Defenders should define their honeypot strategy by identifying attack risks and intelligence gaps.