Abstract: The present disclosure provides a systems, methods, and computer-readable media for distributed cybersecurity data collection and traffic masking. According to some aspects, a system includes a server and multiple logical groups of node devices associated with respective characteristics. The characteristics may be related to different geographical or geopolitical locations, different scheduled operations, or the like. A first node device of a first logical group may execute a data collection agent based on first parameter values corresponding to characteristics of the logical first group to communicate first masked traffic to a network target to obtain first cybersecurity data. A second node device of a second logical group may execute the data collection agent based on second parameter values corresponding to characteristics of the second logical group to communicate second masked traffic to the network target to obtain second cybersecurity data.