Plants fake credentials, API keys, and documents across the environment that have no legitimate reason to ever be touched.

Stands up realistic decoy hosts and services alongside production systems to draw in lateral movement.

Fires an alert the instant any honeytoken or decoy is touched, since there's no false-positive path to a fake asset.

Logs everything the attacker does against the decoy, turning an early warning into free threat intelligence about their tradecraft.