What Mokn does

MokN (MokN SAS) is a Paris-based cybersecurity SaaS company founded in 2024 that sells an identity-deception platform aimed at Fortune Global 500 buyers in finance, retail, and healthcare. The company's core offering, branded "Baits," deploys decoy credentials across customer environments to detect and recover stolen identities before they are weaponized — a methodology the company terms "Active Identity Recovery" or "Phish-Back." A second product, "Lantern," provides External Attack Surface Management (EASM), and the 2026 roadmap adds stolen cookie and session token recovery to extend coverage beyond static credentials. The platform has processed over 1 billion login attempts and surfaced more than 300 compromised credentials not found on the dark web, with more than 1 million users protected across customers whose combined annual revenue exceeds $480 billion.

The business model is enterprise SaaS sold to large organizations, with revenue coming from annual contracts sized to Fortune 500 procurement norms. Customer logos are kept anonymous in public materials, but disclosed case studies reference organizations ranging from roughly 6,000 to 75,000 employees across logistics, retail, and manufacturing, alongside named industries of finance, retail, and healthcare. The company reached over €1 million in ARR within 16 months of founding and has since raised a total of approximately $18 million across a €2.6M seed (October 2025, Moonfire-led) and a $15M Series A (May 2026, GV-led, with Datadog participating) — the latter being GV's first French investment. Headcount remains small at 1–10 employees, with four co-founders (Gautier Bugeon, CEO; Antoine Coudoux, CMO; Alexis Georges, CTO; Adrien Casteleiro, Lead Developer) all bringing offensive security backgrounds.

Following the Series A, MokN is expanding geographically into the United States and United Kingdom and investing in R&D to extend the platform into session and cookie theft recovery, positioning the company as a deception-first complement to conventional identity and EASM tooling rather than a head-to-head replacement for incumbent identity vendors.

Name

Mokn

Legal name

MokN SAS

Website

https://mokn.io

Company type

Private

Founded year

2024

Operating status

Operating

Headcount range

1–10 employees

Short description

MokN is a Paris-based SaaS cybersecurity company founded in 2024 that sells a credential-deception and identity-recovery platform (Baits, plus Lantern EASM) to Fortune Global 500 enterprises in finance, retail, and healthcare.

Ownership category

akta.pro rank

Product category

Credential Deception Software

NAICS

Security Systems Services (except Locksmiths) (561621)

SIC

Finance Services (6199)

akta.pro primary industry

KYC/KYB Identity Verification & Onboarding (FSADALAA)

akta.pro secondary industries

Wallet Risk Scoring, Address Screening & Exposure Checks (FSADALAD), Credential Stuffing & Password Attack Protection (HDADALAC)

Keywords

• Credential deception platform
• Phishing detection software
• Attack surface management
• Identity threat protection
• SaaS cybersecurity platform

Headquarters

HQ city

Paris

HQ country

France

HQ region

Europe

Offices3 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. SaaS subscription (Active Identity Recovery platform): Recurring SaaS revenue from licensing the MokN platform (Baits + Lantern). The company reached over €1 million in annual recurring revenue within 16 months, indicating a subscription-based model with land-and-expand across large enterprise and mid-sized customers. No public pricing; deals are quote-based / demo-driven.
2. Professional services / PoC and onboarding: Free guided Proof of Concept in the customer's environment plus hands-on training, configuration tailoring, and recurring check-ins — supporting subscription deals and driving platform adoption.

Pricing tiers

Go-to-market motion1 record

Distribution channels2 records

Marketing channels5 records

Core offering

MokN provides a SaaS Active Identity Recovery platform that combines credential deception technology (MokN Baits / Phish-Back) with External Attack Surface Management (MokN Lantern). The platform deploys ultra-realistic, certificate-validated decoy login portals on a customer's external perimeter; when attackers test stolen credentials, MokN validates them in real time against authentication systems and triggers only confirmed, false-positive-free alerts. Lantern continuously inventories internet-exposed assets, scans all 65,535 ports, and detects newly exposed services in under 30 minutes via native AWS, Azure, and GCP connectors, with outputs feeding into the customer's SIEM/SOAR/ticketing stack.

Product overview

MokN offers a multi-product cybersecurity platform focused on Active Identity Recovery, combining credential-deception technology with external attack-surface management. The portfolio is anchored by MokN Baits, the flagship Phish-Back product that deploys realistic decoy login portals to intercept and recover stolen credentials before attackers use them, and MokN Lantern, an External Attack Surface Management (EASM) solution that maps exposed assets and detects new exposures in near real time. Together, Baits and Lantern provide layered protection: Lantern identifies exposed entry points on the external perimeter while Baits trap attackers who attempt to use stolen credentials against those assets, with both feeding alerts into the customer's SIEM, SOAR and ticketing stack.

Differentiator

Problem solved

Functional benefit

Brands

• Baits: MokN's flagship credential deception / Active Identity Recovery product line, also referred to as "Phish-Back," that deploys defensive phishing pages (decoys) to lure attackers and recover compromised credentials.
• Lantern

Products and services

• MokN Baits SaaS credential-deception / Phish-Back solution that deploys ultra-realistic, certificate-validated decoy login portals (e.g., SSL VPN, Webmail) on a customer's external perimeter to lure attackers into testing stolen credentials and capture validated, false-positive-free alerts in real time. For enterprise and mid-sized security teams (CISOs, SOC).
• MokN Lantern External Attack Surface Management (EASM) platform that builds and continuously updates a granular inventory of internet-exposed assets, scans all 65,535 ports, and detects newly exposed services (e.g., admin interfaces, weak credentials, cloud misconfigurations) in under 30 minutes via native connectors for AWS, Azure, and GCP. For enterprise and mid-sized security teams.

Quantifiable outcome

• Over €1 million in annual recurring revenue reached within 16 months
• +7 more outcomes

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration8 records

AI capability3 records

Feature7 records

Scale indicators13 records

Recent moves7 records

Expansion highlights5 records

Direct peers

• Acalvio: Enterprise deception platform offering decoy assets and Active Defense for credential and lateral-movement attacks. Directly comparable to MokN's Baits / Phish-Back category and similar enterprise SOC buyer.
• CounterCraft: Theatrical / deception-based cyber threat detection platform with decoy credentials, networks and applications. Overlaps with MokN's deception technology and enterprise security buyer.
• Thinkst Canary: Deception/honeypot solution (Canarytokens, Canary Console) widely used by enterprises to detect credential and asset abuse. Closely comparable in the deception-based detection category.
• SpyCloud: Compromised-credential and digital-identity threat intelligence platform that surfaces stolen credentials from the criminal underground. Adjacent to MokN's credential-theft detection but uses a passive data-feed model versus MokN's active deception approach.

Broad incumbents

• Microsoft Defender for Identity: Identity-based threat detection product within Microsoft Defender, used by large enterprises to detect credential-based attacks against Active Directory. Broad incumbent with overlapping credential-attack detection but bundled into the Microsoft security stack.
• CrowdStrike Falcon Identity Protection: Identity-protection and credential-theft detection within the CrowdStrike Falcon platform. A direct competitor on the credential-detection use case but typically sold as part of a much broader EDR/XDR bundle to enterprise buyers.
• SentinelOne: Endpoint security platform that has been extending into identity threat detection and response. Comparable buyer base (large enterprise CISOs) and overlapping identity-attack detection capabilities.
• Proofpoint: Large email security and phishing-defense incumbent addressing credential-theft, BEC, and account-takeover. Competes for the same enterprise security budget that MokN targets, with broader portfolio coverage.

Emerging players

• Cofense: Phishing detection and response platform focused on user-reported phishing and email-borne credential theft. Comparable phishing-defense buyer persona with partial overlap on credential-theft use cases.
• KnowBe4: Security-awareness and phishing-simulation platform aimed at reducing credential theft via user training. Adjacent solution to MokN's deception-based detection, sold into the same CISO buyer with overlapping credential-risk messaging.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• Facebookfacebook.com/61578289934052

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles4 records

Funding overview

Funding rounds2 records

Investors5 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Mokn