A vendor is pitching us a honeypot — what is it and does it make sense for a small business?

What the vendor is offering is most likely a low-interaction honeypot. Basically, simple software that mimics a real server but only runs dummy services. It's great as an early-warning radar for catching lateral movement on your internal network, but it's not a protective shield; it just rings the bell.

Classic IT vendor move. Just the other day I saw someone trying to sell a honeypot to a company running unpatched OSs and weak passwords. It's like leaving your front door unlocked and putting a fake wallet in the yard to catch a thief. Sort out your 2FA and backups first.

We run a logistics business in Milan with about 30 machines on our network. We got a similar pitch for around €1,000 and turned it down. Instead, our own sysadmin set up an open-source canary file and a fake share. It's been running for two years at zero cost. The only time it ever went off was when an intern ran a network scan by mistake.

A honeypot has one major perk: zero false positives. A standard firewall bombards you with hundreds of pointless alerts every day. But if someone touches a honeypot, they're either an attacker or an employee breaking company policy. Still paying €150/month just to monitor it is way too steep for an SME budget.

Tell the Italian vendor this: 'We don't want an external-facing honeypot, just set up a simple virtual decoy on the internal network and roll it into our annual general maintenance instead of a monthly fee.' Rather than tying up 150 € a month, put that money toward a cloud-based backup solution.

so once you set this trap do hackers just forget about our actual ERP server while attacking it? does it basically act like a lightning rod absorbing the hit and physically shielding the rest of the company?

No, it's not a lightning rod. It only keeps a hacker busy for a few minutes. Its real purpose is to buy you time; the moment the trap is triggered, an alert pops up on your sysadmin's phone, giving you a chance to isolate the threat on the network. If there's no human around to respond, the decoy can't protect anything on its own.

My question might sound amateurish, sorry about that. The biggest time-waster for us was not knowing who had the final say.

This is my opinion, I'm not claiming it's absolute truth.

If I understood correctly, you're saying: The real issue isn't the number, but what it's based on.

Correct me if I'm wrong.

I went through the same thing. Hasty decisions become decisions you have to fix six months later.

Good luck with that.

Absolutely. If I were to add anything: Just because everyone does it doesn't mean it's right.

Hope this helps.

i agree with this then like if you get three different answers on a topic the question was asked wrong.

proven by experience.

Thanks, this was very helpful. When we decide without measuring, we always end up in the same place.

If you have questions, write them; I'll answer as best I can.

I'd say don't rush. If you get three different answers on a topic, the question was asked wrong.

Correct me if I'm wrong.

Same here.

Three different views emerged, they all complement each other. tbh most incidents start with a leaked password not a vulnerability.

If I were you I'd go this route.

Timely topic.

Good call starting this thread. When making decisions, write down the worst-case scenario too, not just the best.

Just because everyone does it doesn't mean it's right. That's all, sorry if I went on too long.