Our consultant suggested setting up a honeypot on our network: What is this trap, and do we really need it?

Technically speaking, a honeypot is a decoy server on your network with deliberate fake vulnerabilities that carries zero legitimate business traffic. A normal employee would never connect to it; therefore, any packet hitting it is an immediate indicator of an attack or malware.

Sounds like your consultant is pitching what's easy to sell and ties you to a monthly subscription, not what you actually need. The priority for an 18-person logistics firm is isolated backups against ransomware, not laying traps.

We set one up out of curiosity at an office of similar size. It logged thousands of automated bot scans a day, but 99% of it was just general internet noise. Without an in-house expert to respond, the log files just ended up eating disk space on the server.

Spend that 130,000 rubles on a solid hardware firewall and an automated offline backup setup. It makes far more sense to make breaking in harder in the first place than to just get an alert after an attacker is already inside.

unless ur a major bank or a telecom company honeypots are pure overkill. just enforce strong passwords for staff and enable 2fa and ur good.

I saw a similar setup at a customs firm last year. Nobody checked the decoy logs for months and the real attack started when the accountant clicked a phishing email. The trap did absolutely nothing.

Is this planned honeypot going to be exposed to the outside web or kept strictly on the internal network? If it's internet-facing, an amateurish configuration could easily turn into a stepping stone for attackers to pivot deeper into your network.

The fundamental rule of security is reinforcing the weakest link. In an 18-person business, the weakest link isn't server exploits; it's users opening fake invoice attachments. Allocate your budget to staff awareness training and proper backups.

I've been dealing with this for a long time. If you don't write this down from the start, it leads to arguments later.

If you post the result here, it will help others too.

I'll argue the opposite don't get mad. When making a decision, first look at what data you have on hand.

If permission and scope aren't in writing, don't start that test. anyway this is my opinion, I'm not claiming it's absolute truth.

We need to take it step by step. When you try to change everything at once, nothing settles.

When making decisions, write down the worst-case scenario too not just the best.

I'd appreciate it if you shared the outcome.

Correct in theory, but it doesn't work that way in practice. Security isn't absolute; it's about making attacks not worth the effort.

Good luck with that.

Let me summarize what's been said so far. An automated scan report is not the same as a penetration test.

If you post the result here, it will help others too.

I've been dealing with this for a long time. Mistakes made on the what is a honeypot side are usually reversible but expensive.

If 2FA is on, a stolen password alone is useless. Correct me if I'm wrong.

i agree.

I went through the same thing.

you're right. like hasty decisions become decisions you have to fix six months later.

this is my opinion, Im not claiming its absolute truth.