Honeypot: how to detect intrusions in a small business network
A honeypot is a device on the network that is not used for anything. No employee has any reason to connect to it, so every connection is suspicious. That makes the honeypot one of the few security tools that raise alerts with almost no false alarms, which is why it suits small businesses that have nobody sitting and interpreting logs.
Why intrusions are detected too late
Most protection is built to stop attacks at the door: the firewall blocks traffic from outside and antivirus stops known malware. But an attacker who logs in with a stolen password, or who gets in through a phishing email, often gets past both without anything raising an alert.
Once inside, the attacker starts mapping the network: which computers and servers are there, which accounts have privileges and where the backups are kept. It is this phase that decides how bad things get.
- The median time before an intrusion was detected was 14 days in 2025, according to Mandiant's annual M-Trends report.
- From the initial intrusion to an attack on the company's user directory (Active Directory) took a median of roughly 11 hours in the cases Sophos investigated.
- 83 per cent of ransomware attacks started outside office hours, according to the same Sophos report.
So the attacker has plenty of time, and likes to act when nobody is around. A honeypot targets exactly this mapping phase.
How a honeypot works
A honeypot looks like an ordinary device on the network, for example a printer, a network drive (NAS) or a router. It responds the way such a device would: it has open ports, a login page in the browser and perhaps a file service. But it contains nothing of value and is used by nobody.
When something on the network connects to it, an alert is sent. Typical things that trigger an alert:
- Port scans: someone is probing which services exist on the network.
- Ping sweeps: someone is looking for which addresses are in use.
- Login attempts via web, Telnet, SSH or FTP, often with default passwords.
- Attempts to open file shares that look interesting.
Because there is no everyday traffic to the honeypot, you do not need to set thresholds or learn to tell normal from abnormal. Either someone touches it, or they do not.
On the internal network, not on the internet
There are two kinds of honeypot. Research honeypots are placed on the internet to collect information about attacks. They receive thousands of connections a day from automated scanners and are useless as an alarm for a business.
To detect intrusions, the honeypot should sit on the internal network, behind the firewall. There, no outsider should be able to reach it, and no insider has any reason to touch it. An alert from there means something is already inside.
What it should look like, and where it should go
- Choose a believable disguise. A network drive named NAS-FINANCE or a printer on an office network looks natural. A device called HONEYPOT does not.
- Place it where the attacker looks. The same network as the computers and servers. If you have several networks, for example a separate one for the till system or guests, you may need one per network.
- Never put real data or passwords on it. Everything it shows should be fake.
- It must not become a way in. A honeypot should simulate services, not run real vulnerable systems that an attacker can take over and use as a stepping stone.
- Do not tell the whole company. The person responsible for IT and management need to know, but the fewer people who know about it, the lower the risk that someone touches it out of curiosity.
The alert must reach someone
An alert that ends up in a log nobody reads is worthless, especially when attacks usually happen at night. Make sure the alert goes to a mobile phone, as a push notification or text message, and to email as a backup. Decide in advance who receives alerts outside office hours and what that person should do. Test the alert once a month by connecting to the honeypot yourself.
A simple way to get alerts on your phone is the ntfy service, which we describe in the guide Phone alerts with ntfy.
How to get started
There are options for every budget and level of expertise:
| Option | Suits you if you | Cost |
|---|---|---|
| Canarytokens | Want to start today with fake files, links and keys that raise an alert when someone opens them. Complements a honeypot rather than replacing it. | Free |
| OpenCanary on a Raspberry Pi | Are used to Linux and want to build it yourself. Open source from Thinkst, can alert via email and webhook. | Free software, a few hundred kronor in hardware |
| Built-in honeypot in a UniFi gateway | Already have Ubiquiti UniFi network equipment. The alert ends up in the gateway's log. | Included |
| Ready-made honeypot device | Want something you just plug in, without maintaining your own installation. | One-off price or subscription |
| Enterprise services, for example Thinkst Canary | Have many networks and want central administration. | From USD 5,000 per year for two devices |
Read more about the free option in the guide Free tripwires with Canarytokens.
When the alert goes off
- Find out which device it came from. The alert contains the IP address. Look it up in the router's or DHCP server's list of connected devices.
- Rule out your own tools. Is your IT partner running a network scan right now? Has someone installed a program that searches for printers? If so, exclude that computer in the honeypot's settings.
- Disconnect the device from the network if there is no natural explanation. Unplug the network cable or turn off Wi-Fi, but do not shut down the computer. That way traces remain for whoever investigates.
- Contact your IT partner or an incident response service and tell them what the alert showed and when.
- Keep the alert and the logs. Times and addresses are needed for an investigation, a police report and any reporting to the authorities.
How a ransomware attack unfolds, and what to do if one has started, is described in the guide Ransomware: how to spot the attack before your files are encrypted.
Frequently Asked Questions
Is it legal to have a honeypot?
Yes, on your own network. You are monitoring your own equipment. IP addresses in the alerts may count as personal data, so it is a good idea to describe the monitoring in the company's IT policy, but no permit is required.
Can a honeypot give false alarms?
Rarely. What can trigger an alert without it being an attack is your own tools that scan the network, for example network monitoring or programs that search for printers. You exclude such computers once, and after that the alerts are practically always genuine.
Is a honeypot enough?
No. It detects an attacker who is already inside, but it stops nothing. Multi-factor authentication (MFA), updates and backups that cannot be deleted are still the foundation.
How many honeypots does a small business need?
Usually one per network. An office with a single network can manage with one.
Will the attacker notice that it is a honeypot?
An experienced attacker may suspect it, but by then they have already scanned or tried to log in, and the alert has gone off. Most attacks on small businesses are also partly automated and scan everything they find.