Conpot review
A configurable, self-hosted honeypot for industrial protocol emulation and attack logging.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Conpot is an open-source, self-hosted honeypot for industrial control system and supervisory control and data acquisition environments. It is designed for security researchers, educators, defenders, and technically capable operators who need to collect intelligence about adversaries targeting industrial systems. Its network decoy scope focuses on emulating ICS/SCADA services and protocols rather than providing a general-purpose enterprise deception platform.
Protocol coverage is the central strength. Conpot supports Modbus, HTTP, SNMP, and S7comm, with additional support for IEC 104, ENIP/CIP, BACnet, FTP, IPMI, TFTP, and Kamstrup. TOML templates and databus settings allow operators to configure the emulated environment, while proxy mode can bridge the honeypot to a real backend. Attack data can be sent to JSON, SQLite, syslog, HPFriends, and TAXII sinks, giving teams several structured logging paths for analysis and sharing.
Deployment remains a technical responsibility. Conpot runs on Linux and can be installed directly with Python or deployed through Docker and docker-compose. That self-hosted model suits teams that want control over placement, configuration, and data handling, but it is less suitable for buyers seeking a managed SaaS service or a guided onboarding process. The project’s 2013 founding year supports its maturity, while its narrower platform coverage and limited ecosystem breadth may matter to teams operating outside Linux or requiring wider integrations. Choose Conpot for customizable ICS/SCADA deception; consider an alternative when managed operations or broader platform coverage are priorities.
Conpot pros and cons
- Where it wins
- Emulates Modbus, HTTP, SNMP, S7comm, and additional industrial protocols
- Structured logging supports JSON, SQLite, syslog, HPFriends, and TAXII sinks
- Offers configurable templates, proxy mode, Docker, and Python installation
- Where it doesn't
- Linux is the only listed platform
- Self-hosted deployment requires technically capable operators
- Its ecosystem and integration breadth is narrower than broader platforms
Conpot fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update