Honeypot

In 1986 and 1987, at Lawrence Berkeley Laboratory, astronomer Clifford Stoll tracked an intruder by feeding him fake military files, labeled SDINET, big enough to keep him online while the line was traced. He told the story in The Cuckoo's Egg (1989). The idea has not changed. A honeypot is an asset built to look legitimate and tempting: a server, an account, a file or a whole network. It serves no operational purpose, so any interaction with it is suspicious by construction and raises an alert with almost no false positives. Low-interaction honeypots emulate a few services and collect the noise of automated scans. High-interaction ones are real systems, instrumented to watch an advanced attacker for hours or days. If they are poorly segmented, the attacker can pivot from them. A honeynet strings several together. Canary tokens are the lightweight version: a file, URL or credential that calls home the moment someone opens or uses it. Decoys feed internal threat intelligence on attacker tactics, and MITRE Engage files them under active defense. On the underwriting side, the cyber application asks first about MFA, EDR and backups. Decoys add a signal of detection capability that some underwriters give credit for. In AI, the same logic means planting decoy data, canaries, in a corpus to spot a model trained on stolen data.