A spreadsheet named Payroll_Adjustments_2026.xlsx sits on a finance file share. Nobody in finance uses it, nobody outside finance has any reason to look for it, and nobody has opened it in a year. At 2:14 on a Saturday morning it is opened from a marketing workstation, and the security team gets one alert that is almost certainly real.
That spreadsheet is a decoy, and decoys are the core of deception technology: assets that exist only to be found by someone who shouldn't be looking. On the CompTIA Security+ SY0-801 exam, deception and disruption technology sits under objective 4.1, a scenario objective that expects you to choose the right mitigating control for a situation. This lesson covers honeypots, honeynets, honeyfiles, honeytokens and canary accounts, how each one raises an alert, and the legal and operational care they need.
Deception works because no legitimate user has a reason to touch the bait
Most detection tools look for something bad hidden in a large volume of normal activity. An IDS matches traffic against signatures, and a SIEM rule looks for patterns such as ten failed logins in a minute. Both produce false positives, because normal users and systems sometimes behave strangely.
Deception reverses that problem. A decoy has no business purpose, so it should see no legitimate activity at all. If nobody should ever log in to a server, open a file or use a credential, then any login, open or use is suspicious by definition. That is why deception alerts are called high-fidelity: when one fires, it is rarely noise, and the team can act without first proving it is real.
Deception is a detective control in the technical category. It blocks nothing; its value is speed. Intruders who get past the perimeter often spend days or weeks exploring before they reach their goal, and almost all of them enumerate servers, file shares and accounts early, so a well-placed decoy can cut that dwell time from weeks to minutes.
The objective says deception and disruption because decoys also waste an attacker's time, feed them false information, and force them to treat every target as a possible trap.
A honeypot is one decoy system; a honeynet is a network of them
A honeypot is a system built to look like a worthwhile target: a file server, a database, a web application, an SSH or RDP host. It holds no real data, serves no real users, and logs everything that touches it.
Honeypots come in two broad designs:
- Low-interaction honeypots emulate services. They listen on ports such as 22, 445 and 3389, answer just enough to look real, and record connection attempts and the usernames and passwords tried. They are cheap and safe because there is no real operating system for the attacker to take over, but they reveal little beyond the first move.
- High-interaction honeypots run real operating systems and applications. The attacker can log in, run tools and try to escalate privileges, so defenders learn far more about techniques and malware. The cost is risk: a real system can really be compromised and turned against someone else.
Placement changes what a honeypot tells you. One exposed to the internet collects a constant stream of automated scans and exploit attempts, useful for research and threat intelligence but noisy as an alert source. One placed on the internal network, where nobody should be scanning, is a strong lateral movement detector. A few lines like these from an internal decoy file server tell the team exactly which workstation to isolate first:
2026-10-18T02:14:07Z decoy-fs02 smb auth src=10.20.4.117 user=CORP\svc_backup result=fail
2026-10-18T02:14:09Z decoy-fs02 smb auth src=10.20.4.117 user=CORP\administrator result=fail
2026-10-18T02:14:22Z decoy-fs02 rdp conn src=10.20.4.117
A honeynet is two or more honeypots connected into a realistic environment, for example a fake domain controller, a file server and a few workstations on their own segment. Its purpose is to watch an attacker move between systems, capture the tools they drop, and learn how they operate. A gateway in front of the honeynet, sometimes called a honeywall, records traffic and limits what can leave, so the attacker can explore without using the honeynet to reach anything real.
Don't confuse either with a sandbox. A sandbox detonates a suspicious file you already have in an isolated environment, while a honeypot waits for an attacker to come to it.