A decoy system or server set up to attract attackers, so their techniques can be studied. In OT, a honeypot might mimic a PLC or a SCADA server to lure in would-be intruders. Researchers deploy ICS honeypots that emulate vulnerable control systems to see how attackers behave when they think they’ve found an exposed power plant or factory. The honeypot has no real control over a process. It’s a trap, and any interaction with it is by definition suspicious, since legitimate users wouldn’t normally be there.
