SECAI Core · phase 14 of 15
Honeypot
A host (honeypot), network (honeynet), file (honeyfile), or credential/token (honeytoken) set up with the purpose of luring attackers away from assets of actual value and/or discovering attack strategies and weaknesses in the security configuration.
The Explain card
- Plain English
- A honeypot is a decoy host, network, file or credential set up to lure attackers away from real assets and to reveal their tools and techniques when they take the bait.
- Example
- A company plants a fake API key labelled "prod-admin" inside a document accessible to its AI assistant. Any attempt to use that key signals a prompt injection or data exfiltration in progress.
- Why it matters
- Honeypots and honeytokens produce almost no false positives: legitimate users never touch them. For AI systems they are a cheap tripwire for injection, scraping and credential theft.
- Hook
- Bait that bites back.
Where it sits in the deck
Phase 14: Incident Response, Evaluation, and Knowledge Bases
When detection fires, teams need structured response plans, scoring frameworks, and curated knowledge bases to triage, measure, and learn from AI security events.
