In simple terms, a honeytoken is a decoy that is too tempting for an attacker to ignore but is not immediately recognized as fake. An example could be an account with elevated privileges. It is placed as a detection tool to entice attackers to interact with it (such as opening, copying, or using it). Once an attacker uses or accesses a honeytoken, the detection team receives a notification, prompting an immediate investigation into the potential attack.

Nerium aims to detect attackers as early as possible in various stages of an attack (cyber kill chain). Therefore, Nerium implements multiple customized detections across different digital layers. However, not every detection method is foolproof, and achieving 100% security is not feasible. The complexity of modern IT environments, including a wide range of systems, cloud infrastructures, encrypted network traffic, and limited visibility, can make it challenging to develop effective detection methods. In this regard, honeytokens can serve as specific point solutions to address these shortcomings.

Where do you implement these? Essentially everywhere, in cloud environments such as Azure, Google, and Amazon. But also on-premises, on servers, networks, applications, and workstations.