A new perspective in cybersecurity
A radar operator somewhere in Europe, in the early 1940s. A bright dot on the screen. It could be an enemy bomber closing in. It could be atmospheric interference, a flock of birds, a fault in the equipment. The operator has a few seconds to decide, and whichever way they get it wrong, the cost is high: ignoring a real aircraft is a disaster. Raising the alarm over interference, again and again, means that next time nobody will believe the screen.
From this problem, simple to state and brutal to live with, grew an entire field of study that we now call Signal Detection Theory. It was formalized statistically in 1954 by Peterson, Birdsall and Fox, and in the same year adapted to human perception by Tanner and Swets. In 1966, Green and Swets turned it into a standard reference with "Signal Detection Theory and Psychophysics". From then on, the radar operator's problem stopped being a radar problem.
Four outcomes, no way out
Every time a system, human or automatic, has to decide whether an ambiguous signal is real, there are only four possible outcomes. The signal is there and it is recognized: a hit. The signal is there but goes unnoticed: a miss. The signal is not there but is mistaken for real: a false alarm. The signal is not there and is correctly ignored: a correct rejection.
The uncomfortable part of the theory is this: the first two errors and the last two pull against each other. Raising a system's sensitivity, making it react to weaker signals, reduces misses but inevitably increases false alarms. Lowering it does the opposite. There is no threshold that wipes out both errors at once when the signal you are trying to recognize is ambiguous by nature. It is a law, not a technical limit that the right tool could overcome.
The same problem, wherever we try to see in the dark
What makes signal detection theory interesting is not the radar itself. It is that the exact same trade-off reappears, unchanged, in every field that has to tell something real from something that merely resembles it.
In radiology, a shadow on a scan can be a tumor or an artifact of the image. The problem has not been solved, only managed: independent double reading by two radiologists, diagnostic support systems, and above all an explicit choice about where to set the bar. In cancer screening, a higher number of false alarms is knowingly accepted so as not to miss a real tumor, because the cost of the two errors is not symmetrical: an unnecessary recall is an inconvenience, a missed tumor is someone's life.
In criminal justice, a piece of evidence can point to guilt or be a coincidence. Here too there is no solution, only a declared policy on the trade-off: "beyond reasonable doubt" is, in signal detection terms, a decision threshold deliberately set to minimize the conviction of innocent people, even at the cost of letting more guilty ones go free than a more aggressive system would.
In anti-fraud, a claim can be genuine or staged. The job has never been to tell the two apart with certainty: it is triage on a large scale, with risk indicators, recurring patterns, and in-depth checks only where the cost of the investigation is justified by the likelihood of fraud. Here too, directing attention to more suspicious cases inevitably means investigating more honest claims as well.
And in cybersecurity the same pattern holds almost unchanged. A login at 11:47 p.m. with valid credentials can be an administrator working late or an attacker moving laterally through the network. UEBA systems, which build a statistical "normal" of behavior and flag deviations, face exactly the trade-off between hits and false alarms, with the same cost it has everywhere: higher sensitivity means more alerts, and beyond a certain point more alerts mean nobody really reads them anymore. It is the alert fatigue that every overloaded IT manager knows firsthand.
In none of these fields has the trade-off ever been eliminated. Some have been dealing with it for seventy years using the precise vocabulary of signal theory. Others, justice and medicine in its oldest form, were dealing with it long before, without a name for it. Either way, the trade-off never went away. It was only moved to where it does the least harm.
A different way of asking the question
There is one case, though, where the trade-off can shrink almost to zero: not because it has been optimized better, but because the nature of the problem has changed.
A honeypot is a system that has no legitimate reason to be touched. Not a real server with plausible traffic to interpret, but a decoy that no employee, no automated process and no supplier ever has a reason to reach. In this specific setting the noise is almost zero: there is no real distribution of innocent behavior to confuse the signal with, because no innocent behavior should ever happen there.
The principle itself is not new. In the digital world, one of the first documented cases dates back to 1986. The astronomer Cliff Stoll, chasing a 75-cent accounting error in the logs of Lawrence Berkeley National Laboratory, uncovers a computer spy on the KGB's payroll. To trap him, he builds an entire fictitious department, code-named SDInet, filled with documents that look classified but are not. It is one of the first honeypots in the history of computing, forty years before anyone put it on a slide.
For forty years the question was never whether the principle worked. It worked, often too well: a fully convincing decoy, indistinguishable from a real system, was also the riskiest one to manage, because if an attacker compromises it all the way, that same credibility becomes a weapon against whoever built it. The trade-off between signal and noise, apparently solved, reopened one level further on: between how well the deception works and how safe it is for those who set it.
It is worth being honest about what this means and what it does not, today. A single, generic decoy dropped in at random would leave out anyone who moves only on real resources and never goes near it: not "less visible", but plainly invisible, by construction. But a well-designed honeypot is not just any container. It is built to look exactly like what an attacker is looking for (a backup, a credentials store, a domain controller) and placed where someone moving laterally has the most reason to look. In a real environment several can be deployed, each designed to catch a different kind of curiosity.
This does not remove the theoretical limit: a threat that never touched any of the decoys would still stay out of reach. But it narrows enormously the space in which that possibility can be enough to stay invisible. It does not replace the radiologist, the judge, the anti-fraud investigator or behavioral correlation tools: it closes one specific blind spot, lateral movement after a compromise, when the attacker's behavior is already disguised as legitimate. The rest of the detection problem, everything that happens outside that slice of the network, remains the job of those who investigate it with other tools, with the same old trade-off.
But for that precise slice of the problem, something really does change. The same goes for anyone who reads logs instead of scans or radar signals: the question stops being "is this behavior anomalous enough to justify an alarm?" and becomes "has someone touched something that has no reason to be touched?". A question that no longer requires thresholds, statistics, or an analyst deciding how ambiguous the noise is.
The best radars in the world still live with interference. The best radiologists in the world still live with false positives. The best justice systems in the world, long before the problem had a name, still live with the risk of erring in one direction or the other. It is not a failure of these fields: it is the nature of the problem, when the signal you are looking for stays ambiguous by definition.
A honeypot is not a better radar, a more experienced radiologist, a stricter judge. It is not playing in the same league: for the piece of the problem that concerns it, it has left it. A decoy that nobody has any legitimate reason to touch makes every investigation of intent useless, because the act declares it on its own.
What is truly new is not the principle. It is being able to put it to use at last without paying the price that made it risky for forty years: a decoy convincing enough to mislead even a skilled attacker and, at the same time, so separate from the customer's network that, if compromised, it cannot become a weapon against whoever built it. The device that connects it accepts no incoming connection at all: there is no way back from there. The honeypot as we have always known it, without its downside.
It is a result that no radar, no scan, no jury, and for forty years not even a honeypot, has ever been able to claim: detecting without exposing the one who defends.