What Is a Honeypot? Decoy Systems for Early Warning

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 13 November 2026.

In one sentence: A honeypot is a fake system, file or login that no real employee has any reason to touch, so anything that touches it is worth a look.

What it is

Ordinary network activity makes an intruder hard to spot. A decoy flips that. MITRE D3FEND, a free catalogue of defensive techniques, defines a Decoy Environment (its synonym is honeypot) as hosts and networks for the purposes of deceiving an attacker. It adds that systems in a decoy environment are typically set up so that some means of communication has no legitimate business purpose, so any communication with them should be logged and analysed.

The UK’s NCSC uses three plain terms. Tripwires, which include honeytokens such as a fake credential or file, detect a threat actor by their interacting with them. Honeypots let a threat actor interact so that their methods and tools can be observed. Breadcrumbs are artefacts that lead an attacker towards a tripwire or honeypot. NCSC’s blog post lays these out in its call for evidence on cyber deception.

How it works

You place a decoy where an intruder would look: a file share named like something valuable, a server on an unused address, or a fake login in a config file.
Nothing in normal business uses it, so you can make any contact raise an alert.
An attacker who is scanning, browsing shares or trying stolen logins touches it.
You get an alert early, often before the attacker reaches real data.
You investigate: which account, which device, what else did they touch.

NCSC splits uses in two. Low-interaction tripwires and honeytokens, to alert to unauthorised access, are for all organisations. Honeypots that collect threat intelligence suit organisations with mature security operations and managed security providers.

Real examples

NCSC ran trials under its Active Cyber Defence 2.0 programme with 121 UK organisations, 14 commercial providers and 10 product trials. Its conclusion: when done well, cyber deception can provide early warning of attacks and generate high-quality intelligence, but it is not a magic fix and requires planning, strategy and support. It found outcome-based metrics were not readily available, and that without a clear strategy firms risk tools that create noise rather than insight. It also found that 90 percent of trial participants would not publicly announce they use deception.

Who it affects and how badly

Any size of organisation can use a simple tripwire. A fake file or login costs almost nothing. Larger organisations with a security team can run honeypots and watch the results. The risk is on the defender’s side if it is done badly. NCSC warns that if deception tools are not properly configured they may fail to detect threats, give a false sense of security or, worse, create openings for attackers.

Sole trader to 10 staff: a honeytoken alert in email or a cloud account is realistic. A full honeypot is not.
10 to 50 and 50 to 250: tripwires on file shares and admin accounts, alerting to whoever owns IT or the MSP.
250 plus and regulated: tripwires plus honeypots tied into monitoring, with a named owner.

The UK angle

NCSC wants deception used more in the UK. It set targets of at least 5,000 instances of honeypots on the UK internet, 20,000 low-interaction instances inside internal networks, 200,000 assets in cloud environments and 2,000,000 tokens, to build an evidence base. In December 2025 it said it is looking at developing a new Active Cyber Defence service to help organisations choose and use deception. Check NCSC’s pages for what is available when you read this.

What we check on a test

Method only, no findings claimed. During a test we can look at the following from the attacker’s side:

Whether our activity raised any alert, and how long it took the client’s team to notice, if the client agrees to share this.
Whether any decoys exist, and whether they look real or obviously fake.
Whether a decoy is safely isolated from real systems and holds no real data.
Whether alerts reach a person who will act on them.

Agree in advance whether testers are told that decoys exist and whether your monitoring team knows a test is running.

How to detect it

This entry is about a detection tool, so the question is how to tell it is working:

Test every decoy on a schedule and confirm the alert arrives.
Check that alerts go to a mailbox or system that someone reads.
Keep a register of every decoy with owner, address and refresh date, so your own staff and scanners do not trigger false alarms.
Review alert volume. If decoys fire constantly on your own tools, tune them.
Include decoys in security exercises and see whether they fired.

How to fix or prevent it

How to deploy one safely, most important first:

Start with a goal: which behaviour do you want to catch, such as browsing shares or using stolen logins. NCSC found that without a clear strategy firms get noise rather than insight.
Start with tripwires: a decoy file or a fake credential that grants nothing.
Isolate any decoy host from real systems and block or limit its outbound traffic.
Put no real data and no real privileges in a decoy.
Route alerts to a named owner and write down what they should do.
Keep decoys current as the network changes. NCSC says tools must be updated and fine-tuned.
Do not use decoys to attack anyone. Use them only on systems you own.

Frequently asked questions

Is a honeypot the same as an antivirus? No. It does not block anything. It tells you someone touched something they should not.

Is deception only for large firms? NCSC says simple tripwires and honeytokens suit all organisations. Honeypots that collect intelligence suit mature teams.

Can a honeypot go wrong? Yes. NCSC warns that misconfiguration can create openings for attackers.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. See manual penetration testing and start with the free web vulnerability scan.

What is a honeypot? How decoy systems give early warning of an attacker