What Is a Honeypot?
A honeypot is a security decoy that detects attackers by monitoring access to a fake system or resource.
The Honeypot Concept
A honeypot works on the principle of guaranteed anomaly: any interaction with a honeypot is suspicious because legitimate users and systems should have no reason to access a system that appears to provide value but actually provides none. Unlike production systems that generate constant legitimate traffic that must be analyzed for anomalies, honeypots generate a clean signal — every access attempt is a potential threat indicator worth investigating.
Honeypot Types
Low-interaction honeypots simulate specific services — an SSH service, a web server, a database port — and capture connection attempts without providing any functional interaction. They are easy to deploy and maintain but provide limited insight into attacker techniques because there is nothing for attackers to interact with. High-interaction honeypots are real systems configured to appear valuable but isolated from production. They allow attackers to interact fully, capturing the attacker's techniques, tools, and objectives in detail. High-interaction honeypots provide richer intelligence but carry higher deployment risk because they provide a real system the attacker could potentially use as a pivot point.
Honeytokens and Honeycredentials
Honeytokens extend the deception concept beyond network services to data and credentials. A honeytoken is a believable but fake data artifact — an AWS API key that is valid but generates an alert when used, a document named 'Acquisition Targets 2026' that generates an alert when opened, a database record with a distinctive fake social security number that generates an alert if it appears in a breach database. Honeytokens are valuable for detecting data exfiltration and insider threats: an attacker or insider who takes a honeytoken and uses it reveals their presence and, in some cases, their location.
Deploying Honeypots Effectively
Effective honeypot deployment requires thoughtful placement and monitoring. A honeypot in a network segment no legitimate user ever visits generates alerts on any connection. A honeypot in a segment with regular legitimate traffic requires more careful tuning to distinguish attacker access from legitimate mistakes. The monitoring infrastructure that captures and alerts on honeypot interactions must be operational before honeypots are deployed — a honeypot nobody is watching provides no value.
Related Reading
What is a honeypot in cybersecurity?
A honeypot is a deliberately deployed decoy system, account, or piece of data designed to attract attackers and gather intelligence about their behavior, techniques, and intent. Honeypots have no legitimate business function — they exist solely to be probed, attacked, and observed. The deception serves two purposes: detecting attacker activity that has bypassed other controls, and gathering threat intelligence about specific techniques being used against the organization.
How is a honeypot different from a honeynet or honeytoken?
A honeypot is typically a single decoy system. A honeynet is a network of multiple honeypots designed to simulate a more complete environment that an attacker would explore. A honeytoken (or canary token) is a piece of decoy data — a fake credential, a fake document, a fake API key — that triggers an alert when accessed or used. All three are deception-based detection mechanisms operating at different scales.
What attacker behavior do honeypots detect?
Honeypots are most useful for detecting: lateral movement (an attacker probing for additional systems), credential abuse (stolen credentials being tested against fake systems), reconnaissance (attackers mapping the environment), and insider threats (employees accessing systems they should not be touching). Because legitimate users have no business interacting with honeypot systems, any activity against them is a high-confidence indicator of unauthorized behavior — producing far lower false positive rates than most detection mechanisms.
What honeypot tools and platforms are available?
Open-source honeypot tools include T-Pot (multi-honeypot platform), Cowrie (SSH/Telnet honeypot), Dionaea (malware capture), Honeyd (network honeypot), and various specialized honeypots for specific protocols. Commercial deception platforms include Illusive Networks, Attivo Networks (part of SentinelOne), and TrapX Security. Canary tokens for honeytokens are available free from Thinkst Canary and as commercial products from multiple vendors.
Are honeypots legal to deploy?
Within an organization's own environment, yes — deploying decoys to detect unauthorized activity is universally permitted. Active deception that extends beyond the organization (luring attackers from elsewhere, conducting offensive operations from honeypot infrastructure) carries legal complications and should be conducted only under legal review. Most organizations deploy honeypots as passive detection mechanisms rather than active deception campaigns, which keeps the legal complexity minimal.
What's the operational maintenance burden of honeypots?
Deception infrastructure requires ongoing tuning to remain effective. Attackers eventually recognize unpatched honeypots that have not seen credential rotation or system changes for extended periods; the honeypot must look like a real system to be effective. Mature deception programs treat honeypots like real infrastructure for maintenance purposes — patching, credential rotation, log rotation — to preserve the deception value.
What's the first step toward deploying honeypots?
Start with honeytokens — fake credentials and documents placed in locations attackers might find them (admin shares, backup directories, source code repositories). Honeytokens require minimal operational maintenance and produce high-confidence alerts when triggered. After honeytoken deployment matures, consider full honeypot deployment for specific detection use cases (lateral movement detection in critical network segments, insider threat detection in sensitive document repositories).
Real-World Example: Honeytoken Detects Data Exfiltration in Progress
A Cloudskope client deployed honeytokens — fake AWS access keys — alongside real credentials in development repositories. Three months after deployment, an alert fired: a honeytoken had been used to attempt AWS API calls from an IP address in Eastern Europe. Investigation revealed that a developer's GitHub account had been compromised through credential stuffing, giving an attacker access to private repositories containing both the honeytoken and real credentials. The honeytoken alert enabled containment before any real credentials were used. The attacker's IP and timing provided forensic evidence that would not have been available without the honeytoken.
The average time from a honeypot's internet exposure to its first connection attempt — demonstrating the continuous automated scanning that attackers use to discover exposed services and the detection value of monitoring those interactions.