Honey Account.

A decoy credential or account — often without a full identity persona — designed to trigger alerts when attempted by an attacker. It belongs to the Defense & Operations category of cybersecurity.

A decoy credential or account — often without a full identity persona — designed to trigger alerts when attempted by an attacker.

A honey account is a credential-centric decoy: a username/password pair, an API key, a service account, or a SaaS user that is deliberately exposed in places attackers tend to look — scripts, configuration files, password vaults, repositories, or paste sites. The credential is monitored, so any authentication attempt indicates compromise. Honey accounts differ from honeyusers in emphasis: honeyusers build a believable persona (HR record, mailbox, group memberships) to catch enumeration and lateral movement, while honey accounts focus on detecting use of a leaked or stolen secret. Both are types of honeytokens and commonly overlap in mature deception programs.

Defences for Honey Account typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Decoy credential, Honey credential.