What is a honeypot?
A honeypot is a fake system or service that looks like a real, attractive target to an attacker, but exists only to deceive attackers, detect them and record how they operate. Because no legitimate user ever needs a honeypot, every interaction with it is suspicious by definition. In OT networks you use a honeypot to spot reconnaissance, unauthorised access and lateral movement early, without putting critical systems at risk.
Honeypots help with threat detection, forensic investigation and improving OT security strategies.
🎯 Why do you use a honeypot?
Security researcher Lance Spitzner defined a honeypot as an information system resource whose value lies in unauthorised or illicit use of that resource. The idea is older: in the late 1980s Clifford Stoll lured a spy with fake files, as he described in The Cuckoo’s Egg (1989). The Honeynet Project, an international non-profit research organisation that has since developed many open source honeypots, was founded in 1999.
A honeypot delivers three things:
- Detection with very little noise - an alert from a honeypot is almost never a false positive, because no normal traffic should reach it. That is a big difference from an IDS, which has to separate legitimate from malicious traffic.
- Threat Intelligence - you see which TTPs, tools, passwords and malware attackers actually use, and you can map them with MITRE ATT&CK for ICS.
- Delay and deception - an attacker who wastes time on a decoy reaches the real process later and gives themselves away.
🧠 How does a honeypot work?
- A fake system or service is configured with apparent functionality, such as a web interface, open ports and a realistic device name.
- The honeypot is made visible on the network: on the internet to measure broadly, or internally to catch intruders.
-
Every interaction is logged:
- login attempts and the passwords used;
- scans and protocol requests;
- Malware downloads and executed commands.
- The data goes to a SIEM or OT SOC and is analysed for Threat Intelligence or anomaly detection.
Honeypots differ mainly in the level of interaction they allow:
| Type | What the attacker gets | Risk | Typical use |
|---|---|---|---|
| Low-interaction | Emulated services that answer only the first steps of a protocol | Low | Measuring scans and automated attacks, internal detection |
| Medium-interaction | More convincing emulation, such as a fake shell or simulated registers | Medium | Capturing attack tools and commands |
| High-interaction | Real operating systems or real PLCs and HMIs | High | In-depth research into targeted attackers |
There are also honeytokens: fake credentials, fake documents or fake database records that raise an alarm as soon as someone uses them. A network of cooperating honeypots is called a honeynet.
🏭 How do you deploy honeypots in OT environments?
In OT a honeypot is all about credibility: an attacker exploring a factory or a water treatment plant is looking for industrial devices and protocols. Typical applications:
- Fake PLC or SCADA interfaces that resemble real industrial systems, complete with brand name, firmware version and process values.
- Emulation of industrial protocols such as Modbus, S7, ProfiNET, BACnet and IEC 60870-5-104 to lure network scans.
- Detection of unauthorised access attempts on remote access, for example a fake engineering workstation or a fake VNC service.
- Internal decoys at every level of the Purdue Model, so that an intruder who is already inside stands out as soon as they start looking around.
- Support for Threat Hunting and Security Monitoring with concrete leads and IOCs.
The best-known open source example is Conpot, a low-interaction ICS honeypot from the Honeynet Project community. Conpot emulates S7, Modbus, IEC 104, EtherNet/IP, BACnet, SNMP, HTTP, FTP and IPMI, among others, and ships templates for devices such as a Guardian AST tank gauge and a Kamstrup energy meter. Conpot 1.0.0 was released on 20 September 2026: a complete platform rewrite in which templates moved from XML to TOML and attacks are logged in structured form to JSON, SQLite, syslog and TAXII, among other outputs.
| Study | Year | Set-up | Key lesson |
|---|---|---|---|
| Trend Micro ICS honeypots | 2013 | Three honeypots imitating the water pressure station of a small American town | 39 attacks from 14 countries in 28 days (automated scans not counted); first signs of attack after only 18 hours |
| GasPot | 2015 | Emulated Veeder-Root Guardian AST tank gauges in seven countries | Fuel stations are actively scanned and tampered with too |
| Trend Micro fake factory | 2019 | Realistic factory with PLCs, robots and open VNC, online for seven months | Mostly cryptominers and CrySIS ransomware, but also attackers who shut the system down |
🔄 How does a honeypot relate to other security measures?
| Measure | What it does | Difference from a honeypot |
|---|---|---|
| Honeypot | A single decoy system that lures and records attackers | Every interaction is suspicious |
| Honeynet | A network of multiple honeypots with routing and switching | Imitates an entire environment |
| IDS | Passive detection of suspicious activity on real systems | Must separate normal from anomalous traffic |
| NDR | Behavioural analysis of network traffic | Sees everything, but with more noise |
| Threat Simulations | Controlled imitation of attacks on your own environment | Tests your defences, does not lure real attackers |
A honeypot therefore does not replace network segmentation, firewalls or monitoring. It is an extra layer within defence in depth that is most valuable where other detection produces too much noise.
🔧 Which steps do you follow to set up an OT honeypot?
- Define the goal - do you want to detect internal intruders, or research internet attacks? For detection, a low-interaction honeypot is almost always enough.
- Choose the location - place internal decoys in the same VLANs as real devices, or in the DMZ between IT and OT. An internet-facing research honeypot belongs in a fully separated environment.
- Make it credible - use device names, IP addresses and firmware versions that fit the rest of your installation.
- Isolate it - a honeypot must never offer a route to real production systems and must not send outbound traffic to the internet.
- Connect it - send every alert to the SIEM and record in the incident response plan what a honeypot alert means.
- Maintain it - a honeypot that stays unchanged for years stands out. Update templates and regularly test that alerts arrive.
In the Netherlands and the wider EU, keep the GDPR (in Dutch the AVG) in mind: IP addresses and other visitor data generally count as personal data, so limit retention periods and document your legal basis. Do store logs with forensic care, so they remain usable for forensic investigation or a police report.
🔐 What are the risks and pitfalls of honeypots?
- No production data or real access in the honeypot; a compromised honeypot must reveal nothing.
- High-interaction is risky - an attacker can use a real, hijacked machine as a stepping stone or for attacks on third parties.
- Fingerprinting - the default settings of well-known open source honeypots are recognisable to scanners. Always customise them.
- False reassurance - a silent honeypot does not mean there is no attacker; they may simply not have found the bait.
- Combine with a SIEM for alerting and correlating attacks, and use honeypots to test anomaly detection as well.
A low-interaction honeypot is low risk with a high information yield, provided it is well isolated and credibly configured.
❓ Frequently asked questions
Is a honeypot legal?
A honeypot on your own network is generally legal in the Netherlands and the EU, as long as you use only your own systems and handle the collected personal data in line with the GDPR. A honeypot must never be used in a way that enables attacks on third parties. When in doubt, seek legal advice, especially for high-interaction honeypots.
Can a honeypot sit in a production OT network?
A low-interaction honeypot can serve as an internal decoy in an OT segment, because it controls no real process and offers no route to production systems. A high-interaction honeypot with real PLCs, on the other hand, belongs in a fully separated environment. What matters most is that the honeypot can never influence the physical process.
What is the difference between a honeypot and a honeytoken?
A honeypot is a complete fake system or service, whereas a honeytoken is a single piece of bait, such as a fake password, fake file or fake database record. Both raise an alarm as soon as someone uses them. Honeytokens are cheap and easy to scatter across real systems.
Which open source honeypots exist for OT?
Conpot is the best-known open source ICS honeypot and emulates Modbus, S7, IEC 104, BACnet and EtherNet/IP, among others. GasPot specifically imitates a fuel station tank gauge. Commercial deception platforms also offer centrally managed OT decoys.
How quickly are honeypots attacked?
An internet-facing honeypot is usually scanned within hours. In Trend Micro’s 2013 ICS honeypot research, the first signs of attack appeared after only 18 hours. An internal honeypot, by contrast, should stay silent, so every alert from it deserves immediate investigation.
Does a honeypot replace an IDS?
A honeypot does not replace an IDS, because it only sees traffic aimed at the decoy and not what happens between real systems. The two complement each other: the IDS watches real traffic, while the honeypot gives reliable, low-noise alerts. Together with a SIEM they form a strong detection layer.
📌 In summary
A honeypot is a decoy that deceives attackers and records their methods, so you spot intruders early without endangering your OT production network. For detection, choose a well-isolated, credible low-interaction honeypot, connect it to your SIEM and define what an alert means.