# What is a Honeypot?

> A honeypot is a monitored decoy system, service, or network resource designed to attract and record unauthorized or suspicious interaction.

- Canonical URL: https://yellowcube.eu/glossary/honeypot/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It has no production purpose that would normally justify such activity, so contact can provide a high-signal lead for investigation. Honeypots may also help defenders study techniques, validate visibility, or divert attention from real assets.

Designs range from low-interaction simulations of a small number of services to isolated environments that allow more realistic activity. Their value depends on believable placement, reliable telemetry, controlled exposure, and a response process. A honeypot should be treated as potentially hostile infrastructure once another party interacts with it.

### Key points

- **Defensive role:** Use observations to investigate reconnaissance, attempted access, tooling, or movement patterns and to improve detections and threat models.
- **Safe design:** Isolate the decoy from production, restrict outbound activity and privileges, exclude real secrets and personal data, and define ownership, retention, and shutdown procedures.
- **Operations:** Monitor sensor health, time synchronization, expected background traffic, configuration drift, and alert delivery; document which interactions the design can and cannot observe.
- **Important limitation:** A connection may come from automated scanning, research, or an error rather than a targeted attack. Interaction does not establish actor identity, intent, or wider compromise, while no interaction does not prove the environment secure.

### Related terms

[Deception technology](<https://yellowcube.eu/glossary/deception-technology/>) · [Honeytoken](<https://yellowcube.eu/glossary/honeytoken/>) · [Canary token](<https://yellowcube.eu/glossary/canary-token/>) · [Network monitoring](<https://yellowcube.eu/glossary/network-monitoring/>) · [Threat hunting](<https://yellowcube.eu/glossary/threat-hunting/>)

### Sources

[NIST glossary: Honeypot](https://csrc.nist.gov/glossary/term/honeypot) · [MITRE D3FEND: Decoy Environment](https://d3fend.mitre.org/technique/d3f:DecoyEnvironment/) · [NIST SP 800-53 Rev. 5, Update 1](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.