MokN Raises $15 Million to Catch Credentials MFA Misses

MokN raised $15 million in Series A funding on May 29, 2026, to grow an identity theft protection platform that traps stolen logins before attackers replay them. GV led the round, with Datadog, Moonfire, OVNI Capital, and angels in the syndicate, and the dollar figure is about €12.9 million.

The Paris company is selling a blunt lesson the last decade of security spend kept postponing. Passwords still leak, MFA still gets skipped, and dark web dumps still arrive after someone has already tried the keys.

Stolen Sessions Walk Past the MFA Prompt

Verizon’s 2026 Data Breach Investigations Report, built from more than 22,000 confirmed breaches, shows credential abuse fell to 13% as the first way in, down from 22% in the prior edition. Exploitation of vulnerabilities now leads initial access at 31%.

That drop is easy to misread. Verizon added pretexting to its initial-access list, and without that change the credential share would have been 16%. Across the whole attack, stolen credentials still show up in 39% of breaches, tied with exploits inside the System Intrusion pattern that carries most ransomware.

THE BREACH MATH BEHIND STOLEN LOGINS

Among ransomware victims who had that prior leak, half saw it within 95 days of the attack. Twenty-seven percent of ransomware victims had no linked infostealer or credential event in the prior year, which is how the 73% figure is built. Small organizations in that set saw a median of seven credential leak events a year. Larger ones saw about 20.

Session theft is the piece MFA was never built to stop. SpyCloud’s 2026 Identity Exposure Report recaptured 8.6 billion stolen session cookies from underground sources for 2025, alongside 13.2 million infostealer infections that exposed 642.4 million credentials, about 50 per infection. Forty percent of those infections hit machines that already ran EDR or antivirus. A cookie from an authenticated browser is a bearer token. Import it, and the login prompt, and the second factor, never fire.

VPN access is still the product attackers want to buy. Verizon’s look at initial access brokers found 44% of offerings were VPN connections, which is the same door MokN chose to fake first.

What the $15 Million Has to Cover

Baits, the first product, is a password trap. The raise is being spent on the next surface, because a reset does nothing if the attacker already holds the session.

WHERE THE SERIES A IS MEANT TO GO

• Cookie recovery: Upcoming products target stolen browser cookies that let an attacker skip the login.
• Hijacked sessions: Compromised sessions are on the same roadmap, the live tokens MFA never sees.
• Customer accounts: A separate line is planned for consumer and customer logins, not only staff identity.
• New offices: The company is building out France and the United States and opening in the United Kingdom, with leadership already split between Paris and New York.
• Category build: R&D spend is aimed at a multi-product stack it calls Active Identity Recovery, sold as a standard rather than a point tool.

Chief executive and co-founder Gautier Bugeon said the first product proved the method and that it now has to cover every form of identity, not only the passwords that still dominate security slide decks. Asia is in test alongside the UK. The Series A brings total funding to $18 million after a €2.6 million seed on October 3, 2025.

Fake VPN Portals With Real Certificates

MokN’s homepage calls the method “phishing as a defense.” Baits are decoy VPN and webmail portals dressed with the customer’s domains and certificates so they sit on the public perimeter like the real thing. Attackers who have stolen a login scan the company’s exposed assets and try the keys. The bait answers “login failed.” Behind that page, MokN checks the pair against the customer’s own authentication systems and, if it is valid, fires a critical alert so the password can be reset in minutes.

The rapid adoption by major companies and the results achieved with our first solution have confirmed one thing: this approach must go further. Today, we are laying the groundwork for Active Identity Recovery by extending proactive recovery to all forms of identity, with the ambition of making it a new global standard for identity protection.

Gautier Bugeon, CEO and co-founder of MokN

The company says most stolen credentials never appear on the dark web, so a feed of leaked dumps is a lagging indicator. Off-the-shelf baits mimic SSL VPN and webmail, the two doors attackers try first after a phish or an infostealer hit. Custom baits copy a specific login page or a high-value user group. Deployment is a certificate upload and a DNS change, live in under 3 minutes, with no change to the customer’s own infrastructure. Alerts are supposed to fire only on validated credentials, which is the pitch to tired SOC queues.

A CISO at a multi-billion-dollar company, quoted on MokN’s site without a name, said the team knew it was being targeted and had no direct proof until baits intercepted freshly stolen credentials before any public exposure, which then became a board-level talking point.

Four Client Files the Dark Web Missed

The product page walks through four unnamed deployments. Each one is a case where the useful signal showed up on a fake door, not in a leak database.

WHAT THE DECOYS CAUGHT

The retail file is the dark web argument in miniature. If VIP passwords are being tested and they are not in public dumps, someone is sitting on a private set or waiting. The manufacturing file is the lag: months between the first try on a bait and the same secrets showing up where monitors look. The 75,000-person file is worse, because the spraying campaign ran off-network so internal defenses never saw it, and the bait traffic was what confirmed the directory theft.

The company site currently lists 960,000+ users protected and more than 300 compromised credentials that were unknown from the dark web. Combined annual revenue of the organizations it protects, it says, exceeds $480 billion. It keeps client logos off the page on purpose.

The Trap Started on a French SOC Floor

Bugeon has said he was a SOC manager at a large French group when a tightly aimed phish still got through, even though the company had the usual stack. His working idea was simple: if the network had a fake front door, the attacker would try it and hand over the stolen login in the process. He later told interviewers the company started with €5,000.

He founded MokN in 2023 with Antoine Coudoux, Alexis Georges, and Adrien Casteleiro. By the October 2025 seed it claimed more than 500,000 users protected and more than €1 million in annual recurring revenue, with Moonfire leading and OVNI Capital in the round. At the May 2026 Series A the company said it had 35 customers, including CAC 40 groups. Bugeon has described himself as a former SOC manager who built the firm because compromised identities stayed a blind spot even when every other tool was green.

FROM A €5,000 START TO A HOUSTON PITCH

1. 2023: Bugeon, Coudoux, Georges, and Casteleiro found MokN in Paris after a targeted phish on Bugeon’s then-employer.
2. October 3, 2025: The company closes a €2.6 million seed led by Moonfire, with OVNI Capital in the round, and says it already has more than €1 million in ARR.
3. May 29, 2026: GV leads a $15 million Series A with Datadog joining; total funding reaches $18 million.
4. September 15, 2026: MokN takes the Launch Pad stage in Houston as one of five finalists.

Luna Schmid, a partner at GV, said Baits uses highly realistic decoys to trigger immediate, automated recovery and that the firm believes the approach will change how organizations stop credential theft before it grows. Datadog did not publish a separate rationale for its check. GV’s appearance is still the headline in France, because it is the first time GV backed a French startup.

Houston Hears the Pitch on September 15

The U.S. push is no longer a slide. MokN listed Blue Team Con in Chicago for September 10 to 13, 2026, and CYBR.SEC.CON in Houston for September 15 to 16. Organizers named it a Launch Pad finalist with Above Security, Astelia, Singulr AI, and VisionHeight. The live pitch is set for September 15 at 2:45 p.m. in Ballroom B at the George R. Brown Convention Center, in front of a panel that mixes CISO, venture, marketing, and sales judges.

Five emerging cybersecurity companies have made it through months of screening and preparation. Now, only the live test remains.

Meet the 2026 #CYBRSECCON Launch Pad finalists:
> Above Security
> Astelia
> Singulr AI
> MokN
> VisionHeight

Launch Pad is designed to answer a… pic.twitter.com/fmmysTkrQh

— CYBR.SEC.Events (@CybrSecEvents) September 4, 2026

Launch Pad sits inside an innovator track written for startups at $5 million ARR or less, still privately held, still Series A or earlier, still valued under $50 million. That is the bracket MokN still occupies after the GV round. The money is real. The cookie and session products are not on the price list yet. The Houston test is whether CISOs will buy a fake door now, and wait for the rest of the platform, after years of being told MFA and a dark web feed were enough.

Frequently Asked Questions

How Long Does a MokN Bait Take to Deploy?

MokN says a bait can go live in under 3 minutes from its SaaS console: pick a profile, upload a certificate, and point DNS, with no change to the customer’s own servers. Off-the-shelf profiles cover SSL VPN and webmail, and custom baits are built when a company wants a specific login page copied.

Are MokN Baits Visible to Employees and Partners?

The company says baits are not indexed, not linked from normal sites, and not reachable through ordinary browsing, so staff and vendors should never see them. Only someone scanning and probing the external perimeter is meant to find the fake portals.

How Do Baits Differ From Internal Honeypots?

Internal honeypots sit inside the network and try to catch an attacker who is already in, often in a hurry. Baits sit on the public internet, where attackers have time to fingerprint a page and walk away if it feels fake, which is why MokN spends months copying the behavior of real VPN and webmail stacks and then filters brute-force noise so only validated logins alert.

What Is MokN Lantern Used For?

Lantern is MokN’s map of internet-facing assets, sold as a way to see which login pages and services are actually exposed before choosing where to plant baits. The company says baits still work without a full perimeter inventory, and that they work better when Lantern has already listed the doors attackers will try.