Thanks! Glad it was helpful. I didnt have any similar realization until I had worked in the field for awhile amd honestly didnt have anyone to tell so i probably rambled. Good summary. Lean more into WAF, EDR and observability before a honeypot but yeah both are valid.

Hope your talk goes well!