Honeypot

A honeypot is a computing asset, whether a server, account, file or entire network, configured to appear legitimate and attractive to an attacker, but which has no real operational purpose. Any access or interaction with this asset is therefore suspicious by construction and triggers an alert. Low-interaction honeypots simulate only a few services and capture automated intrusion attempts. High-interaction honeypots are genuine systems configured to observe advanced attackers for hours or days, at the risk of being used as a pivot. At larger scale, a honeynet refers to an entire network of decoys. Canary tokens are a lightweight variant: a file, URL or credential that, when opened or used, sends a real-time alert. Honeypots contribute to internal threat intelligence by revealing the tactics employed. For insurers, their presence in a security program signals a proactive posture that can influence cyber pricing. In AI, analogous techniques consist of inserting decoy data into training sets to detect models that were trained on stolen data.

A bank deploys a canary token in the form of an Excel file named 'Admin Passwords 2025.xlsx' on a network share. Three days after deployment, an alert is triggered from an unexpected internal IP address. The investigation reveals an attacker already present in the network for several weeks, enabling a rapid response before any ransomware deployment.

pot de miel, honeypot, leurre réseau, honeytrap, canary token