A tripwire is a hidden trigger that generates an alert when someone touches, opens, executes, or queries something that should remain unused in normal operations. It is a defensive detection control, not a block: the goal is to create a high-confidence signal that an unauthorized actor has interacted with a decoy file, account, service, or configuration.
Tripwires matter because skilled attackers often rely on valid credentials and ordinary tools, making their activity look legitimate. A well-placed tripwire can expose reconnaissance, lateral movement, or credential abuse earlier than signature-based tools. In practice, defenders pair tripwires with monitoring and response workflows so an alert leads to triage, investigation, and containment. Their value depends on realism, careful placement, and the assumption that legitimate users will never trigger them.