What Is a Honeypot?
A honeypot is a decoy system built to attract and study attackers. It has no legitimate purpose, so nobody should ever interact with it — which means any interaction is, by definition, suspicious. That property gives honeypots something most detection lacks: an extremely low false-positive rate. A hit on a honeypot is almost always a real intrusion.
Why are honeypots such high-signal detectors?#
Because their value comes from being useless. A SIEM rule sifting real traffic must constantly separate malicious from benign; a honeypot has no benign traffic to filter. A connection to a decoy database that no application knows about is not a false positive waiting to be triaged — it is an attacker, already inside, revealing themselves.
Honeypots also gather threat intelligence: the techniques, tools, and IOCs attackers use, observed safely.
Low vs high interaction#
| Low-interaction | High-interaction | |
|---|---|---|
| What it is | Emulated service | Real system |
| Intelligence value | Basic | Rich |
| Risk | Low | Higher (must be isolated) |
| Effort | Low | High |
The related concept of a honeytoken — a fake credential, file, or record that should never be used — applies the same idea to data: any use of it signals compromise.
Honeypots are the detection side of deception technology. More at the Network Security hub.
Frequently asked questions#
What is a honeypot?
A honeypot is a decoy system or service deliberately deployed to attract attackers, with no legitimate business purpose. Because no real user should ever touch it, any interaction is inherently suspicious — making honeypots a high-signal, low-false-positive way to detect intrusions and study attacker behavior.
What is the difference between a low- and high-interaction honeypot?
A low-interaction honeypot emulates only enough of a service to lure and log attackers, which is safe and simple but easy to fingerprint. A high-interaction honeypot is a real system that lets attackers do more, yielding richer intelligence but carrying the risk that it could be used as a foothold if not carefully isolated.