Cloud-based deception technology with granular scoring for breach detection

A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of:

• monitoring activity associated with a plurality of decoys hosted in a decoy cloud environment for a customer, wherein the decoy cloud environment is separate from a real environment of the customer, and wherein the activity is between one or more fake assets on user devices of users associated with the customer and corresponding decoys in the decoy cloud environment;
• generating a dynamic risk score configured to modulate in direct accord with the activity based on monitoring various steps taken between a fake asset and a decoy, wherein the monitoring is configured to track progressive stages of interaction between the fake assets and the corresponding decoys, and wherein each step taken by a user with the one or more fake assets, including initiating or upgrading a network connection, sending data, executing a decoy file, or using a decoy credential, increases the dynamic risk score in real time;
• and
• detecting a breach of the customer based on the dynamic risk score exceeding a threshold, wherein any interaction with a fake asset is inherently treated as malicious such that the risk score begins from a zero-activity baseline and increases exclusively upon fake asset interactions.