Offense · Deception

Honeytokens: 100% certain intrusion detection

06/07/2026 · ~5 min read

HoneytokensDeceptionCanaryIntrusion detection

Every signature- or behavior-based defense — IDS, EDR, antivirus — suffers from the same ailment: false alarms. It guesses whether an activity is malicious, and sometimes gets it wrong. A honeytoken flips the equation: it's a digital trap — a file, a key, a password, or an address — that no legitimate process ever touches. So every access to it is a confirmed intrusion, with zero false alarms.

What a honeytoken actually is

A honeytoken is a fake piece of bait that the operator plants anywhere sensitive: a decoy URL, a DNS record, a fictitious cloud key, a "confidential" document, or a credential pair for a database that doesn't exist. The idea is as old as espionage itself — a fake name on a mailing list to catch whoever sold it. In the cyber world this becomes the cleanest breach signal there is: if someone read, opened, or used the honeytoken — they weren't supposed to be there. Period.

Zero false alarms — not a marketing slogan. An EDR has no way to know for certain whether a given process is malicious. A honeytoken doesn't have that problem: nothing legitimate is there. The contact itself is the proof. That's the difference between "maybe we were breached" and "we were breached — here's the IP".

How it works — 100% agentless

1. Issue. From the dashboard the operator mints a honeytoken by type and label (for example "SSH key · backup server"). The output is just a string. 2. Plant. You paste the string anywhere tempting — a passwords.xlsx file on a file server, a decoy key in the code, an internal DNS record. There's nothing to install on any device. 3. Trigger. The moment an attacker touches the honeytoken, the access hits a public Worker — a cloud beacon — that logs the event: source IP, geo, timestamp. 4. Enrich. The beacon cross-references the IP against the threat intelligence feed (C2) that already serves the platform. 5. Conceal. The Worker returns an innocent 1x1 GIF — the attacker sees nothing suspicious and carries on as if nothing happened. We already know.

What happens the moment it's triggered

The hit enters the live attack feed in real time.
It's fed into the SIEM's incident correlation, connecting to all the other signals into a single attack story.
The operator gets an instant email — no need to sit in front of a screen to know.
That honeytoken's counter in the dashboard goes up, so you can see trends ("this file was touched 4 times this week").

Why it's especially critical for a small business: most SMBs don't have a SOC sitting on alerts. A honeytoken is the most reliable, cheapest, and most unambiguous signal for the question "have we been breached?" — completely silent until it fires, and then completely certain. It's especially brilliant for catching insider threats and lateral movement: plant a fake database credential pair, a decoy SSH key, or a passwords.xlsx — and whoever tries to use them gives themselves away immediately.

Where it fits in the framework

In MITRE and NIST terms this is deception in the Detect function. While UEBA and EDR learn "what's normal" and guess at deviations, the honeytoken guesses at nothing — it sets a trap and waits. The two approaches complement each other: behavior narrows the field of view, and the honeytoken provides the clean proof. Together, on one single platform, they're the difference between hoping you'll catch an intruder — and knowing the moment one gets in.

← Back to the blog · How it works →