Deception / Honeypots
Decoys that detect attackers via interaction.
Overview
Deception technology plants decoy assets and credentials that legitimate users never touch, so any interaction is high-fidelity alert. It excels at catching lateral movement with low false positives. A niche but valued layer, sold per decoy or environment. Strong open-source options exist for smaller deployments.
High-fidelity supplemental detection once core controls exist.
Advantages
- Very low false positives and high-fidelity alerts
- catches lateral movement
- Thinkst Canary widely loved and cheap
- OSS options exist.
Trade-offs
- Niche supplemental control, not a primary defense
- coverage limited to where decoys are placed
- smaller market/maturity.
Open-source option
T-Pot (a multi-honeypot platform) and OpenCanary (lightweight canary/honeytoken alerts) are both genuine, actively-maintained open-source deception tools — this area has real self-hostable coverage even though the field was previously unset.
Vendors & tools in this area
Agentless identity-focused deception — deploys 75+ deception techniques to catch lateral movement via Active Directory/Entra ID, not network-level honeypots.
Visit site →