Honeypot
decoy · honeytoken · canary token · honeynet · deception technology · pot de miel
A decoy (fake server, fake account, fake file) deliberately planted to attract attackers: since no legitimate user should ever touch it, any interaction is a reliable alert.
In practice
An internal honeypot detects intruders who are already inside, exploring the network or trying credentials. Its lightweight variants, “honeytokens”, are fake credentials or documents whose mere use triggers an alert. Internet-facing honeypots mainly serve research: observing automated attacks and collecting indicators. They must be isolated so they never become a foothold for the attacker.
Fictional case: a company creates a fake “backup-admin” account that nobody uses. Six months later, a login attempt on that account reveals an intruder in the middle of lateral movement, several days before they reach the real backups.
