Cyberpediaby Brain
ENDEFR

Honeypots and honeytokens: traps to catch intruders

Decoy server, fake document, fake access key: what security decoys are, and what an employee should do on coming across one.

In 30 seconds

Where it happens
On systems, files or accounts that the security team has placed on purpose, without employees having to deal with them.
What the attacker wants
To find passwords, keys or access tokens. The decoy offers exactly that, but it leads nowhere.
The reflex
Do not touch a decoy, never install one yourself, and report to security any alert message or suspicious file.
If it is already done
Tell security without delay, stating what was opened and when.

What it is

A honeypot is a decoy. The NIST glossary defines it as a system (for example a web server) or a system resource (for example a file on a server) designed to be attractive to hackers and intruders, « like honey is attractive to bears »1. In this article, "honeytoken" means the same idea on a smaller scale: a piece of data with no real use, such as a fake login or a fake access key, placed where an intruder will find it. The sources cited here do not define this term.

For an employee, these traps mostly stay invisible. They serve the company's security, which installs and monitors them. This article explains the principle, what is expected of each person if a decoy appears on their path, and the flaws that make these devices useless or dangerous.

Straight answers

What is a decoy for?

It is used to spot an intrusion. The UK's NCSC points out that the first goal of cyber security is to prevent attacks2. That is not always possible2. The role of a security operations centre (SOC) is to limit the damage by detecting and handling attacks that get past preventive controls2. A decoy is one means of detection among others: it adds to the protections that block, it does not replace them.

Why does an intruder fall for it?

Because it is looking for exactly what the decoy imitates. MITRE describes adversaries who search local file systems and network shares for files containing poorly protected credentials3. These can be files created by users to note down their passwords, configuration files containing passwords, or source code with embedded passwords3. These same adversaries can list files and folders to decide what to do next4. A fake password file, stored in the right place, looks like a find.

Can an employee trigger a decoy by mistake?

It is possible, and this article cannot say how often: the sources cited here do not document it. The rule is therefore simple. A file, an account or a share that has nothing to do with your work is not to be opened out of curiosity. If you opened it, tell security rather than keep quiet.

Should an employee install a decoy at home or on their workstation?

No. A badly placed decoy can create a problem instead of solving one. The choice of location, isolation and monitoring falls to the security team.

1How it works1 min

There are three main families of decoys, which this article distinguishes from the examples in the NIST glossary1 and the MITRE pages35.

  • The decoy server or system: this is the honeypot in the NIST sense, a system that is attractive to the intruder1.
  • The fake document or fake file: a resource placed on a server, which NIST also includes in its definition of the honeypot1.
  • The fake token or fake access key: an application token is used to make authorized requests on behalf of a user or a service, and it is common in cloud and container applications5. An adversary who steals such tokens can access data and act with the rights of the accounts concerned5. A decoy token, by this article's reasoning, would attract the same greed.

The alert principle rests on use: the decoy has no function in daily work, so any contact with it deserves examination. The sources cited here do not detail how commercial tools work technically, and this article does not describe it.

The same reasoning applies to accounts. MITRE notes that cloud accounts, created by an organization for its users, its services or administration, are targets6. An adversary can go after them by brute force or by phishing6. A fake account could serve as bait on this ground, by this article's reasoning.

2What you do1 min
  • You do not touch what does not concern you. A file named « passwords » in a shared folder you never use is not a windfall.
  • You do not copy, test or share any login, key or token found by chance.
  • You report to security any unexpected alert message, any suspicious file or account, with the name, the location and the time.
  • You do not install a decoy yourself, either on a workstation or in a cloud space.
  • You do not store your own passwords in a file: MITRE cites precisely these files among those that adversaries look for3.
3Pitfalls2 min

The decoy that is too easy to recognize

A crude fake document, with too obvious a name, fools no one. The sources cited here do not say how to make a decoy credible: the point is only flagged here, with no technical instruction.

The ignored alert

Detecting is useless if no one reacts. The NCSC describes the SOC as a set-up that detects and responds2. Its guide covers both detection and incident response2.

The poorly isolated decoy

The sources cited here do not address isolating a decoy from the rest of the network. MITRE does recommend, in general terms, reducing the attack surface by removing unnecessary software, features and services8, which also applies to a forgotten decoy.

Personal data collected without a framework

If a decoy records what a person does, the rules on personal data may apply. The GDPR, in its Article 5, requires that such data be processed lawfully, fairly and transparently7. It must be collected for specified, explicit and legitimate purposes7. It must also be limited to what is necessary7. The GDPR also requires appropriate security of the processing7. A monitoring device with no clear purpose and no information given to the people concerned departs from these principles.

The cloud account that becomes a target

A cloud account synchronized with internal systems can open the way into the company itself: MITRE states that federated or synchronized accounts can make it possible to act on both internal systems and the cloud6. The article infers from this that a fake account of this type should be partitioned off like a sensitive account.

Fact sheet

Identifier
CP-235
Wing
3. Protocols and defence
Brain skill
Safe Web Browsing (browse_safely)
Brain reflex
cr-078
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
8 sources checked on 3 November 2026
Sources8 sources
  1. NIST, “honeypot - Glossary | CSRC”. https://csrc.nist.gov/glossary/term/honeypot (accessed 3 November 2026)
  2. NCSC (UK), “Building a Security Operations Centre (SOC)”, 23 May 2022. https://www.ncsc.gov.uk/collection/building-a-security-operations-centre (accessed 3 November 2026)
  3. MITRE ATT&CK, “Unsecured Credentials: Credentials In Files, Sub-technique T1552.001 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1552/001/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “File and Directory Discovery, Technique T1083 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1083/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Steal Application Access Token, Technique T1528 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1528/ (accessed 3 November 2026)
  6. MITRE ATT&CK, “Valid Accounts: Cloud Accounts, Sub-technique T1078.004 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1078/004/ (accessed 3 November 2026)
  7. CNIL, “CHAPITRE II - Principes”. https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre2 (accessed 3 November 2026)
  8. MITRE ATT&CK, “Disable or Remove Feature or Program, Mitigation M1042 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/mitigations/M1042/ (accessed 3 November 2026)

Cite this article

Brain, “Honeypots and honeytokens: traps to catch intruders”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/honeypot-honeytoken-canarytokens-traps/

BibTeX 
@misc{brain_cp235_en_2026,
  author = {Brain},
  title = {Honeypots and honeytokens: traps to catch intruders},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/honeypot-honeytoken-canarytokens-traps/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence