Design, examples and proof

01 · SURFACE DESIGN BY MISSION

Start with the question, then select the Surface.

Surface composition follows a small set of inputs: the risk to observe, the exposure context, geography and sector relevance, the target and service profile, the required engagement depth, containment policy, retention and access requirements, and the available output path.

Typical questions a Surface is designed around:

  • Who is validating access against an exposed appliance profile in this region?
  • What does an operator do after obtaining a shell?
  • Which credentials, tools or payloads are being carried into a selected target profile?
  • Does an internal non-public target receive discovery or lateral interaction?
Scoping is a managed design process with OHIIHO, supported by deployment patterns and templates.
02 · EXAMPLE SURFACE PATTERNS

Composition follows the mission, not a fixed package.

Contact-focused Surface

Selected exposure, one or more Contact Points, an evidence and Finding pipeline, and available SOC delivery.

Optimizes for — economical coverage, preventive signal, authentication and protocol intelligence, managed-deception entry.

Deep-engagement Surface

Selected exposure, a Live Host, deeper session and artifact capture, analyst inspection and workflow delivery.

Optimizes for — post-access behavior, tooling and file capture, deeper CTI and detection-engineering use.

Hybrid Surface

Contact Points for breadth, one or more Live Hosts for depth, and a shared evidence and operations context.

Optimizes for — balancing cost and interaction depth, MSSP or mature-SOC use, broader mission coverage.

Non-public detection Surface

Authorized non-public placement, apparent or protocol-aware targets, and high-confidence interaction signal.

Optimizes for — discovery and lateral-interaction detection where supported.

Qualified
These are design patterns, not fixed public packages or SKUs. No exact target count, price or availability promise appears without current commercial confirmation.
Boundaries, separation & responsibility
How a Surface stays separate from production — and who owns what — lives on the Trust page
Engagement runs on controlled targets, non-inline and separate from production assets, with outbound activity controlled at infrastructure level. The OHIIHO / customer responsibility split, the containment and data-handling model, and the current public limits — Live Host and Contact Point engagement, pull-based Console, MCP and API delivery (STIX 2.1 over TAXII 2.1 available by engagement), and no universal-target-type or self-verifying-evidence claim — are set out on the Trust page: production separation, responsibilities and what HIIH does not claim.
03 · EVIDENCE FROM RESEARCH

What the Surfaces have already revealed.

Engagement
Credible synthetic context
Observed — adversaries actively checking whether a target is a controlled environment before trusting it, captured target-side. Supporting material — the inspection behavior itself, timing and the checks performed. Outcome — evidence that credibility matters and that the inspection behavior is itself informative.
The Honeypot-Detection Arms Race · 2026-06 Read the research →
Engagement
Live Host deep interaction
Observed — a Go ransomware-worm executing inside a controlled target. Supporting material — session records, files and tooling recovered during the engagement. Outcome — behavioral analysis plus detection and hunting content.
Inside Sorry-worm: anatomy of a Go ransomware-worm hybrid · 2026-05 Read the research →
Access
Contact Point / access-validation signal
Observed — residential-sourced credential-validation activity, probing SSH across multiple regions, captured target-side. Supporting material — authentication sequences, client characteristics, timing and infrastructure patterns. Outcome — indicators and detection context for credential-validation behavior distinct from broad scanning.
Residential Broadband Botnet Uses AsyncSSH to Validate Credentials Across Four Regions · 2026-06 Read the research →

OHIIHO Research is the editorial research function of the same organization. Its credibility comes from primary observation, explicit evidence classes and restraint. Explore evidence from Research ↗