Abstract: A method of automatically manipulating a lifecycle of a honeyfile on a file system, includes: implementing a learning algorithm on a file system; identifying a real file; training the learning algorithm by observing temporal events involving the real file; training a model with the learning algorithm; implementing a user agent on the file system; creating a honeyfile on the file system; deploying the honeyfile on the file system; using the trained model to generate user agent actions; evaluating the honeyfile; and either: deleting the honeyfile; or re-using the trained model to generate user agent actions to automatically modify the honeyfile.