What is a honeypot? Deception as defense

The principle

Legitimate users have no business on a honeypot. That is why it produces hardly any false positives: Anyone who interacts with it is very likely an attacker or a compromised system. At the same time, it keeps attackers away from real systems and buys time.

Types of honeypots

• Low interaction: simulate individual services, easy to run, low risk.
• High interaction: real systems in a controlled environment, provide deep insights, require careful isolation.
• Honeytokens: decoys such as fake credentials or documents that trigger an alert when used.

Redirect attackers automatically

Deception becomes especially effective when detected attackers are redirected in a targeted way. XMfortress Respond can steer connections from a suspicious system into a honeypot environment modeled on the real one. The behavior is observed, and the findings feed back into your own detection.

Risks and rules

Honeypots must be cleanly separated from production systems so they do not become a stepping stone themselves. Legal questions, for example about logging, should also be clarified in advance. Actions should be logged and reversible at any time.