Deception and honeypots

What it is

Decoys that no legitimate user has any reason to touch: fake servers, fake admin accounts, planted credentials, cloud keys and documents that raise an alarm the moment they are used. Because normal work never trips them, an alert almost always means a real intruder. Honeypots on the internet also show which new vulnerabilities attackers are exploiting, often before an advisory is out.

How to value it

Detection tools struggle with attackers who use valid accounts and built-in admin tools, because that looks like normal work. A decoy turns this around: touching it is suspicious by definition, so its alerts are rare, trustworthy and early, while the attacker is still exploring. Deception is cheap to start with, small teams can run it, and it complements EDR and monitoring rather than replacing them.

Questions to ask a vendor

1. 1What kinds of decoys does it offer: servers, accounts, credentials, cloud keys, documents? How realistic are they?
2. 2How are decoys kept believable as our environment changes, without manual work?
3. 3How do alerts reach our SOC or SIEM, and what does a typical false positive look like?
4. 4Could an attacker recognise or abuse the decoys, and how is the platform itself protected?

Risk

Intruders moving through the network undetected after the first break-in.

Control

Decoy systems, accounts and credentials across the network, identity systems and cloud, alerting the SOC.

Owner

Security operations lead.

Measure

Share of network segments and cloud accounts covered by decoys, and time from a decoy being touched to response.

A starting point: set the owner and measure to fit your organisation.