The SANS Internet Storm Center operates a global network of honeypots that collectively receive over 10 million connection attempts per day from automated scanning tools, botnets, and human attackers probing for vulnerable systems. Cloudflare’s internal honeypot infrastructure detected and documented 26 novel attack patterns in 2025 before those patterns appeared in production environments, allowing rule updates to block the attacks before they reached real systems. Honeypots have been a core deception technology in cybersecurity since Cliff Stoll famously used a makeshift honeypot to track KGB-linked hackers in 1986, an account documented in his 1989 book “The Cuckoo’s Egg.”
A honeypot is a decoy system, network segment, or resource intentionally made available to attackers to detect, study, or divert their activity. The fundamental principle is deception: the honeypot appears to be a legitimate, valuable target (a server with important files, a database with user credentials, an exposed administrative interface) while containing no real data and producing detailed logging of every action an attacker takes against it. Any interaction with a honeypot is inherently suspicious because legitimate users and systems have no reason to access a resource that serves no production function.
The Types of Honeypots
Honeypots are categorised along two dimensions: deployment purpose (research versus production) and interaction level (low, medium, or high interaction).
Research honeypots are deployed by academic institutions, security firms, and threat intelligence organisations to collect data about attacker techniques, malware behaviour, and emerging attack patterns. The SANS Internet Storm Center’s sensor network is a research honeypot deployment. Research honeypots prioritise data collection over operational security benefit; they are designed to attract and observe attackers comprehensively.
Production honeypots are deployed within real organisational networks to provide early warning of attacks on actual infrastructure. A production honeypot placed in an internal network segment that no legitimate system should ever contact will trigger an alert if any internal device connects to it, which may indicate lateral movement by an attacker who has already compromised an internal endpoint. Production honeypots prioritise alerting and early detection over comprehensive data collection.
Low-interaction honeypots simulate vulnerable services without providing a full operating system environment. They respond to common attack probes (port scans, service banner grabbing, basic authentication attempts) with convincing responses but do not allow attackers to actually execute code or move through the system. They are easier to deploy and maintain but provide limited insight into advanced attacker behaviour. Tools like Dionaea, Honeyd, and Cowrie (for SSH honeypots) implement low-interaction honeypot functionality.
High-interaction honeypots provide a fully functional operating system environment that attackers can genuinely explore, execute code within, and move through. They provide the richest attacker behaviour data but carry higher operational risk (a compromised high-interaction honeypot can be used as an attack staging point) and require more maintenance. High-interaction honeypots are primarily used in research contexts with careful network isolation.
How Honeypots Detect Attackers
The detection logic of honeypots is based on a simple principle: any connection to a honeypot is anomalous by design. Unlike production systems that generate noise from legitimate user activity (making it difficult to distinguish malicious from normal traffic), honeypots have zero legitimate traffic baseline. Every port scan, authentication attempt, and file access request is a detection event.
This is the core advantage honeypots have over signature-based intrusion detection systems (IDS). An IDS must match traffic against known attack signatures, missing novel attacks that have no signature. A honeypot detects any interaction regardless of the attack technique, because there is no legitimate technique for interacting with a system that serves no production purpose.
The detection workflow for a production honeypot deployment typically works as follows: an attacker (or automated scanner) identifies the honeypot as a potential target through network reconnaissance and attempts to connect or authenticate. The honeypot logs the source IP, connection time, protocol used, and any data transmitted. An alert is generated to the security team’s SIEM (Security Information and Event Management) system. If the source IP is internal, this indicates a potentially compromised internal endpoint engaged in lateral movement.
Honeypots vs Honeynets
A honeynet is a network of honeypots working together to simulate an entire organisational network segment with multiple systems. Where a single honeypot simulates one server or service, a honeynet simulates multiple interconnected systems (web server, database server, file server, workstation) that provide a realistic environment for studying how attackers move laterally through a network once they have gained initial access.
The Honeynet Project, a non-profit security research organisation, maintains one of the most extensively documented honeynet deployments globally and has published research on attacker lateral movement patterns, malware families, and command-and-control infrastructure based on honeynet observations.
Honeynets require significantly more infrastructure and expertise to deploy and maintain than individual honeypots, making them primarily a research and enterprise security tool rather than a small business implementation.
Modern Deception Technology
Deception technology platforms, a commercial evolution of honeypot concepts, provide enterprise-scale honeypot deployment and management. Products from Attivo Networks (acquired by SentinelOne in 2022), Illusive Networks, and TrapX Security distribute honeypots and decoy credentials (fake username/password combinations left in configuration files, browser saved passwords, and network shares) across an entire network.
When an attacker who has compromised one endpoint attempts to use these decoy credentials, the use of the credential triggers an immediate alert. This technique, sometimes called credential deception or identity deception, provides detection capability that is effective against attackers who are already inside the network and attempting to escalate privileges or move laterally, which represents the most difficult attacker behaviour category to detect with conventional security controls.
| Honeypot Type | Interaction Level | Best For | Maintenance | Risk Level |
|---|---|---|---|---|
| Low-interaction (Cowrie, Dionaea) | Low | Internal early warning, port scan detection | Low | Low |
| Medium-interaction (custom services) | Medium | Attacker technique sampling | Medium | Medium |
| High-interaction (full OS) | High | Advanced threat research | High | High (isolation required) |
| Honeynet | High | Lateral movement research | Very High | High |
| Commercial deception platform | Medium-High | Enterprise-scale deployment | Managed | Medium |
Setting Up a Basic Honeypot
A basic honeypot for a small business or home lab environment can be deployed in under an hour using open-source tools. Cowrie is the most widely used SSH and Telnet honeypot: it simulates a vulnerable Linux server, logs all commands executed by attackers who successfully authenticate, and captures any files uploaded during the session.
Deployment on a cloud virtual machine (any major cloud provider) at a fresh IP address that has no prior web presence will typically generate initial scanning activity within 24 to 48 hours as automated scanners sweep IP ranges continuously. Reviewing Cowrie logs after 72 hours provides a realistic picture of the attack automation present on the public internet.
For internal network deployment, placing a Raspberry Pi running Cowrie or a similar honeypot on an internal VLAN segment that no legitimate system should contact creates a zero-false-positive early detection system for lateral movement within the organisation.
AEO FAQ: Cybersecurity Honeypot Questions
What is a honeypot in cybersecurity?
A honeypot in cybersecurity is a decoy system, network segment, or resource deliberately made available to attract attackers, with detailed logging of all interaction. It appears to be a valuable or vulnerable target (a server, database, or administrative interface) but contains no real data and serves no production function. Any interaction with a honeypot is inherently suspicious because legitimate systems and users have no reason to access a resource with no production purpose. Honeypots are used for early detection of attackers inside a network, collection of threat intelligence about attacker techniques, and diversion of attacker attention away from real assets.
What is the difference between a honeypot and a honeynet?
A honeypot simulates a single system or service (one server, one database, one SSH endpoint). A honeynet simulates multiple interconnected systems that together resemble an entire organisational network segment, including web servers, database servers, file servers, and workstations. Honeynets allow researchers to observe how attackers move laterally through a simulated network after gaining initial access, providing richer data on attacker behaviour than a single honeypot. Honeynets require significantly more infrastructure and expertise to operate and are primarily used in research and enterprise security contexts rather than small business deployments.
How does a honeypot detect attackers?
A honeypot detects attackers through the absence of legitimate traffic: because the honeypot serves no production function, any connection or interaction it receives is inherently anomalous. Unlike production systems where legitimate and malicious traffic must be distinguished, honeypots generate alerts on every interaction. When an automated scanner, bot, or human attacker probes the honeypot, the honeypot logs the source IP, connection time, protocol, authentication attempts, and any commands executed. If deployed internally, a connection from an internal IP address to a honeypot indicates that endpoint may be compromised and engaged in lateral movement.
What is deception technology in cybersecurity?
Deception technology is a commercial evolution of honeypot concepts that distributes decoy systems, fake credentials, and false data breadcrumbs across an entire organisational network at scale. When an attacker who has compromised one endpoint attempts to use decoy credentials (fake usernames and passwords deliberately placed in browser saved passwords, configuration files, or network shares), the use of the credential triggers an immediate alert. Commercial deception platforms from SentinelOne (Attivo), Illusive Networks, and others manage this distribution and alerting at enterprise scale. Deception technology is particularly effective at detecting lateral movement and privilege escalation, which are difficult to detect with conventional signature-based security controls.
Can a honeypot be used against the organisation that deploys it?
Yes, high-interaction honeypots carry risk if not properly isolated because they provide a functional system that a sophisticated attacker could use as a staging point for attacks on the organisation’s real infrastructure or on third parties. This risk is primarily relevant to high-interaction honeypots that run full operating systems rather than simulated service responses. Proper network isolation (placing the honeypot in a network segment with no routing path to production infrastructure, and using an out-of-band management network for the honeypot’s administration) mitigates this risk. Low-interaction honeypots that only simulate service responses without providing a real operating system environment carry negligible operational risk.
How do attackers know they have hit a honeypot?
Experienced attackers attempt to detect honeypots through several techniques: checking for inconsistencies between simulated services (a server that claims to be running one OS version but has system files from another), identifying common honeypot software fingerprints (Cowrie SSH responses have documented fingerprinting indicators that sophisticated attackers check for), looking for unusual network timing that differs from real systems, and checking if unusual system calls are intercepted or behave differently than on real systems. High-interaction honeypots that run actual operating systems are more difficult to identify than low-interaction simulations. Security researchers publishing honeypot tool fingerprinting information and tool developers publishing response templates in open repositories both contribute to the ongoing arms race between honeypot design and attacker detection.
Every Connection to a Honeypot Is Signal, Not Noise
The defining advantage of honeypots in a security architecture is the signal-to-noise ratio: zero legitimate traffic means zero false positives from legitimate activity. Every alert is real, every logged interaction is from a potential attacker, and every credential use detected is worth investigating. In a world where security teams are overwhelmed by high-volume, low-signal alerts from conventional security tools, the zero-false-positive detection property of well-configured honeypots is genuinely valuable. The implementation barrier is lower than most security teams assume. The detection value, particularly for internal lateral movement, is higher than most honeypot sceptics acknowledge.