Skip to content Skip to navigation Skip to footer

Honeypots refer to decoy servers or systems that are deployed next to systems your organization actually uses for production. Honeypots are designed to look like attractive targets, and they get deployed to allow IT teams to monitor the system’s security responses and to redirect the attacker away from their intended target. 

There are various honeypots, and they can be set up according to what your organization needs. Because they appear to be legitimate threats, honeypots act like a trap, enabling you to identify attacks early and mount an appropriate response. This honeypot meaning points to some of the ways they can be used to direct attackers away from your most important systems. While the attacker falls for the bait, you can gather crucial intelligence about the type of attack, as well as the methods the attacker is using. 

A honeypot works best when it appears to be a legitimate system. In other words, it must run the same processes your actual production system would run. It should also contain decoy files the attacker will see as appropriate for the targeted processes. In many cases, it is best to put the honeypot behind the firewall protecting your organization’s network. This enables you to examine threats that get past the firewall and prevent attacks engineered to be launched from within a compromised honeypot. As the attack ensues, your firewall, positioned between the honeypot and the internet, can intercept it and eliminate the data.

How Do Honeypots Work?

In many ways, a honeypot looks exactly like a genuine computer system. It has the applications and data that cyber criminals use to identify an ideal target. A honeypot can, for instance, pretend to be a system that contains sensitive consumer data, such as credit card or personal identification information. The system can be populated with decoy data that may draw in an attacker looking to steal and use or sell it. As the attacker breaks into the honeypot, the IT team can observe how the attacker proceeds, taking note of the various techniques they deploy and how the system’s defenses hold up or fail. This can then be used to strengthen the overall defenses used to protect the network.

Honeypots use security vulnerabilities to lure in attackers. They may have ports that are vulnerable to a port scan, which is a technique for figuring out which ports are open on a network. A port left open may entice an attacker, allowing the security team to observe how they approach their attack.

Honeypotting is different from other types of security measures in that it is not designed to directly prevent attacks. The purpose of a honeypot is to refine an organization’s intrusion detection system (IDS) and threat response so it is in a better position to manage and prevent attacks.

There are two primary kinds of honeypots: production and research. Production honeypots focus on the identification of compromises in your internal network, as well as fooling the malicious actor. Production honeypots are positioned alongside your genuine production servers and run the same kinds of services.

Research honeypots, on the other hand, collect information regarding attacks, focusing not just on how threats act within your internal environment but how they operate in the wider world. Gathering information about threats in this way can help administrators design stronger defense systems and figure out which patches they need to prioritize. They can then ensure that sensitive systems have up-to-date security measures to defend against the attacks that fell for the honeypot’s lures.

The Complexities of Honeypots Varies

There are different types of honeypots, each designed for different production or research purposes.

Pure Honeypot

A pure honeypot refers to a full-scale system running on various servers. It completely mimics the production system. Within a pure honeypot is data made to look confidential, as well as “sensitive” user information, which have a number of sensors used to track and observe attacker activity.

High-interaction Honeypot

A high-interaction honeypot is designed to get attackers to invest as much time as possible inside the honeypot. This gives the security team more opportunities to observe the targets and intentions of the attacker and more chances to discover vulnerabilities within the system. 

A high-interaction honeypot may have extra systems, databases, and processes that the attacker will want to try to infiltrate. Researchers can observe how the attacker goes about looking for information, as well as which information they prefer and how they attempt to escalate access privileges.

Mid-interaction Honeypot

Mid-interaction honeypots imitate elements of the application layer, but they do not have an operating system. Their mission is to confuse an attacker or stall them so the organization has more time to ascertain how to react to the kind of attack in question.

Low-interaction Honeypot

Low-interaction honeypots are less resource-intensive and gather rudimentary information regarding the kind of threat and where it came from. These are relatively simple to set up, and they make use of Transmission Control Protocol (TCP), Internet Protocol (IP), and network services. However, there is nothing inside the honeypot to hold the attacker’s attention for a considerable amount of time.

Different Types of Honeypots and How They Work

Malware Honeypot

Malware honeypots use attack vectors already known to lure in malware. They can, for example, imitate a Universal Serial Bus (USB) storage device. If a computer comes under attack, the honeypot fools the malware into attacking the emulated USB.

Spam Honeypot

Spam honeypots are designed to attract spammers by using open proxies and mail relays. Spammers perform tests on mail relays by using them to send themselves an email. If they are successful, they can then transmit large amounts of spam. A spam trap can identify a spammer’s test and then block the spam they try to send out.

Database Honeypot

A database honeypot is used to make decoy databases to attract database-specific attacks like SQL injections, which illicitly manage data. These kinds of honeypots can be implemented using a database firewall.

Client Honeypot

Client honeypots attempt to lure in malicious servers that attackers use while hacking clients. They pose as a client to observe how an attacker makes modifications to a server during the attack. Client honeypots are typically run in a virtualized environment and have containment protections in place to reduce the risk of exposure to the researchers.


Honeynets consist of a network of honeypots. With different kinds of honeypots forming a honeynet, several types of attacks can be studied, such as distributed denial-of-service (DDoS) attacks, attacks to a content delivery network (CDN), or a ransomware attack. While a honeynet is used to study different kinds of attacks, it contains all traffic, both inbound and outbound, to protect the rest of the organization’s system.

Benefits of a Honeypot

Honeypots come with several advantages a security team can leverage to improve network safety.

Break Down the Attacker Kill Chain

Attackers move through your environment like predators, scanning your network and looking for vulnerabilities. While they are on the prowl, they may engage with your honeypot. At this point, you can both trap the attacker inside and investigate its behavior. Honeypots also disrupt the kill chain by enticing attackers to invest their time going after the useless information in the honeypot instead of actual, sensitive targets of value.

Help in Testing the Incident Response Processes

Honeypots are an efficient way to see how your security team and the system will react to a threat. You can use a honeypot to evaluate the effectiveness of your team’s responses and address any weaknesses in policies.

Straightforward and Low Maintenance

Honeypots are both easy-to-implement and effective tools for providing alerts and information regarding the attacker's behavior. Your security team can deploy a honeypot and just wait for an attacker to interact with it. There is no need to constantly monitor the decoy environment, and you do not have to arm it with intel regarding known threats for it to be an effective tool.

How Fortinet Can Help

The Fortinet FortiDeceptor uses deception technology to identify and respond to threats from outside and within your network. FortiDeceptor gives you a network of virtual machines with honeypots running on them, and it uses real-time protections and threat analytics through the Fortinet Security Fabric. FortiDeceptor works in three phases:

  • Deceive phase: The cybersecurity team sends out deception virtual machines (VMs) and decoys across the data center, campus, or cloud that appear to be genuine assets.
  • Expose phase: An attacker’s lateral movement and activity are observed, collected, logged, and correlated. Then a timeline is developed based on this data, which sheds light on the attack and how it may play a role in a larger campaign. The security team is also alerted during this phase, and intel can be shared with security information and event management (SIEM) systems to allow for event management in a consolidated, single-pane environment.
  • Elimination phase: The security team uses the intel they have gathered to investigate and take steps to remediate. You also have the option of letting FortiDeceptor perform the mitigation automatically.