An unknown device and a suspicious device are different.
Unknown-device protection asks whether a device meets your trust policy. Deception asks whether activity reaches a decoy that should not be part of ordinary work. A previously authorized device can still generate a threat signal.
Use both ideas in the evaluation. Confirm that a new, untrusted device receives the intended restriction, then test how suspicious activity from an already connected device is handled.
Restrict devices that do not meet Auto Trust Policy.
EasyNAC discovers and profiles connected devices. Auto Trust Policy uses the selected conditions, including available AD and supported XDR information, to determine appropriate access. Devices that fail to meet the configured trust criteria receive restricted access.
ARP-based enforcement brings a restricted device’s traffic through EasyNAC for the configured access control list. A captive portal can provide an approval or remediation path. No new switch 802.1X authentication rollout is required for this agentless approach.
Use decoys as another detection signal.
Built-in deception introduces decoy assets to reveal interactions that warrant investigation. The OT whitepaper and product documentation describe using these signals with alerts and configured quarantine actions.
A decoy interaction is a signal to examine, not a complete explanation of the incident. Decide which events should alert the team and which should trigger restriction. Test the trigger and the resulting access change with an approved test device.
Read the deception whitepaper → · Watch the deception demonstration →
Connect security alerts to network response.
Automated Threat Response can use configured alerts from other security systems. The compatibility guide describes email, syslog and API integration options. EasyNAC then applies the selected access response to the identified device.
Validate device identification, the alert rule and the permitted traffic after restriction. For a critical device, the response may need to emphasize alerting and controlled intervention rather than the same quarantine action used for a test laptop.
Prove the response and recovery.
- Connect an unknown test device and check its access to protected resources.
- Generate an approved deception or integrated-alert test.
- Confirm the correct device, policy action and event record.
- Verify that authorized work continues through required paths.
- Resolve the test condition and confirm the intended restoration procedure.
Keep detection, access response and investigation responsibilities clear. NAC can help contain access on covered networks; it does not replace endpoint investigation, patching or recovery planning.
See how EasyNAC fits your network.
Use the standalone Evaluation Kit for practical tests, a deployment checklist and an editable scorecard. Bring your network questions to the EasyNAC team.