Conpot (ICS Honeypot) is a honeypot that emulates industrial control system services to attract reconnaissance and attack traffic. It helps defenders observe attacker techniques, scan patterns and payloads without exposing real equipment. The main value is visibility: alerts should be tuned to capture interaction with the decoy and feed threat hunting and detection work.
What Conpot Is Designed To Do
Conpot is a decoy environment for industrial control systems, built to look enough like real operational technology services that scanners and attackers interact with it. That design gives defenders a safe way to study reconnaissance, probing, and early-stage attack behaviour without exposing production assets.
Because the decoy is intentionally attractive, its value is not uptime or process control, but observation. The right success measure is whether it reveals useful attacker activity, not whether it behaves like a full production PLC, HMI, or historian.
How Conpot Supports Industrial Visibility
Conpot sits in the broader category of deception technology. A well-tuned decoy can surface what protocols are being touched, which service banners draw interest, how quickly automated scans escalate, and what payloads arrive after initial contact. NHIMG’s Deception Technology Guide covers how honeypots, honeynets, canary assets, and honey credentials fit together as a detection layer.
For ICS environments, that visibility is especially useful because hostile probing often precedes anything visibly destructive. Conpot can help defenders distinguish broad internet noise from activity that is specifically tailored to industrial services, which improves triage and threat-hunting prioritisation.
Where Conpot Fits In An OT Security Program
Conpot is most useful when it is treated as a sensor, not a standalone control. Its alerts should feed logging, detection engineering, and hunting workflows, and the decoy should be placed where it will be seen by the right kind of traffic without creating confusion for operations teams.
That placement logic aligns with OT security guidance on segmentation, monitoring, and safe exposure of non-production assets. NIST SP 800-82 Rev 3 explains how industrial environments differ from enterprise IT and why monitoring and boundary design matter so much in ICS.
Defenders also use established ICS advisory and coordination sources to decide what should be simulated, what traffic is interesting, and what needs escalation. CISA Industrial Control Systems is the canonical starting point for current ICS advisories, guidance, and ecosystem references.
Why Conpot Matters For Detection And Hunting
The main practical benefit of Conpot is that it turns otherwise invisible interest into evidence. A decoy can capture protocol names, source patterns, command sequences, and payload structure, giving defenders a baseline for suspicious behaviour in environments where direct experimentation on real equipment is risky.
That makes it useful for validating detections as well as discovering new ones. If the same hosts, scripts, or network paths repeatedly touch the decoy, the pattern can be turned into alerts, enrichment rules, and hunt hypotheses for the wider OT estate.
Risk and Threat Considerations
Conpot reduces risk by absorbing reconnaissance, but it also creates a deliberate point of interaction that must be monitored and contained. If it is too realistic, poorly isolated, or connected to sensitive assets, it can become a misleading signal source or an unintended pivot point.
Failure mechanism: Attackers use the decoy to learn what protocols and service patterns are present, then adapt tooling or follow-on activity to avoid simple detections. Weak isolation or ambiguous alerting can also create false confidence, where defenders mistake decoy visibility for full environmental coverage.
Impact: The organisation may miss real offensive preparation against production OT, or spend time reacting to low-value decoy noise instead of material compromise paths. In the worst case, a badly designed deception layer can distract analysts while real reconnaissance continues elsewhere.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Conpot exists to generate reviewable interaction evidence from suspicious OT activity. |
| SI-4 — System Monitoring | A honeypot is a monitoring mechanism designed to detect reconnaissance and hostile interaction. | |
| SC-7 — Boundary Protection | Conpot should be isolated and positioned so deception traffic does not expose real OT assets. | |
| Recommendation — Review honeypot events and correlate them with broader OT telemetry for hunt and response decisions. Deploy deception sensors as part of continuous monitoring for suspicious OT probing and payload delivery. Place decoy services behind strong boundary controls and keep them separated from production control paths. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The term centers on capturing and using interaction logs from a decoy service. |
| CIS-13 — Network Monitoring and Defense | Conpot is a network-visible deception asset used to observe malicious or suspicious traffic. | |
| Recommendation — Centralise honeypot logs and preserve them for correlation, hunting, and incident review. Monitor decoy network activity to detect scans, probes, and payload delivery attempts. | ||
Practitioner Guidance
Why practitioners should care: Conpot is only valuable when it is engineered around a detection objective, not deployed as a novelty service. Define in advance which interactions should trigger investigation, and make sure the decoy produces logs that can be consumed by the monitoring stack you already trust.
What to watch for: Repeated scans, protocol-specific probing, and payloads that are shaped to industrial services are the interactions most likely to justify escalation. The best deployments are those that convert those touches into clear, reviewable evidence for hunting and tuning.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org