Cybersecurity glossary
What is a Honeypot?
Learn what a honeypot is, how decoy systems attract and study attackers, the difference between low and high interaction designs, and how to run honeypots without creating extra risk.
Definition
A honeypot is a decoy system, service, or environment that has no legitimate production purpose—so any interaction is treated as suspicious—used to detect attackers, delay them, and collect intelligence on their tools and techniques.
Why a door nobody should open is a great alarm
Production systems have legitimate users, so “someone connected” is not enough. A honeypot has no business role. That emptiness is the signal: scanners, stolen-credential testers, and worms reveal themselves by showing up.
Deception does not replace EDR or identity monitoring. It adds tripwires in places attackers expect to find treasure.
Honeypot shapes
Service decoys
Fake SSH, RDP, databases, or industrial protocols that log banners, credentials, and payloads.
Host and file decoys
A workstation or share that looks like finance data, with canary files inside.
Credential and cloud decoys
Bogus VPN portals or cloud consoles that capture stuffing against identities that must never work in production.
Honeynets
Several decoys routed together so you can watch attempted lateral movement in a cage.
Running deception without becoming the incident
Place with intent
Internal decoys near crown-jewel segments beat a random VM on the guest Wi-Fi.
Isolate aggressively
No path to real identity stores, production data, or outbound spam. Assume compromise of the pot.
Make it believable enough
Empty default Linux is ignored. A slightly messy hostname and fake documents get touched.
Instrument everything
Full packet or process capture on the decoy; alerts on auth success, file open, and new processes.
Feed intel, not noise
Internet scans become research. Internal interaction becomes IR.
Interaction level trade-offs
| Level | You learn | You accept |
|---|---|---|
| Low interaction | Scanner IPs, attempted creds, malware droppers at the door | Limited post-exploit TTPs; easier for attackers to fingerprint |
| Medium / emulated | Richer protocol abuse without a full OS | Emulation bugs; maintenance of fake stacks |
| High interaction | Real implants, privilege escalation, C2 behavior | Escape risk, legal issues, malware handling burden |
- Document that the system has zero legitimate users; any use is hostile or a misconfiguration.
- Segment honeypots so a breakout cannot reach production identity or data.
- Never reuse production credentials, hashes, or customer data as “realism.”
- Alert on internal decoy use at high severity; treat internet background fire separately.
- Handle captured malware in a dedicated sandbox with legal guidance.
- Rotate and refresh decoys so they do not become known-dead inventory.
- Map observed techniques into ATT&CK and detection engineering backlogs.
- Get legal and privacy review before exposing decoys to the public internet.
The practical takeaway
A honeypot is a system whose only job is to be touched by the wrong people. Isolate it like a lab, alert like a crown jewel when it is used from inside, and mine it for TTPs—without giving attackers a stepping stone into the real estate.
Related security terms
Canary Token
Lightweight tripwires that complement full decoy systems.
Threat Intelligence
Honeypots are a first-party collection source for TTPs and IOCs.
Indicator of Compromise (IOC)
Artifacts harvested from honeypot interactions, used with expiry.
Anomaly Detection
Production baselines still matter; honeypots are high-signal supplements.
Security Operations Center (SOC)
Should receive honeypot alerts as high-fidelity, not as noisy scans.
Frequently asked questions
What is a honeypot in simple terms?
It is a fake system left where attackers might touch it. Because real users should never need it, any login, scan, or file drop is a strong clue that someone is poking around.
How is a honeypot different from a canary token?
A canary is usually a small planted artifact (a fake AWS key, a unique URL). A honeypot is a service or host that can interact, capture malware, and waste attacker time.
What is low versus high interaction?
Low-interaction emulates protocols enough to log probes. High-interaction offers a real or richly emulated system so you see post-exploitation—at higher operational and legal risk.
Is it legal to run a honeypot?
It depends on jurisdiction, where it is placed, and what you capture. Internal decoys on your own network are the usual starting point. Get legal review before internet-facing malware collection.
Can a honeypot become a pivot point?
Yes if it is poorly isolated. High-interaction pots must be segmented, monitored, and unable to reach production identities or data.
Should every scan of a honeypot wake the SOC?
Internet-facing SSH brute force is background noise. Internal honeypot authentication or process execution on a decoy file server should page someone.
What is a honeynet?
A network of honeypots designed to look like a believable environment, used to study lateral movement rather than a single fake daemon.
References
Explore authoritative guidance and frameworks related to honeypot.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.