Honeyfile.

A decoy document planted in storage to trigger an alert if an attacker or insider reads, copies, or exfiltrates it. It belongs to the Defense & Operations category of cybersecurity.

A decoy document planted in storage to trigger an alert if an attacker or insider reads, copies, or exfiltrates it.

A honeyfile is a fake but believable document — for example a file named passwords.xlsx, contracts-2026.docx, or aws-keys.txt — placed in directories where curious attackers or rogue insiders are likely to browse. The file contains no real value but is instrumented so that any access generates an immediate, high-fidelity alert. Honeyfiles are cheap, generate very few false positives, and are effective for detecting lateral movement, ransomware reconnaissance, and data theft. They are typically deployed on file shares, endpoints, and cloud storage buckets alongside endpoint detection and data-loss prevention tools as part of a broader deception strategy.

Defences for Honeyfile typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Decoy file, Canary file.