HoneyHarbor

SMBs may benefit from active deception but lack staff to operate believable decoys, isolate them and review attacker evidence. HoneyHarbor deploys disposable tenant-scoped sensors, records protocol interactions, uses constrained generation to vary fake environments, and surfaces investigation candidates in a managed dashboard. The supplied research confirms several active open-source LLM honeypots with multi-feed reporting, one verified capability and an expensive managed-deception incumbent, while finding no SMB-priced managed LLM-deception service. The closest source project is AGPL-licensed, so a commercial service requires a documented license strategy or clean-room implementation; copying code is not permitted by assumption. Automatic external reporting is unsafe: IP addresses can belong to proxies, compromised hosts, researchers or shared infrastructure. Sensor observation, fingerprint candidate, cross-sensor correlation, analyst disposition, report approval, feed acknowledgement, later reputation action and remediation remain separate. Generated decoys operate with default-deny egress, synthetic secrets and no production authority. Cross-customer correlation uses minimized, purpose-limited features only with tenant authorization and cannot expose another tenant's events. Success is earlier, reviewable detection evidence—not attacker identity, guaranteed prevention or a universal reputation verdict.

An SMB security leader or managed security provider that wants active deception coverage without operating a sensor fleet internally.