent integration documentation from Sekoia says the MokN connector polls bait attempts from MokN's API and forwards normalized events, including attempt IDs, timestamps, submitted usernames and passwords, source IP addresses, and geographic context, which supports the view that the product is designed to slot into an existing SOC workflow rather than replace one [Sekoia Documentation].

MokN also publicly references a second product, Lantern, for continuous inventory of external attack surface and weakness detection, but the available evidence is thinner than it is for Baits [MokN]. That leaves the current public thesis resting on Baits as the commercial wedge: if the decoys are realistic enough to attract real adversary traffic and quiet enough to avoid analyst fatigue, the product could occupy a useful layer between credential exposure monitoring and post-compromise response; if not, the category can struggle to earn a durable budget line [Vestbee, May 2026] [Tracebit].

Partially corroborated -- Product positioning is corroborated across Tech.eu, EU-Startups, SecurityWeek, PR Times, and Sekoia documentation, but several implementation details remain company-led or partner-described rather than independently tested publicly.

Market Research

PUBLIC The market matters now because identity attacks keep moving toward valid credentials, and MokN is selling into the part of security budgets that wakes up when attackers look indistinguishable from real users [SecurityWeek, May 2026] [Vestbee, May 2026].

The available public record does not provide a named third-party TAM, SAM, or SOM for MokN’s exact category, which the company and some coverage frame as "active identity recovery" or "phish-back" rather than a standard Gartner-style segment [SecurityWeek, May 2026] [Vestbee, May 2026]. That leaves investors with an adjacent-market exercise rather than a clean sizing model. On public evidence, the more defensible read is that MokN sits at the intersection of identity threat detection and response, deception technology, external attack-surface monitoring, and broader enterprise identity security spend, with the company’s wedge aimed specifically at stolen-credential misuse on internet-facing assets [Tech.eu, May 2026] [PR Times, October 2026] [MokN, retrieved 2026].

Demand signals in the research are narrower than a conventional market map, but they are directionally consistent. Coverage repeatedly describes Baits as decoy VPN, webmail, and authentication pages that imitate a customer environment, with the goal of capturing attacker login attempts that use compromised credentials [EU-Startups, October 2025] [Tech.eu, May 2026] [IT Brief UK, June 2026]. That positioning matters because it targets a known operational gap in many security stacks: once credentials are stolen, teams often have to distinguish malicious use from legitimate authentication behavior with limited context. MokN’s reported integrations into SIEM, SOAR, and ticketing systems, plus Sekoia’s documentation showing normalized event forwarding from the MokN API, suggest the company is aligning itself with existing incident response workflows rather than asking buyers to stand up a separate control plane from scratch [PR Times, October 2026] [Sekoia Documentation].

The company’s adjacent markets are easier to identify than its standalone category. On one side sit deception and honeypot vendors, which train buyers to pay for controlled environments that expose attacker behavior. On another sit identity security and credential-protection tools, which focus on prevention, detection, or remediation around account compromise. Lantern, which MokN describes as continuous external attack-surface inventory and monitoring, also places part of the product story near external attack-surface management rather than pure deception software [MokN, retrieved 2026]. That adjacency broadens the budget conversations available to the company, but it also means MokN may need to explain when Baits is a complement to existing identity and detection tooling, and when it is expected to displace budget from incumbent controls.

Regulatory and macro forces appear favorable in a general sense, even if the sources do not tie them directly to contract wins. Large enterprises in finance, retail, and healthcare face persistent scrutiny around identity compromise, account access, incident response, and auditability, and those are precisely the verticals mentioned in public coverage of MokN’s customer footprint [BusinessCloud, May 2026]. The company’s Paris base and stated expansion into the United States and United Kingdom place it in geographies where cyber spending is comparatively mature and where identity-centric attacks remain a board-level issue [EU-Startups, October 2025] [EU-Startups, May 2026]. Still, the market evidence here is more qualitative than quantified. Public reporting shows that buyers recognize the problem, but it does not yet establish how large the budget line is for this exact product category versus adjacent identity or detection spend.

Cited market or segment framing	What the sources support	Sources
Active identity recovery	Described as MokN's positioning for recovering stolen credentials before exploitation	[SecurityWeek, May 2026], [Vestbee, May 2026]
Deception technology adjacency	Baits is described as realistic decoy VPN, webmail, and authentication portals	[Tech.eu, May 2026], [EU-Startups, October 2025], [IT Brief UK, June 2026]
Identity security adjacency	Product centers on detecting malicious use of stolen credentials and feeding response systems	[PR Times, October 2026], [Sekoia Documentation]
External attack-surface adjacency	Lantern is described as continuous external attack-surface inventory and monitoring	[MokN, retrieved 2026]

The table underscores the core issue in sizing MokN’s opportunity from public data: the problem is well defined, but the commercial category is still being assembled from adjacent security budgets. That can support a meaningful company if the pain is acute, though it usually lengthens the proof burden during enterprise sales.

Partially corroborated -- Section relies on named public sources for product positioning and market adjacency, but no independent third-party TAM or category sizing was identified.

Competition and Substitutes

Positioning

MIXED MokN sits in a narrower lane than most identity-security vendors: it is not trying to own the whole authentication stack, but to catch attackers at the moment stolen credentials are actually tested against convincing decoys on internet-facing surfaces [SecurityWeek, May 2026] [PR Times, October 2026] [Sekoia Documentation].

Company	Positioning	Stage / Funding	Notable Differentiator	Source
MokN	Active identity recovery and credential-theft detection through external bait login pages	Series A, total disclosed funding reached $18M by May 2026	Focus on decoy VPN, webmail, and authentication portals that capture real attacker login attempts and feed them into incident response tooling	[SecurityWeek, May 2026]; [Vestbee, May 2026]; [PR Times, October 2026]
Tracebit	Deception-based detection for cloud and production environments	Not established in the provided public source set	Public references tie MokN specifically to external bait pages, which suggests a more internet-facing credential-testing use case than broad internal deception claims	[ai.tracebit.com]
Thinkst Canary	Deception and honeypot-based threat detection	Not established in the provided public source set	Established category framing around deception sensors and canary assets, typically used to surface intrusions once an attacker touches planted assets	[SecurityWeek, May 2026]
Acalvio	Identity and deception security platform	Not established in the provided public source set	Broader platform framing around deception and identity defense rather than MokN's tighter phish-back workflow	[SecurityWeek, May 2026]
CounterCraft	Deception technology for attacker engagement and detection	Not established in the provided public source set	Longer-standing deception category presence, with positioning that extends beyond credential baiting alone	[SecurityWeek, May 2026]

The comparison is imperfect because public sourcing here is asymmetric. MokN's product contours are described in multiple 2026 articles and integration documents, while the competitor rows in this section are constrained to named firms surfaced in the research set rather than full company profiles with matched funding and customer disclosures. That still tells something useful: MokN is being framed in press coverage less as a generic deception vendor and more as a purpose-built credential-recovery workflow for external identity attacks [Tech.eu, May 2026] [SecurityWeek, May 2026] [Vestbee, May 2026].

The segment map breaks into three layers. Incumbents are the broader identity-security and SOC toolchain vendors that already own authentication logs, alert routing, and response workflows, even if they do not appear by name in the captured sources; MokN integrates into that existing stack rather than replacing it [PR Times, October 2026] [Sekoia Documentation]. Challengers are the deception specialists named in the research, including Thinkst Canary, Acalvio, CounterCraft, and Tracebit, each of which competes for the same security budget line when buyers evaluate whether planted assets can detect adversary behavior earlier than conventional controls [SecurityWeek, May 2026] [ai.tracebit.com]. Adjacent substitutes are dark-web monitoring, phishing-resistant identity controls, and external attack-surface monitoring tools. MokN itself gestures toward that adjacency through Lantern, which inventories external exposure, but the stronger public evidence still sits with Baits rather than a broader platform claim [MokN] [PR Times, October 2026].

MokN's clearest edge today is product focus. The company is not merely saying it detects deception hits; the public materials describe a system designed to collect attempted usernames, passwords, timestamps, IP data, and geography when an attacker uses stolen credentials against bait services, then forward those events into security operations workflows [Sekoia Documentation] [PR Times, October 2026]. That makes the wedge easier to understand for an enterprise SOC than a more abstract deception pitch. The edge is helped by founder-market fit, at least on the operations side: Gautier Bugeon previously ran SOC work at Eramet, and Antoine Coudoux's public profile points to more than a decade designing SOCs and leading incident response and pentest work [SVTR] [LinkedIn]. Still, durability is not settled. Workflow knowledge and early customer design wins can matter, but deception categories have historically been vulnerable to feature convergence once larger security vendors decide the alert quality is attractive enough to absorb [SecurityWeek, May 2026].

The main exposure is breadth. A vendor such as Thinkst Canary enters with a longer-standing brand inside deception-based detection, while Acalvio and CounterCraft suggest a wider platform canvas around deception and identity defense, at least in category perception [SecurityWeek, May 2026]. Tracebit is the more specific flank risk because public references connect MokN to external bait login pages, implying that a buyer could frame the decision as external credential testing versus broader cloud or infrastructure deception rather than a net-new category purchase [ai.tracebit.com]. MokN also does not appear to own a native identity control plane, endpoint estate, or network telemetry channel in the public record. That means it depends on integration into incumbent security stacks for downstream action, which can strengthen adoption if integrations are clean, but can also cap strategic control if the surrounding platform vendors add similar baiting or credential-validation features [PR Times, October 2026] [Sekoia Documentation].

The most plausible 18-month scenario is a split outcome between category specialists and platform owners. Winner if X: MokN, if enterprises keep treating credential theft as a discrete operational pain point and if the company can convert its reported base of more than 35 customers and more than 1 million protected users into repeatable SOC-led expansion inside regulated verticals such as finance and healthcare [Vestbee, May 2026] [BusinessCloud, May 2026]. Loser if Y: a narrower deception specialist such as Tracebit, if buyers increasingly prefer point solutions tied directly to stolen-credential recovery rather than broader but less immediate deception narratives [ai.tracebit.com] [SecurityWeek, May 2026]. The reverse scenario is also easy to see: MokN loses relative ground if the category gets reframed as one module inside larger identity or XDR platforms, because its public differentiation today rests on a sharp use case rather than on a proven multi-product moat.

Partially corroborated -- Confirmed by multiple public sources for MokN's positioning and funding, but competitor details in this section are only partially corroborated within the provided source set.

Opportunity

Upside case

PUBLIC The prize here is large if MokN can turn a narrow credential-theft product into a standard control for identity defense, because the company is already showing early signs of enterprise adoption, a repeatable product story, and investor backing that usually appears only after a security tool has found a real pain point [Vestbee, May 2026] [SecurityWeek, May 2026].

The headline opportunity is straightforward: MokN could become the default external decoy layer for stolen-credential detection and recovery across large enterprises. That is a bigger outcome than selling a point tool for phishing response. The evidence that makes it reachable, rather than merely aspirational, is modest but real. Public reporting says MokN protects more than 1 million users across more than 35 enterprise and mid-market customers as of May 2026 [Vestbee, May 2026]. Coverage also shows a product thesis that is specific enough to map to buyer workflows: Baits sets up defensive login pages in externally exposed environments, collects real-time attacker login attempts, and integrates with authentication infrastructure, SIEM, SOAR, and ticketing systems [PR Times, October 2026] [Sekoia Documentation]. That matters because security products usually compound only after they fit existing response stacks. The $15 million Series A led by GV, with participation from Datadog, Moonfire, and OVNI Capital, suggests the company has reached a level of market validation that supports a broader platform attempt [SecurityWeek, May 2026] [Tech.eu, May 2026].

The near-to-medium term paths to scale are visible, even if each still requires execution.

Scenario	What happens	Catalyst	Why it's plausible
Land-and-expand in large enterprises	MokN starts with baited login surfaces, then expands into broader identity incident response and attack surface monitoring within the same account	Large enterprise security teams adopt Baits for a single high-risk surface, then connect it into SIEM and SOAR workflows	MokN reports more than 35 enterprise and mid-market customers and more than 1 million protected users, while PR Times and Sekoia documentation show integrations into existing security operations tooling [Vestbee, May 2026] [PR Times, October 2026] [Sekoia Documentation]
Become the specialist layer for credential compromise recovery	MokN defines a distinct category around post-theft detection and recovery, rather than competing head-on with broader identity or endpoint suites	Repeated credential-theft incidents keep buyer budgets focused on recovery workflows that start after credentials are already stolen	SecurityWeek describes the company as a "phish-back" platform and reports MokN framing the category as Active Identity Recovery, which is a tighter wedge than general identity security [SecurityWeek, May 2026] [Vestbee, May 2026]
Build a channel through ecosystem integrations	MokN wins distribution by becoming an easy add-on inside incident response and security analytics environments	More integrations with SIEM, SOAR, and MSSP workflows reduce deployment friction and make the product easier to trial	Public materials say Baits can be deployed without major changes to customer environments and can integrate with SIEM, SOAR, and ticket management systems; Sekoia has already documented an integration that forwards MokN events through its platform [PR Times, October 2026] [Sekoia Documentation]

The compounding mechanism, if it appears, would likely come from deployment simplicity plus response-system integration rather than a consumer-style network effect. MokN says first deployment can happen quickly, and third-party descriptions indicate that Baits can run in a dedicated MokN cloud environment without major changes to customer systems [MokN] [PR Times, October 2026]. If that holds up in practice, the sales motion gets easier: a narrow initial installation on internet-facing login surfaces can produce attacker telemetry, that telemetry can flow into SIEM and SOAR systems, and the operational value of the product rises as more surfaces and workflows are connected [Sekoia Documentation] [PR Times, October 2026]. Lantern, the company's separate attack-surface inventory product, adds a second potential layer to the same customer relationship [MokN]. That does not yet prove a moat, but it does point to a credible flywheel where every successful deployment creates more integration depth, more response context, and a broader reason to standardize on the platform.

The size of the win is best framed as a scenario, not a forecast, because public market and M&A comparables in this exact niche are thin in the provided source set. Even so, there is a credible venture-scale outcome here if MokN becomes a system of record for external credential-compromise detection in large organizations. Public evidence already places it at more than $1 million ARR according to the CEO's LinkedIn, though that is company-linked and should be treated cautiously [Gautier Bugeon LinkedIn]. If the land-and-expand scenario plays out, and MokN grows from dozens of customers to several hundred multinational accounts with broader identity-response workflows attached, the company could plausibly support a high-value strategic or late-stage private outcome on the logic that security buyers pay premium multiples for control points that sit directly in authentication and incident response paths (scenario, not a forecast) [SecurityWeek, May 2026] [PR Times, October 2026]. The public evidence does not support a tighter valuation range than that, but it does support the core upside claim: this is not only a phishing tool if the platform broadens successfully.

Partially corroborated -- Relies on named public reporting from SecurityWeek, Vestbee, Tech.eu, PR Times, Sekoia documentation, and company materials; several important operating claims remain company-reported or single-source.

Sources