ITDR teams seed a small number of decoy honeytoken identities among real accounts. They have no legitimate business use, so any touch — a login, a credential read, a token request — is a near-certain sign of compromise. This simulation models an attacker performing lateral movement as a random walk on the directory's trust graph, and asks: how many probes does it take before a honeytoken gets touched?
P(honeytoken touched by probe k) ≈ 1 − (1 − d·s)^k
d = honeytoken density among reachable identities
s = monitoring sensitivity (chance a touch is actually caught)
E[MTTD] ≈ 1 / (d·s) (probes, geometric-distribution expectation)
- Honeytoken density — fraction of decoy identities woven into every tier of the directory; higher density shortens expected detection time.
- Strategy — "Random" picks any reachable neighbour uniformly; "Targeted" weights the walk toward higher-privilege tiers, the way a real attacker chasing domain-admin rights would, which changes which honeytokens it is likely to encounter first.
- Monitoring sensitivity — even a honeytoken touch isn't caught 100% of the time in practice (alerting pipeline gaps, delayed log ingestion); this scales that catch probability.
- Breach depth — the highest-privilege tier the attacker reached before an alert fired, the practical measure of "how much damage before we noticed."
Real ITDR programs report MTTD/MTTR as core metrics; honeytokens exist precisely because they turn detection into a near-deterministic tripwire instead of relying on noisy behavioural anomaly scores alone.