They're trying to sell deception tech and honeypots to our 15-person office. Is this overkill or actually useful?

Here's how deception tech works: when an attacker enters the office network, they don't know what's hosted where, so they scan. The honeypot presents a fake server that looks like an easy mark. But in a 15-person setup, even an IT guy or an intern could accidentally click that share and trigger an alert. The overhead of managing it is just too much for a small office.

We paid 3,500 GBP for a similar system two years ago at our 20-person law firm in Manchester. It triggered 4 alerts all year, and all four were just our own backup software polling the local office printer. There was never an actual threat. We didn't renew when the contract ended.

Sounds like your IT provider just signed up as a reseller for a new vendor and is trying to hit their quota on the first client they can find. What kind of lateral depth exists in a 15-person network to even lay traps in? Turn it down flat.

Do not approve that 4,800 GBP spend. Ask your IT firm whether they handle centralized patch management for your machines and if your backups are isolated against ransomware. Those are your actual risks, not fake servers.

in a room with 15 people, everyone can already see each other's screens anyway. instead of scanning for fake sevrers an intruder would get info faster just glancing at the desk next to them. total fantasy purchase.

Do the 15 laptops have centrally managed antivirus or endpoint protection? Is 2FA enforced across your email accounts? If the answer to either isn't a hard yes it makes no sense to even discuss this quote.

honeypots are for huge corpps with thousands of users. like who is deceiving who on a 15-pc network lol, total waste of money honestly

To get into the details: If you don't write this down from the start, it leads to arguments later.

Start with a small trial; don't commit to everything at once. tbh hope this helps.

Following.

Exactly like that. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

I'm also curious if anyone does it differently.

the most overlooked point about what is decepion technology is this: If you don't write this down from the start, it leads to arguments later.

the biggest time-waster for us was not knnowing who had the final say.. but if I were you I'd go this route.

Great work. The harder it is to reverse a decision the slower you should make it.

If you have questions, write them; Ill answer as best I can.

I've been dealing with this for a long time. The answer varies greatly by industry; there is no one-size-fits-all rule.

If you post the result here, it will help others too.

I feel the same way. Taking measures without an inventory leaves doors you haven't seen open.

Proven by experience.

Great work.

the discussion got scattered, let me summarize and don't hesitate to ask; those who don't ask always pay more.

I think differently. Don't hesitate to ask; those who don't ask always pay more.

Of course, it varies if your situation is different.

i agree with this. tbh taking notes for two weeks yields better results than a six-month estimate.

correct me if Im wrong.