Abstract: The present invention relates to a honeypot host (500) adapted in a network (90). The honeypot host (500) of the present invention is generally comprised of a computer system (10) and a honeypot system (300) incorporated in the computer system (10). The honeypot system (300) generally deploys at least one decoy host 80 to at least one unused Internet Protocol (IP) address (160) around the network (90). The honeypot system (300) is further adapted to be self-replicable. In the event that a honeypot system (300) in the network (90) is compromised, the honeypot system (300) is capable of self-terminating at least a portion of the compromised honeypot system (300) and self-replicating a new honeypot system (300). The honeypot system (300) is also further adapted to detect whether the current honeypot system (300) has been compromised. The present invention is also related in another aspect to a method for replicating a honeypot system (300) to replace a compromised honeypot system (300).