Defense

Honeypot

A deliberately exposed decoy system whose only purpose is to be attacked, so the attempt can be observed.

Definition

In cyber security, a honeypot is a decoy system, service or piece of data deliberately made reachable so that any interaction with it indicates unauthorised activity, since it has no legitimate business use.

The power of a honeypot is its signal-to-noise ratio. Production systems generate constant legitimate traffic, so distinguishing an attacker is hard. A honeypot has no legitimate users at all, which means any connection to it is suspicious by definition. That makes it one of the highest-confidence detection sources available.

Honeypots vary in depth. Low-interaction honeypots emulate just enough of a service to log an attempt, are safe and cheap, and are what most organisations should deploy. High-interaction honeypots are real systems that let an attacker operate, yielding much richer intelligence but carrying real risk if not isolated. Honeytokens are the lightest form: a fake credential, file or database record that alerts when used.

Honeytokens deserve particular attention because they are cheap and effective. A fake administrator credential planted in a password manager, or a decoy customer record in a database, will never be touched legitimately. If it is used, you know both that someone is inside and roughly where they have reached.

At a glance

Type
Detection technique
Also known as
Decoy system, honeytoken, canary token

How it works

  1. 1

    Deploy a decoy that looks valuable but has no legitimate purpose

  2. 2

    Isolate it so it cannot be used as a route into real systems

  3. 3

    Instrument it so every interaction is logged in detail

  4. 4

    Alert on any interaction at all, since there is no benign baseline to filter out

  5. 5

    Analyse what the attacker attempted, and use it to improve real detections

Key points

  • Any interaction with a honeypot is suspicious, because it has no legitimate users
  • Low-interaction honeypots are safe and sufficient for most organisations
  • High-interaction honeypots give richer intelligence but must be strictly isolated
  • Honeytokens are the cheapest and often the highest-value variant
  • A honeypot detects intruders already inside; it does not prevent entry

Best practices

  • Isolate thoroughly, since a poorly contained high-interaction honeypot becomes a real foothold
  • Alert on every interaction rather than sampling, as volume should be near zero
  • Plant honeytokens in places an attacker would look, such as password managers and file shares
  • Feed honeypot alerts into your SIEM so they are correlated with other activity
  • Document that the system is a decoy, so future staff do not mistake it for production

Real-world example

An Indonesian bank plants a fake administrator credential in its password vault and a decoy customer record in a reporting database. Four months later the honeytoken credential is used. No production alert had fired, but the token proved an intruder was inside and had reached the vault, which redirected the entire investigation.

How Claro helps

Honeypots detect an intruder who is already inside. Most intruders get in through a person, so the two controls sit at different points on the same timeline. Claro reduces the number of successful entries; a honeypot catches the ones that get through. Neither substitutes for the other.

Frequently asked questions

What is a honeypot in cyber security?

A decoy system, service or data item deliberately made reachable so that any interaction with it signals unauthorised activity. Because it has no legitimate business use, it produces very few false positives.

What is the difference between a honeypot and a honeytoken?

A honeypot is a decoy system or service. A honeytoken is a single decoy artefact, such as a fake credential, file or database record, that alerts when accessed. Honeytokens are far cheaper to deploy and often just as useful.

Is running a honeypot risky?

Low-interaction honeypots carry little risk because they only emulate a service. High-interaction honeypots are real systems and can become a genuine foothold if isolation fails, so they need strict network separation and monitoring.

Does a honeypot prevent attacks?

No. It detects activity rather than blocking it, and only once someone is already inside or probing. It complements preventive controls and awareness rather than replacing them.

Related terms

Attack Surface

The total set of points, technical and human, where an attacker could attempt to gain entry to a system or extract data, including every account, endpoint, application, exposed service, and employee.

Incident Response

The structured process an organization follows to detect, contain, investigate, and recover from a security incident.

SIEM

A platform that centralises log data from across an estate, correlates it, and raises alerts on suspicious patterns.

Credential Stuffing

An automated attack that tries usernames and passwords stolen from one data breach against many other websites, exploiting people who reuse the same password across accounts.

Reduce your human risk

Claro measures and lowers the risk these terms describe, in English and Bahasa Indonesia.

Request a demo