Honeypot

How it works

A honeypot is instrumented end to end: every connection, request, authentication attempt and executed command is logged and raises an alert. Unlike an IDS or antivirus, which must separate malicious activity from a large volume of legitimate traffic, a honeypot carries no normal traffic at all. The detection logic is consequently binary and robust: interaction means the presence of an actor who should not be there, whether an external attacker, internal lateral movement or automated reconnaissance.

To be reached, a honeypot must be discovered by the adversary. It is therefore exposed in the areas attackers naturally explore, and clues are sometimes planted to lead them in:

• Breadcrumbs: stored credentials, configuration entries, network shares or command-history artifacts that quietly point toward the decoy.
• Honeytokens scattered across real assets, acting as portable bait that fires an alert the moment they are used.
• Realistic exposed services (SSH, RDP, SMB, databases, APIs) with credible banners and behavior to sustain the illusion.
• Placement aligned with likely attack paths, from the DMZ through the internal network to sensitive segments.

Types and network placement

Honeypots are traditionally classified by their level of interaction. A low-interaction honeypot emulates only the surface of a service: it answers a handful of requests, captures the first actions and carries little risk, but offers limited observational depth. A high-interaction honeypot exposes a real operating system or application, capturing the attacker's full behavior and tooling at the cost of a far greater compromise risk to be managed. The choice is a trade-off between intelligence richness and exposure.

Placement determines the value of the signal. At the perimeter or in the DMZ, a honeypot records scans and opportunistic probing from the internet. Inside the network, among production assets, it becomes a lateral-movement detector: an attacker already inside who maps the domain will eventually probe the decoy. The honeypot belongs to a broader family of deception lures alongside the decoy, the canary token and the honeytoken, which together cover files, credentials, services and entire hosts.

Detection value, intelligence and risks

The primary value of a honeypot is early, reliable detection: it often alerts before real damage occurs, in places where perimeter tools are blind. It also yields first-hand intelligence: source addresses, tested credentials, deployed tooling, and observed tactics and techniques, all feeding incident response and threat hunting. The concept dates back to foundational work in the 1990s, popularized by Lance Spitzner and the Honeynet Project, and remains a pillar of modern cyber-deception strategies.

The main risk lies in isolation. A poorly contained high-interaction honeypot can be hijacked by the attacker to pivot toward real systems. Strict network segmentation, continuous monitoring and outbound containment rules are therefore essential. A decoy that is too generic or badly maintained also risks being fingerprinted as fake, losing its credibility against a sophisticated adversary.