Someone pitched us a honeypot — what is it, and does it make sense for an SMB with two servers?

If a honeypot isn't isolated properly, it can actually backfire on you. If your IT guy clumsily sets up a high-interaction decoy and an attacker compromises it, they can use it as a pivot point straight into your internal network or ERP server. Both deployment and monitoring require serious expertise.

Classic tech vendor tactic. People in the office are probably all using "123456" as their password and proper server backups aren't even running, but this guy wants to build you a NASA-tier decoy so he can bill you every month.

Put that budget straight into an offline backup unit instead. Have it back up at night and disconnect from the network. If ransomware hits tomorrow, an isolated backup will save you, not a honeypot.

We got talked into something similar for our 20-person office; they charged 600 Euro for setup and wanted 100 Euro a month to monitor it. It triggered 40,000 bot scan alerts in a month. Nobody ever sat down to read those logs, so by month three we completely shut it down.

Before pitching a honeypot did your IT guy close off the remote desktop port on the office ERP server? Did he enforce 2FA for all users? If the answer to either is no you should definitely question his motives.

for a two-server setup a honeypot is totally overkill and pointless. honestly get a firewall, put things behind a vpn use strong passwords, and you're more than good.

note: I wrote this based on my own experience, it might not apply to everyone.

Honeypot architectures generally make sense for large-scale enterprises that run an in-house Security Operations Center (SOC) or face direct targeted cyber-espionage threats. At the SME scale, the risk-benefit and cost balance is definitely not rational.

just politely decline the offer imo. spend your money on patching basic vulnerabilities and getting a solid backup system instead you'll sleep much better at night.

Edit: asked below, I wrote the answer in the second message.

We need to make a distinction here. An untested backup is not a backup.

Processes without records never improve, because you don't know what to fix. Proven by experience.

It's rare to find an explanation this clear.

I'll try it. People defend habits not processes. Resistance comes from there.

Of course, it varies if your situation is different.

The opposite happened to me, that's why I'm writing. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Any unwritten clause becomes a point of disagreement later, as both sides remember it differently. Hope this helps.

I'll try it. Forgotten test environments are more often the entry point than live systems.

Proven by experience.

Exactly, and not many people know this. Mistakes made on the what is a honeypot side are usually reversible but expensive.

If I understood correctly, youre saying: Security isnt absolute; its about making attacks not worth the effort.

If you have questions, write them; Ill answer as best I can.

I think differently. An automated scan report is not the same as a penetration test.

I'm also curious if anyone does it differently.

I'm in the same situation, that's why I'm asking. An automated scan report is not the same as a penetration test.

If you post the result here, it will help others too.

i disagree with you on this point then having backups accessible on the same network and with the same identity makes them part of the target.