What is Honeypot?

Honeypots range widely in fidelity. Low-interaction honeypots emulate just enough of a service, an open SSH banner, a fake login page, a decoy database listener, to log connection attempts and basic interaction without actually running the real software behind it, which makes them cheap to deploy at scale and safe since there's nothing real for an attacker to compromise. High-interaction honeypots run genuine, fully functional systems (real operating systems, real applications) inside an isolated, heavily monitored environment, letting defenders observe an attacker's full toolkit and post-exploitation behavior in detail, at the cost of more operational risk if the isolation is ever misconfigured. Honeytokens are a related, lighter-weight variant: fake credentials, API keys, or database records seeded into real systems specifically so that any attempt to use them triggers an alert, since a legitimate process never reads or authenticates with a token that was never actually issued to anyone.

Deployment patterns vary by goal. A honeypot placed on the same network segment as production servers, with a hostname and naming convention indistinguishable from a real asset, is meant to catch lateral movement: once an attacker has a foothold and starts scanning the internal network for targets, they have no way to know the domain controller-looking host they just probed doesn't actually hold anything real. A honeypot exposed to the internet alongside genuine external services is meant to catch reconnaissance and opportunistic exploitation attempts before they ever reach a production system. Research honeypots, often run by threat intelligence teams and academic groups rather than individual organizations, are deliberately left more exposed and are used to collect malware samples, observe emerging attacker tooling, and study campaign infrastructure at scale rather than to protect any specific asset.

Because a honeypot has no legitimate business purpose, any traffic to it is inherently suspicious, which is what makes honeypot alerts unusually high-fidelity compared to detections built against noisy production traffic. The tradeoff is coverage: a honeypot only catches attackers who happen to touch it, so it complements rather than replaces broader detection across the SIEM, IDS, and endpoint layers instead of substituting for them.