Decoys & Honeypots
Decoys and honeypots are the core intelligence collection mechanisms of Defused. You can access these capabilities either as managed offerings or through standalone / self-deployed systems. The deployment model varies by tier:
- Defused TF - Streams data from Defused’s internally hosted, globally distributed honeypot network.
- Defused EX - Supports managed deployment of honeypots that are dedicated to you (their alerts and telemetry belong exclusively to your account).
- Defused IB and Enterprise - Support on-premise deployment using multiple deployment options and integration models.
Deploy Logic (TF)
Defused TF does not require you to deploy anything. Instead, TF provides access to a set of pre-built, continuously-operated honeypot feeds. Users subscribe to these feeds and consume telemetry in real time.
Each feed has two characteristics:
Feed Strength
Indicates how active a feed currently is based on observed attacker interaction volume.
Feed Age
Reflects how long a feed has been deployed:
- Cold - Not yet deployed
- Warming - Deployed for less than 3 days
- Warmed Up - Deployed for more than 3 days and producing stable telemetry
Feeds are occasionally recycled and redeployed to maintain signal over time.
Subscription Locks
To protect the managed infrastructure that Defused provisions and operates on your behalf, new feed subscriptions are locked for the first 3 days after activation.
During this warm-up period, the feed cannot be unsubscribed.
Deploy Logic (EX)
For Defused EX, users can deploy managed assets directly from the same interface using the Deploy this Decoy section.
This action deploys the selected decoy into the Defused Managed Network.
EX provides dedicated honeypots whose telemetry is not shared across tenants.
Note: Defused EX is becoming generally available in Q1 2026.
On-Premise Deployment (IB / Enterprise)
For on-premise deployment models, refer to the legacy documentation:
https://console.defusedcyber.com/documentation