Do honeypots and canary tokens make sense for a small business, are there risks?

First check whether you've sorted out the basics. Is 2FA enforced on all accounts? Are server backups kept air-gapped from the network? Putting a honeypot on the server while lacking these basics is like installing a motion sensor in the living room of a house without a lock. If basic hygiene is in place, then consider the trap.

If an attacker has already breached your server to the point of rummaging through files it's pretty much too late anyway. In a 12-person firm closing server ports to the outside and placing remote access behind a secure network is a far smarter and cost-free investment than trying to catch an intruder from the inside.

At our 15-person logistics company of similar size, we set up 3 trap files two years ago. Over two years the alarm went off 4 times; 3 were our own staff cleaning up the server or wandering into the folder by mistake, and one was an antivirus scan opening the file. We never caught a real attack, but the false alarms caused quite a bit of panic.

our accountant got curious and opened the trap file thinking it was the payroll list an alert went to the general manager's phone in the middle of the night and all hell broke loose. it's definitely super hard to distinguish curious internal staff, use with caution.

edit: fixed a few typos.

Before making a decision, I recommend following this priority: 1) Local server blocked from the external network, 2) Mandatory strong passwords and two-factor authentication, 3) Daily offline backups, 4) Basic phishing awareness training for employees. Budgeting for trap tech before these four items are established is just an unnecessary expense.

when they plant this trap file on the server how do they control whether staff can see it or not? i mean do they drop it into regular folders or does it sit in a hidden folder?

note: I wrote this based on my own experience, it might not apply to everyone.

Before committing to 2,500 TL a month, have your consultant run a single test as part of their consulting scope. Have them place a trigger file just on the local public share, see how many false positives pop up over a month, and evaluate the operational overhead that way.

On the personal data protection side informing the staff is critical. Before your consultant places any trap files I recommend serving notice to your employees with a document clearly stating in your information security policy that company resources are auditable and unauthorized access attempts are logged.

My question might sound amateurish, sorry about that. If 2FA is on, a stolen password alone is useless.

Could you elaborate on that? If 2FA is on, a stolen password alone is useless.

There's a part I don't understand. If 2FA is on, a stolen password alone is useless.

Proven by experience.

I completely agree. Taking notes for two weeks yields better results than a six-month estimate.

Proven by experience.

Noted thanks. Everything goes well for the first three months; problems arise in the fourth.

If I were you I'd go this route.

same here.

Timely topic.

Thanks a lot I'll try it today. The answer varies greatly by industry; there is no one-size-fits-all rule.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection. Proven by experience.

sorry but this doesn't apply in every case but like if it's your first time start small; scaling comes later.

I'll try it.