What Became of Illusive Networks' EIC Accelerator Cyber Deception

Most cyberattacks do not end at the first computer the attacker breaks into. To reach the data worth stealing, intruders hop from machine to machine using credentials they find along the way. Illusive Networks, a Tel Aviv company founded in 2014 by the cybersecurity company builder Team8 and Ofer Israeli, built software that removes those credentials and plants fake ones in their place, so that an intruder who uses one gives himself away. In the EIC SME Instrument Phase 2 round of 5 June 2019, the European Commission selected its project CYBER-PDR, "Disempowering Cyber-Attackers", for a grant of €2,472,750 towards a €3,532,500 plan to take the product into the European market, according to CORDIS and the Commission's list of selected companies, which names Illusive as the project's only beneficiary.

Twelve months after the project ended, the company no longer existed as an independent business. The US security company Proofpoint, owned by the private equity firm Thoma Bravo, announced on 12 December 2022 that it would buy Illusive and said on 28 December 2022 that the deal had closed. Its products are still on sale under the Proofpoint name.

Where Illusive Stands Now

The old company website, illusivenetworks.com, now redirects to a Proofpoint page titled "Illusive is Now Proofpoint", which describes the product as "Proofpoint Identity Threat Defense, previously Illusive". Proofpoint still sells it as its identity threat detection and response line, advertising "75+ decoy types" deployed with "no agents, sensors, or changes to your systems". The Israeli legal entity still exists: North Data's copy of the Israeli company register lists an annual report filed on 24 May 2026 and gives its address as Proofpoint's Innovation Center in Tel Aviv. That status could not be checked against a second source, as the Israeli Corporations Authority's own database is not openly searchable.

The European subsidiary that the EIC grant helped to set up is being wound down. Illusive Networks Germany GmbH, registered with the Munich court and based in Frankfurt, went into liquidation in June 2025, according to North Data.

The price was not disclosed. The Times of Israel cited Hebrew press reports of $100 million to $150 million; Calcalist later put it at "around $100 million". The Times of Israel put Illusive's total funding at $54 million. Proofpoint's announcement, reprinted by Thoma Bravo, said the deal was expected to close by January 2023; Proofpoint's own blog reported it closed in December 2022.

The Technology: Traps on Every Endpoint

Conventional deception products put honeypots, fake servers, on the network and wait for an intruder to stumble into them. Illusive put its deceptions on every real endpoint, server and network device instead: fake credentials, connections and files that look like what an attacker searches for, as TechCrunch described it at launch. Any use of a fake credential triggers an alert and starts a forensic report. In 2018, according to Wikipedia, it added Attack Surface Manager, which finds and removes real credentials and pathways left on machines that attackers could use to move on.

By the time of the sale the two products were called Spotlight, which scans Active Directory, privileged access tools and endpoints for exposed identities, and Shadow, the deception layer, which Proofpoint describes as agentless. Proofpoint's announcement claimed that Shadow was "undefeated in over 150 red team exercises", a company claim that has not been independently tested in any public source found for this article. The industry has since relabelled the field "identity threat detection and response", and Illusive's pitch changed with it, from catching intruders to protecting privileged identities.

What CYBER-PDR Promised, and What CORDIS Shows

CYBER-PDR ran from 1 January 2020 to 31 December 2021, and the grant agreement was signed on 24 February 2020. It was not a research project: the product was already sold, and the money was for market entry. The proposal promised a strategic alliance with the Vienna deception company CyberTrap, 960 demonstrations and 160 proofs of concept with European banks, insurers and Fortune 500 companies, a sales pipeline in seven countries, a German office, certifications, and "potential annual revenues of €87M by 2022". The closing report raises that figure to €90 million.

The final periodic report covers the engineering in detail and the sales not at all. It says a decoy module built on CyberTrap's product, the Attack Surface Manager upgrade and new cloud capabilities were all completed in June 2020, that the website was rebuilt and that ISO 27001 was audited. A SOC 1 report was dropped in favour of SOC 2 and GDPR work. It gives no number of demos, pilots, customers or European revenue. The CORDIS results article says the platform "has been successfully launched on the EU market", without naming a European customer.

1. Decoy built with CyberTrapDeliveredCompleted June 2020, per the CORDIS report; no public announcement by either company was found.
2. Attack surface and cloud featuresDeliveredBoth completed June 2020; sold today as Proofpoint Spotlight and Shadow.
3. German officeDeliveredThe report says February 2020; North Data shows registration in November 2020. In liquidation since June 2025.
4. CertificationsPartlyISO 27001 audited in June 2020; SOC 1 not completed.
5. 960 demos and 160 proofs of concept in EuropeNot reportedNo figures in the report or any company statement.
6. €87M annual revenue by 2022Not reportedNo revenue was ever published.

On the product side the project did what it said, on time. On the commercial side, which was the stated purpose of the grant, nothing can be checked. For scale, the €87 million of annual revenue projected for 2022 compares with a reported price of $100 million to $150 million for the whole company that same year.

What Illusive Achieved Since the Award

Before the grant, Illusive had raised a $5 million first round led by Team8 in June 2015, according to Team8; a $22 million Series B led by NEA that October, reported by TechCrunch; a $3 million extension in May 2016, according to Globes; and an undisclosed investment from Microsoft Ventures in January 2017, which TechCrunch said took its total to "something more than $30 million".

In October 2020, nine months into the EIC project, it closed a $24 million Series B1 with Spring Lake Equity Partners and its existing backers, according to Globes and Help Net Security. The company said new annual recurring revenue had grown 228% over 12 months and that it had become the only deception vendor with Microsoft "co-sell ready" status. It hired a chief revenue officer and a chief marketing officer. Those growth numbers came from the company and were never backed by published accounts.

The EIC Fund and the Grant's Effect

CYBER-PDR was a grant-only award, and Illusive Networks does not appear among the roughly 315 companies on the EIC Fund's list of invested companies. No EU equity was involved. How much the grant changed Illusive's course is hard to judge. It was a well-funded, venture-backed company with about 100 staff when the money arrived, and the €2.47 million was a fraction of the $54 million it raised from investors. What the grant demonstrably paid for is engineering that is still on sale and a German subsidiary that is now being closed.

Why Europe Should Care

Detecting intruders who have already got inside a network is the kind of capability the EU wants spread across critical sectors. The NIS2 Directive, in force since January 2023, requires medium and large organisations in critical sectors to take "appropriate cybersecurity risk-management measures" and to report significant incidents, and the EU Cybersecurity Strategy ties the EU's "technological sovereignty" to the resilience of connected services.

The strategic-autonomy case for this grant is weaker. The beneficiary was an Israeli company backed largely by US investors, and the technology now belongs to a US company owned by a US private equity firm. The one European element, the CyberTrap decoy, came from an Austrian partner. The grant helped a non-EU vendor sell into Europe; it did not build a European supplier.

The Verdict

Illusive Networks and Proofpoint have not been asked for comment for this article. It is based entirely on public records, company statements and EU project data, linked throughout.