Deception
Self-hosted deception: where it fits, and where it does not
A successful login tells you almost nothing. A touched decoy tells you almost everything. This page covers what the deception options actually are — including the free ones from Thinkst themselves — and how to place bait so that it fires when it matters.
Credit where it is due. Thinkst did more than anyone to make deception mainstream, and they give away two of the best tools in the category. If your budget covers their appliance, buy it — it is excellent, and this page is not an argument against it.
Why deception works when signatures struggle
Detection by signature asks: does this behaviour look bad? The answer is usually ambiguous, which is why alert fatigue exists and why analysts stop reading the queue.
Deception asks a different question: did anyone touch the thing that has no legitimate use? A link nobody should open. A share nobody should browse. A port nobody should connect to. A real user has no reason to go there, so a trip is almost never a false alarm.
You do not hunt the needle in the haystack. You plant a needle that screams.
The practical consequence is signal-to-noise. A honeypot alert does not need triage in the way a SIEM correlation does — the question is not is this real? but who, and how far in?
The options
| Option | Runs where | Covers | Cost |
|---|---|---|---|
| Canarytokens.org Thinkst, free |
Thinkst's servers | Tokens only — URLs, documents, DNS and more | Free |
| OpenCanary Thinkst, open source |
Yours | Honeypot services. Tokens and console are not included | Free |
| Thinkst Canary commercial |
Devices yours, console hosted | Devices, tokens and console together, supported | Roughly $5k–$14k per year depending on device count1 |
| Decoy this project |
Yours, entirely | Tokens, document beacons, honeypot services and console in one binary | Free edition Apache-2.0 |
Read that table for what it is: three good options and one more. The self-hosted case is narrower than “it is cheaper”. It matters when the trip evidence itself is sensitive — when a token firing reveals an internal hostname, a project name, or a client's infrastructure that you are contractually not allowed to send anywhere. If that is not your situation, the free hosted tokens are excellent and you should use them.
Decoy
One Go binary. Tokens, document beacons, honeypot listeners and the console in the same process, on your infrastructure. Trips, evidence and alerts never leave your network. Licence validation is offline Ed25519 — nothing phones home in either edition.
- Web/URL tokens — unguessable links that alert the instant they are fetched.
- Document beacons — a .docx, .xlsx or .pdf that reports the opener's IP the moment it is opened.
- Honeypot services — fake SSH, RDP, admin-panel and database ports that log every connection and every credential tried.
- DNS and cloud-credential traps — catch scanners that resolve before they connect, and attackers harvesting fake keys.
Findings can be emitted as RFC 3164 syslog, so a Decoy trip lands next to your existing detections rather than in a separate inbox.
Where to place bait so it actually fires
Coverage equals placement. This is the part that decides whether deception works for you, and no product can do it for you.
- Somewhere only lateral movement would reach — not the front door. Bait on your perimeter catches internet background noise and teaches you nothing.
- Named like something worth stealing, not like a trap.
backup-keys,payroll-2026.xlsx,vpn-config-old. Neverhoneypot, nevercanary. - Route the alert somewhere a human reads. One trip is not noise, and it should not land in a channel nobody opens.
- Tell your own team it exists, at least at the right level. A trip investigated as a breach when it was an over-curious junior admin costs everyone a night.
Honest limits
- Deception is detection, not prevention. It tells you someone is in; it does not keep them out.
- A trap only fires if an intruder finds it. Bad placement means silence, and silence looks exactly like safety.
- Document beacons fire only in clients that fetch remote content — many, not all.
- DNS tokens and full cloud-credential-misuse detection need external setup: a delegated zone, and CloudTrail on the AWS side.
- Not a replacement for EDR or a SIEM. A high-signal complement to both.
Plant only in your own systems. Decoy is bait for your environment, to catch someone in your environment. It is passive — it records who came, it never attacks back. Read SAFETY.md before you start; it is short, and it keeps you on the right side of the law.
Run it
Grab the tarball and SHA256SUMS from the releases page, then:
sha256sum -c SHA256SUMS
tar -xzf decoy-free-*-linux-amd64.tar.gz
./decoy
# dashboard on http://127.0.0.1:84241 Thinkst does not publish list pricing. The range quoted is from aggregated buyer transaction data reported by Vendr (median around $9,900 per year, low end around $5,100, high end around $13,620). Treat it as an order of magnitude, not a quote — your number depends on device count and contract term.