# Cowrie: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 10 judge labels across 1 category by 6 of 14 models. Page: https://www.gane.ai/index/it/vendors/cowrie

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Deception technology](https://www.gane.ai/index/it/security/deception-technology/index.md) | 2% | 9 | 20% | 10 |

## What the models said for it

- "Start with Canarytoken (low overhead, immediate value) combined with Cowrie (captures useful threat intel)." (Claude Haiku 4.5, Deception)
- "Cowrie emulates SSH/Telnet for capturing attacker commands and malware. Both are free, community-supported, and lightweight." (Grok 4.20, Deception)
- "Best for SSH and Telnet deception: Cowrie. The de facto standard for shell interaction logging." (Muse Glimmer 30B, Deception)
- "The de facto standard SSH/Telnet honeypot. Excellent logging and malware capture." (DeepSeek V4 Flash, Deception)

## And against it

- "Avoid as primary solutions. They are easily fingerprinted by modern attackers, offer low interaction, and lack automation/AI." (Grok 4.20, Deception)
- "Free, but requires more manual setup and management" (MiniMax M2.5, Deception)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 1 | 0 | 1 | 0 | 2 |
| GPT-5.4 mini | 0 | 0 | 0 | 0 | 0 |
| Gemini 3.5 Flash | 0 | 0 | 0 | 0 | 0 |
| Perplexity Sonar | 0 | 1 | 0 | 0 | 1 |
| Grok 4.20 | 0 | 1 | 1 | 1 | 3 |
| Mistral Small | 0 | 0 | 0 | 0 | 0 |
| DeepSeek V4 Flash | 0 | 1 | 0 | 0 | 1 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 0 | 0 | 0 | 0 |
| Kimi K2 | 0 | 0 | 0 | 0 | 0 |
| GLM 4.7 FlashX | 0 | 0 | 0 | 0 | 0 |
| MiniMax M2.5 | 0 | 0 | 0 | 1 | 1 |
| GPT-6 Luna | 0 | 0 | 0 | 0 | 0 |
| Muse Glimmer 30B | 0 | 1 | 1 | 0 | 2 |

## Sources returned with these answers

The sites and pages cited by the answers that named Cowrie, from 27 of the 30 answers that named it (only the models that return a source list).

### Domains cited

- cybersectools.com: 15
- tools.resorsit.com: 15
- guideflow.com: 13
- github.com: 12
- sourceforge.net: 12
- verifiedmarketresearch.com: 12
- expertinsights.com: 11
- gane.ai/index: 9
- acalvio.com: 6
- guptadeepak.com: 6

### Pages cited

- https://tools.resorsit.com/tools/security/deception: 15
- https://verifiedmarketresearch.com/blog/best-deception-technology-software: 12
- https://expertinsights.com/network-security/best-deception-technology-companies: 11
- https://guideflow.com/blog/honeypot-software: 10
- https://cybersectools.com/categories/honeypots: 9
- https://sourceforge.net/software/deception-technology: 9
- https://guptadeepak.com/tools/top-5-honeypots-deception-tools-2026: 6
- https://sourceforge.net/software/deception-technology/for-small-business: 6

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.