A decoy system is a monitored environment designed to attract and record activity such as reconnaissance, vulnerability scans, or attempted exploitation. It may imitate a real service or device, but is kept separate from production systems. Honeypots are a common form of decoy system.
Defenders use decoys to observe attacker behavior and identify which services or flaws are drawing interest. A probe against a decoy can provide an early warning and help guide patching or monitoring, but it does not prove that a real system was targeted or compromised. In practice, teams analyze logs and network activity from decoys while treating the environment as untrusted and preventing it from becoming a route into their systems.