Deception technology and honeypots
Most security tools watch for known bad behavior. Deception works the other way: a decoy file, login or server that no legitimate user should touch. When something touches it, the alert is nearly always real, because ordinary work never goes there.
What we do
- Decoy placement plan
- Token and honeypot deployment
- Alert routing and ownership
- Playbook for a triggered decoy
- Testing in tabletop exercises
- Periodic decoy refresh
- Reporting of triggers
Our team works with Canarytokens for tripwire documents, links and credentials, with OpenCanary, an open-source honeypot that imitates services such as SSH, web and file shares, and with Thinkst Canary for managed decoy devices. We place decoys where an intruder would look next and send the alerts to a channel someone watches.
This group links to our Cybersecurity services. Decoys add early warning and do not replace logging or detection. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Canarytokens
- OpenCanary
- Thinkst Canary
- Attivo
- Acalvio
Platforms and practices
- Tripwire documents and links
- Decoy credentials
- Fake SSH and file share services
- Decoy placement planning
- Alert routing to chat or SIEM
- Low-noise alert tuning
- Decoy naming that blends in
- Response playbook for a trip
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Deception technology and honeypots for clients
Where this matters most
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageAre decoys safe, or do they invite attackers in?
A decoy is a fake service or file that holds no real data and is isolated from real systems, so an intruder gains nothing by touching it. It does not attract attackers from the internet in the way a public honeypot would, since we place decoys inside your network. We keep them away from production data and credentials.
Do decoys replace logging and detection?
No. Decoys add early warning because no legitimate user should ever touch them, but they only catch an intruder who happens to find one. Logging, endpoint detection and alert monitoring are still needed. Think of a decoy as a tripwire that adds to the other tools.
What happens when a decoy is triggered?
The alert goes to a chat channel or the SIEM that someone watches. A response playbook says who checks it first, how to identify the source device or account and when to treat it as an incident. Because an alert on a decoy is nearly always real, it should be handled quickly, and we test the playbook in a tabletop exercise.
How many decoys does a small company need?
Fewer than people expect. A handful of tripwire documents, decoy credentials and one or two fake servers or file shares in the places an intruder would look next can be enough. Placement matters more than quantity, so we start with a plan of where an attacker would go, and refresh the decoys from time to time.