Honeypot

A decoy system, account or file deliberately set up to attract attackers, so that any interaction with it signals suspicious activity and reveals their methods.

A honeypot looks like a real and tempting target, such as a server, a shared folder named "Payroll", or an administrator account, but it has no legitimate business purpose. Because nobody should ever touch it, any attempt to access it is a strong sign that something is wrong. Related tools include honeytokens, which are fake credentials or documents planted to trigger an alert when used or opened.

For a small business, honeypots can provide early warning with very few false alarms. Many attackers explore a network for some time before launching ransomware or stealing data, and a well-placed decoy can reveal them during that window. Large research honeypots also help security companies learn about new attack techniques, which improves the tools businesses rely on.

Practical tip: you do not need a complex setup. Some security platforms offer simple deception features, such as decoy files or canary tokens, that send an alert when touched. Make sure alerts go to someone who will act on them promptly.