A honeypot is a decoy — a server, account or device deliberately set up to look attractive to attackers, instrumented to record everything they do. The concept borrows from espionage: instead of chasing intruders across your network, you leave a tempting target where every touch raises an alert. For a small business, a honeypot is less about studying attackers and more about one clean signal: anything touching the decoy is, by definition, up to no good.
TL;DR
- A honeypot is a decoy system planted to attract attackers and record what they do.
- Any interaction with a honeypot is suspicious by definition — no legitimate user should ever touch it.
- Small businesses get most of the value from cheap variants: honeypot admin accounts, fake file shares, decoy servers, canary tokens.
- Pair a honeypot with MFA, least privilege and fast patching for real intrusion detection on a small-business budget.
- Awareness training and human risk reporting are the human-side decoy: they surface the staff-side signals that technical honeypots cannot.
What a honeypot actually is
A honeypot is an isolated system with no production purpose. It has no users, serves no customers and holds no real data. That absence is the whole point: every packet, login or file access it receives is suspicious by definition. The honeypot logs everything — source address, credentials used, commands run, files touched — and raises alerts.
Security teams grade honeypots by how much they let the attacker do:
- Low-interaction honeypots simulate services and ports. Cheap, safe, and enough to detect scanning and automated attacks.
- Medium-interaction emulate more of a real system's behaviour to catch human attackers, at higher risk if not properly isolated.
- High-interaction honeypots are real systems in a sealed environment — the research-grade version, and more than a small business needs.
- Canary tokens and deception files are the lightweight cousins: a document named 'passwords.xlsx' that alerts when opened, a webhook URL in a config file that pings when touched.
Why honeypots suit small businesses
Enterprise intrusion detection needs tuning, staffing and constant signature updates. A honeypot needs isolation and one alert rule: something touched the decoy. That inversion is what makes it attractive for a ten-person business:
- Zero false positives by design. No legitimate traffic should ever reach the decoy, so any alert is worth investigating.
- Almost no tuning. Unlike a firewall rule set or an EDR policy, there is nothing to balance — the decoy either gets touched or it does not.
- Early warning. Attackers reconnoitre before they attack. A touched honeypot means reconnaissance is happening, before the damaging step.
- Cheap. A spare VM, a decoy account and a canary file cost nothing.
Cheap honeypots a small business can actually run
- A honeypot admin account. An account named 'backupadmin' or 'admin-old' deployed with a canary token as its password. No one should ever log in — a login attempt means credentials are circulating, and even a password-spray attempt that succeeds pings you.
- A decoy file share. A share named 'HR salaries' or 'Client contracts' with a few canary-tokened files. Nobody in your business should open it; an open event is an insider or attacker signal.
- A decoy server or VM. A spare VM with common admin ports open and canary services running — useful when you want to see who is scanning your network segment.
- Canary tokens in strategic spots — a PDF named '2027 Budget FINAL.xlsx' on a share, a webhook in a config file — the cheapest detection there is.
How a honeypot fits the defence stack
A honeypot detects; it does not prevent. It earns its place alongside the controls that stop attacks from succeeding:
- MFA on every account — a honeypot alerts on stolen-credential attempts, MFA blocks them.
- Least privilege — the attacker touching the decoy has fewer places to go.
- Fast patching — the exploit that got the attacker to the decoy is closed at the source.
- Backups — if prevention fails, recovery does not depend on the attacker's goodwill.
- Staff awareness — the human-side honeypot: staff who report odd behaviour, unexpected logins and suspicious email. Cyber Aware's security awareness training builds that reporting reflex monthly and auto-enrols anyone who clicks a simulated lure into same-day remediation; human risk reporting shows per person whether click and report behaviour is improving.
For the full controls audit — MFA coverage, patch cadence, monitoring coverage, backups — a cyber security gap assessment shows which are evidenced and which to close next.
FAQ
What is a honeypot in cyber security? A decoy system, account or file planted to attract attackers and record everything they do. Because no legitimate user touches it, every interaction is a high-confidence alert.
Is a honeypot legal? Yes. Monitoring your own decoy systems on your own network is legal, including in Australia, though privacy and evidence-handling rules still apply if you pursue an attacker.
Can a honeypot be a risk? Only if poorly deployed. A honeypot must be isolated from production systems — a decoy that shares credentials or network access with real systems is itself a liability. Deploy isolated, log everything, alert on any touch.
What is the difference between a honeypot and an IDS? An IDS watches all traffic for known-bad patterns; a honeypot waits for any interaction with a decoy. A honeypot is a component that produces high-confidence alerts; an IDS is the broader monitoring system that may consume them.
Do honeypots work against insider threats? Partly — a decoy 'HR salaries' share catches staff browsing files they have no business opening. But insider risk responds better to least privilege, offboarding discipline and human risk measurement than to decoys alone.
How much does a honeypot cost? A spare VM, a decoy account and a few canary tokens cost nothing beyond setup time. Commercial honeypot or deception platforms exist but are rarely needed at small-business scale.
One last thing
Plant one canary this week: a spreadsheet named something irresistible — 'Master Passwords.xlsx' — with a canary token inside, on a share staff can reach. If nobody ever opens it, good. If someone does, you have just caught an attacker or a curious employee red-handed for the price of a spreadsheet.
Related guides
- What is an insider threat? — the risk that decoy shares help surface.
- What is a backdoor? — what honeypot alerts help you find before damage.
- What is data exfiltration? — what a touched honeypot often precedes.