Conpot is used as a honeypot for industrial control systems to simulate exposed industrial services and observe attacker behaviour. Security teams use it to detect scanning, credential attacks and protocol abuse without placing real OT assets at risk. It should be isolated, monitored closely and treated as deception infrastructure rather than production control equipment.
Why Conpot Is Useful in Security Testing
Conpot gives defenders a safe way to study hostile behaviour against industrial control system services without touching production OT. It is most useful when the test objective is to observe what gets probed, how attackers sequence reconnaissance, and which protocols or credentials they try first. That makes it a detection and intelligence tool, not a control-system simulator for operational use.
A Deception Technology Guide is the most natural reference point for how Conpot fits into broader deception design, including honeypots, honey credentials and decoy assets. Conpot belongs in that family because its value comes from believable exposure, logging and safe containment rather than functional control.
For security testing, the key question is whether the simulated service surface is realistic enough to attract the right traffic. If the decoy is too shallow, attackers may ignore it; if it is too convincing but poorly isolated, it can create unnecessary operational risk. The test therefore measures both attacker interaction and the quality of the containment boundary.
What Security Teams Learn From Conpot
Conpot is most informative when you want to see how scanners, bots and hands-on intruders behave after they find exposed industrial services. Teams can use it to identify common enumeration patterns, identify whether default credentials are attempted, and see which protocol features attract follow-up interaction. That evidence helps refine monitoring, alerting and exposure management around real OT-facing assets.
It is also useful for validating whether defenders can distinguish harmless deception traffic from events that deserve escalation. In practice, the value is not just that Conpot receives hits, but that those hits can be translated into actionable detection logic, better triage rules and a clearer understanding of what “normal” hostile probing looks like in an OT-adjacent environment.
MITRE ATT&CK Enterprise Matrix is a useful companion when you want to map observed activity to reconnaissance, credential access and lateral movement patterns. Even when Conpot is deployed outside an enterprise network, ATT&CK helps analysts turn raw interaction logs into threat-actor technique hypotheses.
OWASP API Security Top 10 is less about Conpot itself than about the habit of testing exposed interfaces for weak authentication, unsafe consumption and authorisation flaws. That mindset translates well to industrial protocols, where exposed services often fail because access assumptions are broader than operators realise.
How to Use Conpot Safely and Realistically
Conpot works best when it is placed behind strong isolation, monitored continuously and treated as a sensor for attacker behaviour. Its purpose is to attract, record and analyse hostile interaction, so the deployment should be designed to prevent any accidental path into production OT, adjacent IT systems or shared credentials. The more believable the decoy, the more important that separation becomes.
A NIST Privacy Framework is not the primary lens here, but its discipline around collection, minimisation and governance is still helpful when logs may contain network artefacts, identifiers or operator data. In a security-testing context, the same principle applies: capture enough to investigate, but avoid turning a deception node into a data sink with weak oversight.
NIST SP 800-53 Rev 5 Security and Privacy Controls is a practical anchor for the surrounding controls: access restriction, audit logging, configuration management and system integrity. Those controls matter because a honeypot is only useful if its own administration, telemetry and containment are trustworthy.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1595 — Active Scanning | Conpot observes scanning and reconnaissance against exposed services. |
| Recommendation — Map decoy hits to reconnaissance techniques and tune detections for exposed OT services. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Conpot commonly attracts credential attempts against exposed interfaces. |
| Recommendation — Validate exposed service authentication paths and alert on weak or repeated login attempts. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | Honeypot value depends on reliable logging of hostile interaction for analysis. |
| SC-7 — Boundary Protection | The honeypot must stay segregated from production OT and adjacent systems. | |
| CM-2 — Baseline Configuration | Conpot needs controlled, known-good setup so telemetry and containment remain trustworthy. | |
| Recommendation — Define and retain the audit events needed to investigate interaction with the decoy. Enforce boundary controls so the decoy cannot pivot into real operational assets. Lock down the honeypot baseline and review any configuration drift before redeploying. | ||
Practitioner Guidance
What to verify: Confirm that Conpot is isolated enough that no route exists from the honeypot into real OT services, shared admin tooling or reused credentials. If the deployment can be reached from a production trust zone, it is too risky to use as a decoy.
What to measure: Track which protocols, source patterns and credential attempts recur most often, then compare that traffic with alerts from real industrial environments. The goal is not volume alone, but signal quality and whether the decoy is improving detection decisions.
Common mistake: Treating the honeypot as a proof of security rather than an observation platform. A successful deployment can still reveal poor segmentation, weak monitoring or exposed services that need remediation.
Practitioner takeaway: Conpot is most valuable when it is used as a controlled deception sensor, not a fake system to be trusted. Its real payoff comes from safe exposure, disciplined logging and the ability to turn attacker interaction into better OT detection and containment.