Credential Security

Use Honeytokens to Detect Credential Misuse

Many security alerts begin with ordinary activity: a login, an API request, or a secret being read. The difficult question is whether that activity is legitimate. A real credential may be used by several expected systems, so a single use often provides weak evidence of compromise. A honeytoken changes that problem by creating an identity or credential that has no legitimate operational use. If something tries to use it, the event is unusual by design and can produce a high-signal alert.