A honeypot is a deliberately exposed decoy system, service or file that has no legitimate business use. Because nobody should touch it, any interaction is suspicious, and the activity can be logged and studied.
Why it matters
Real traffic to production systems is mixed with noise, so spotting an intruder is hard. A honeypot flips that: every connection is worth attention. Teams use them to detect scanning and internal movement early, to collect attacker techniques and indicators, and to distract automated tools from real assets. A related idea is a honeytoken, such as a fake credential that triggers an alert when used.
Example
An organisation places a fake file server on an internal network segment with an attractive name. No employee has a reason to open it. When a compromised workstation tries to browse it, the honeypot records the source address and sends an alert, giving the team an early warning.
Common mistakes
- Placing a honeypot on the same network as production without isolation, so it becomes a stepping stone.
- Making it so unrealistic that automated tools recognise and skip it.
- Deploying one and never monitoring it, which defeats the purpose.
- Treating it as a replacement for patching and access control.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.