What Honeypots Do and Why They Work
A honeypot is a deliberately vulnerable or attractive-looking system placed in a network to lure attackers. It appears to be a legitimate target â a database server, a file share, a domain controller â but contains no real data and serves no production function. Because legitimate users have no reason to interact with a honeypot, any connection attempt, login, or access is almost certainly malicious activity. This makes honeypots remarkably low-noise detection systems â unlike SIEM alerts that generate thousands of events daily, a honeypot alert is nearly always genuine.
Honeypots serve three purposes: early detection â attackers probing the network will discover and interact with honeypots, generating alerts before they reach real systems; threat intelligence â high-interaction honeypots let researchers observe attacker tools, techniques, and procedures (TTPs) in a controlled environment without risking real data; and attacker deception â honeypots waste attacker time and resources on false targets, slowing their progress toward real assets.
Low-Interaction vs High-Interaction Honeypots
Honeynet â A Network of Honeypots
A honeynet is a network of interconnected honeypots that creates a realistic-looking environment â multiple servers with different roles (web server, database, file server, domain controller) that an attacker can move between laterally. Honeynets are used primarily for threat intelligence research. By observing how attackers move through the honeynet, what tools they use, and what they're ultimately after, security researchers gain detailed insight into current attack campaigns and techniques. The Honeynet Project is the leading open-source honeypot research organisation and publishes threat intelligence derived from global honeynet deployments.
Canary Tokens and Honeyfiles
A honeyfile (or canary file) is a file placed in a file share or database that looks valuable â a file named passwords.xlsx or customer_data.csv â but contains no real data. When anyone opens or downloads the file, an alert is triggered. Any access to a honeyfile is almost certainly unauthorised â a legitimate user doesn't need to open a file called passwords.xlsx that isn't in any documented workflow. Honeyfiles are highly effective for detecting insider threats and attackers who have already established a foothold and are searching for data to exfiltrate.
Canary tokens extend this concept beyond files. A canary token can be embedded in a document (a unique URL that phones home when the document is opened), a web page, an email, a database record, or even source code. Each token is unique â when triggered, the alert identifies exactly which token was accessed, from what IP address, at what time. Tools like canarytokens.org make it trivial to deploy canary tokens across an environment. Detecting the activation of a canary token in a shared drive is a reliable indicator that an insider is searching for sensitive data or an attacker has already compromised a user account.
Honeypot Types by Purpose
Beyond the low/high interaction distinction, honeypots are categorised by what they're designed to detect. Research honeypots are deployed by security researchers and threat intelligence teams to study attacker behaviour, capture malware samples, and understand current attack campaigns. They're typically high-interaction, heavily monitored, and isolated from production networks. The data they collect â attack tools, techniques, command-and-control infrastructure â feeds threat intelligence reports that help the broader security community. Production honeypots are deployed within or alongside production networks to detect attacks against the organisation specifically. They're lower interaction, focused on early detection rather than intelligence gathering, and trigger immediate alerts when accessed.
Database honeypots are fake database servers containing fabricated but realistic-looking data â customer records, financial data, user credentials â placed on the internal network. An attacker who compromises the network and searches for databases will find the honeypot first. Any connection to the honeypot database is an immediate high-fidelity alert. Credential honeypots are fake user accounts (often named something like "admin-backup" or "svc-backup") with realistic-looking credentials. If anyone uses these credentials â they appear in legitimate places like fake IT documentation â it means someone has accessed those documents and extracted the credentials, indicating a breach.
Deception Technology at Scale
Modern deception technology platforms (Attivo Networks, Illusive Networks, Cymulate) automate honeypot deployment at scale across the entire network. Rather than a few manually configured honeypots, these platforms deploy decoy systems, accounts, credentials, and files across every subnet â making deception pervasive. An attacker performing lateral movement in such an environment has a high probability of interacting with a decoy before reaching real assets. The decoy interaction triggers an immediate, high-confidence alert â far more actionable than SIEM correlations that might have dozens of legitimate-looking events mixed in. Deception technology represents an evolution of the honeypot concept from individual systems to an organisation-wide detection layer.
Honeypot Legal and Ethical Considerations
Honeypots operate in a legal grey area that the Security+ exam occasionally touches. Deploying a honeypot on your own network to detect intruders is legal and unambiguous. The concern arises with entrapment â can an organisation be held liable for luring attackers into committing crimes against the honeypot? In practice, honeypots are considered legal as long as they don't actively solicit attacks (they're passive â attackers discover them through their own scanning) and the organisation doesn't manufacture the criminal intent. The attacker chose to probe and attack the honeypot; the organisation merely made a target available. Always consult legal counsel before deploying high-interaction honeypots that might be used as evidence in prosecution.
Honeypot Placement Strategy
Honeypot placement determines what activity they detect. A honeypot on the DMZ detects inbound attacks from the internet. A honeypot on the internal network detects lateral movement from an already-compromised internal host or a malicious insider â any internal system that connects to an internal honeypot is exhibiting suspicious behaviour. Placing honeypots in each VLAN segment provides early detection of lateral movement as attackers hop between segments. The key principle: legitimate traffic never touches a honeypot, so any interaction is an alert worth investigating immediately.