Decoys vs Honeypots vs Honeytokens vs Canary Tokens

The short answer

The rest of this guide explains each term and how to choose between them.

Why the terms get mixed up

“Honeypot” is the most familiar term, so it is often used for any kind of deception. Product names add to the confusion. Thinkst, for example, offers a commercial product called Thinkst Canary and a free service called Canarytokens, so “canary” has become shorthand for a whole category.¹

Standards have moved towards “decoy”. NIST SP 800-53 Revision 4 named control SC-26 “Honeypots”. Revision 5 renamed it “Decoys”: components designed to be the target of malicious attacks so those attacks can be detected, deflected, and analysed, with honeypots, honeynets, and deception nets given as examples.²

MITRE D3FEND’s Deceive tactic is built around two techniques, Decoy Environment and Decoy Object. It lists “Honeypot” as a synonym of Decoy Environment and “Lure” as a synonym of Decoy Object.³⁴⁵

What is a decoy?

A decoy is anything created and placed to deceive an adversary, so that interacting with it reveals their activity. D3FEND splits decoys into two groups:

• Decoy Environment (D3-DE): hosts and networks built to deceive an adversary. This is where honeypots and honeynets sit.⁴
• Decoy Object (D3-DO): individual objects created and deployed to deceive, such as credentials, files, tokens, personas, and network resources.⁵

The property that makes every decoy useful is the same: it has no legitimate business purpose. A failed sign-in to a real account might be a typo. An attempt to use a credential that exists only as a decoy has very few innocent explanations, so the signal is unusually specific.

D3FEND divides Decoy Object into six sub-techniques:³

What is a honeypot?

A honeypot is a decoy system or service that an adversary can connect to and interact with. The definition NIST publishes from CNSSI 4009 describes a system or system resource designed to attract potential adversaries “like honey is attractive to bears”.⁶ The Australian Cyber Security Centre describes a honeypot as a computer system designed to attract malicious actors so defenders can develop better defensive measures and responses.⁷

ENISA adds the defining property: a honeypot’s only job is to be probed, attacked, or accessed without authorisation, so anyone using it is suspicious by definition.⁸

Low-interaction and high-interaction honeypots

ENISA classifies honeypots by how much they let an adversary do:⁸

• Low-interaction honeypots emulate services or applications. They are cheaper and safer to run, but emulation is easier to tell apart from a real system.
• High-interaction honeypots run real operating systems and services. They capture richer behaviour, but they give an adversary a real system to use, so they need strong isolation and close monitoring.

ENISA also separates server-side honeypots, which wait for incoming connections, from client-side honeypots, which actively connect to services to find malicious servers or content.⁸

Honeynets

A honeynet is a network of honeypots. D3FEND describes three arrangements:⁴

• Integrated Honeynet (D3-IHN): decoys placed inside a production environment.
• Connected Honeynet (D3-CHN): a decoy environment connected to the enterprise network that simulates some functionality without exposing production systems.
• Standalone Honeynet (D3-SHN): a decoy environment with no connection to production systems.

The Honeynet Project, a non-profit security research organisation founded in 1999, publishes open research and open-source tools in this area.⁹

Where honeypots fit today

Honeypot security depends heavily on placement:

• Internet-facing honeypots see a constant stream of automated scanning. That is valuable for research and threat intelligence, but it rarely gives early warning of an attack aimed at your organisation.
• Internal honeypots sit inside the network where nothing legitimate should connect to them. A connection is a strong sign of internal reconnaissance or lateral movement, which MITRE ATT&CK tracks as techniques such as Remote System Discovery (T1018) and Network Service Discovery (T1046).¹⁰¹¹

An enterprise honeypot also needs an owner, a maintenance plan, and a response workflow. A honeypot that nobody monitors is a liability, not a sensor.

What is a honeytoken?

A honeytoken is a decoy piece of data rather than a decoy system. In a 2003 article, Lance Spitzner described honeytokens as records or files with no legitimate use, so that any access to them signals misuse. His example was a decoy patient record in a hospital database that no legitimate user should ever open.¹²

Common honeytokens include:

• decoy credentials, API keys, and connection strings;
• decoy database records and customer entries;
• decoy documents and spreadsheets;
• decoy email addresses;
• decoy session tokens and cookies.

The key difference from a honeypot is location. A honeytoken lives inside real systems, documents, repositories, and workflows, where an adversary is already looking. It detects discovery and use, so it can catch activity that never touches a separate decoy system, such as an adversary testing a stolen credential or an insider browsing records they have no reason to see.

In MITRE ATT&CK terms, honeytokens commonly sit in the path of techniques such as Unsecured Credentials (T1552), Valid Accounts (T1078), File and Directory Discovery (T1083), and Data from Information Repositories (T1213).^13141516

A honeytoken only works if its use is observable. Decide in advance what counts as use, where that use will be recorded or reported, and who receives the alert.

What is a canary token?

A canary token is a honeytoken designed to raise an alert by itself. The name comes from the canary in a coal mine: an early warning that something is wrong. Most canary tokens work through a callback. When the token is opened, resolved, or used, it triggers a web request, DNS lookup, or other event that sends an alert.

Common forms include:

• a document that calls home when it is opened;
• a URL or QR code that alerts when it is visited;
• a DNS name that alerts when it is resolved;
• a cloud access key that alerts when someone uses it;
• a configuration file, such as a VPN profile, that alerts when it is used.

Thinkst’s free Canarytokens service is the best-known example. Thinkst describes Canarytokens as digital tripwires that notify you when they are touched, and offers token types including Google Docs and Sheets, QR codes, WireGuard VPN configurations, AWS API keys, AWS S3 buckets, and Office 365 mail bugs.¹⁷¹ Written as one word, “Canarytokens” refers to Thinkst’s service; “canary token” is the general term.

Canary tokens are quick to deploy and easy to understand. Their limits come from the callback: if the callback cannot happen, there is no alert, and automated tools such as link scanners and document previewers can trigger one without a person being involved. Test each token where it will actually live.

Where lures fit

D3FEND lists “lure” as a synonym of Decoy Object.⁵ In practice, people use “lure” for a decoy placed to attract interest: a believable credential in a runbook, a sensitive-looking file, or a route that appears to lead somewhere valuable. Treat it as another word for a decoy object rather than a separate category.

Cyber deception vs honeypots

Cyber deception, sometimes called deception technology, is the broader practice. It covers choosing an objective, placing decoys of every kind along likely adversary paths, monitoring interaction, and routing the result into investigation and response. A honeypot is one technique within that practice.

The choice of decoy should follow the adversary’s path. If that path runs through stolen credentials, cloud access, or sensitive data rather than network scanning, a standalone honeypot may never see it. A decoy credential in a repository or a decoy file next to real data sits directly on that path. A practical approach is to combine lightweight decoy objects close to real assets with a small number of carefully placed decoy systems.

The UK National Cyber Security Centre’s 2025 cyber deception trials found that deception can work but is not plug-and-play, and that its effectiveness depends on having the right data, context, and strategy.¹⁸ That applies to every term in this guide.

How the terms map to MITRE D3FEND

Which one should you use?

Start with the behaviour you want to detect, then choose the decoy that sits on that path.

Whatever you choose, keep the first deployment narrow, make sure an alert has somewhere to go, and test it before relying on it. The cyber deception readiness checklist covers how to choose and prepare a first use case.

For worked examples, see identity-led deception for cloud credential compromise, FIRCY for AWS environments, and detecting rogue AI agents with cyber deception.

Common mistakes

• Calling everything a honeypot. It blurs requirements and procurement. Say what the decoy is and what behaviour it should reveal.
• Placing a honeypot far from real adversary paths. An isolated system on the internet mostly sees automated scanning.
• Deploying tokens with nowhere to send the alert. A decoy without an owner and a response workflow is just a fake object.
• Using real data or real credentials as decoys. A decoy should create evidence, not access.
• Forgetting normal automation. Scanners, backup tools, indexers, and link previewers can all touch decoys. Understand them before setting severity.
• Never testing. Trigger every decoy in an authorised test and confirm the alert reaches the right person with enough context to act.

How FIRCY uses these terms

FIRCY uses decoy as the umbrella term, consistent with MITRE D3FEND and NIST SP 800-53 Revision 5. FIRCY still uses honeypot, honeytoken, and canary token where they describe a specific type, because they are how many teams search for and talk about deception.

FIRCY Sense uses cyber deception for active defence. Decoy credentials, documents, services, and other signals are placed where adversaries are likely to look, and each interaction becomes early-warning evidence that teams can route into existing SIEM, SOAR, ticketing, and response workflows.

To see how this fits a wider defensive strategy, read What is active defence in cyber security?.

Related FIRCY resources

• What is active defence in cyber security?
• Cyber deception readiness checklist
• Identity-led deception for cloud credential compromise
• Detecting rogue AI agents with cyber deception
• FIRCY for AWS environments
• FIRCY Sense platform

Ready to put a decoy on a real adversary path? Apply for a FIRCY Sense trial and bring one behaviour you want to detect.

Sources and further reading