A computer-implemented method for automatically creating a honeyfile for a file system, comprising the steps of: surveying a file set of the file system to identify tokenisable data in the file set; tokenising the identified tokenisable data to form a plurality of token sequences; wherein, each token in a token sequence has a token tag which identifies an attribute of the token and each token includes a token string which comprises tokenisable data; and a token sequence is represented by a sequence of token tags, called a signature; and either: selecting one of the plurality of token sequences or signatures; or generating a token sequence or signature to operate as an exemplar token sequence; applying a substitution method to substitute the tokens of the exemplar token sequence or signature with replacement tokenisable data; wherein the substitution method includes comparing the attribute(s) of an exemplar token with the attribute(s) of the replacement tokenisable data and is controllable to control variability of the replacement tokenisable data; and the substitution method includes: assessing a distance between the attribute(s) of the exemplar token(s) and the attribute(s) of the replacement tokenisable data, the assessing comprising applying a distance parameter to substitute according to the proximity of the replacement tokenisable data and the exemplar tokens; and the method further comprises packaging the replacement tokenisable data into a honeyfile. surveying a file set of the file system to identify tokenisable data in the file set; tokenising the identified tokenisable data to form a plurality of token sequences; wherein, each token in a token sequence has a token tag which identifies an attribute of the token and each token includes a token string which comprises tokenisable data; and a token sequence is represented by a sequence of token tags, called a signature; and either: selecting one of the plurality of token sequences or signatures; or generating a token sequence or signature to operate as an exemplar token sequence; wherein, each token in a token sequence has a token tag which identifies an attribute of the token and each token includes a token string which comprises tokenisable data; and a token sequence is represented by a sequence of token tags, called a signature; and selecting one of the plurality of token sequences or signatures; or generating a token sequence or signature to operate as an exemplar token sequence; applying a substitution method to substitute the tokens of the exemplar token sequence or signature with replacement tokenisable data; wherein the substitution method includes comparing the attribute(s) of an exemplar token with the attribute(s) of the replacement tokenisable data and is controllable to control variability of the replacement tokenisable data; and the substitution method includes: assessing a distance between the attribute(s) of the exemplar token(s) and the attribute(s) of the replacement tokenisable data, the assessing comprising applying a distance parameter to substitute according to the proximity of the replacement tokenisable data and the exemplar tokens; and the method further comprises packaging the replacement tokenisable data into a honeyfile. wherein the substitution method includes comparing the attribute(s) of an exemplar token with the attribute(s) of the replacement tokenisable data and is controllable to control variability of the replacement tokenisable data; and the substitution method includes: assessing a distance between the attribute(s) of the exemplar token(s) and the attribute(s) of the replacement tokenisable data, the assessing comprising applying a distance parameter to substitute according to the proximity of the replacement tokenisable data and the exemplar tokens; and the method further comprises packaging the replacement tokenisable data into a honeyfile.