1. A method comprising: detecting an attack vector using a honeypot, wherein the honeypot includes a resource emulator and an attack vector identifier; based on a condition of detecting the attack vector, searching a system of record with the attack vector identifier to identify a type of attack vector for the detected attack vector; based on a condition that the type of attack vector is identified in the system of record, extracting signatures from a storage unit using the honeypot, wherein each signature represents a behavior of a network system resource in response to the attack vector; making a copy of network system resources and services that the attack vector will affect; and directing the attack vector to the copy of the network resources and services; and based on a condition that the type of attack vector is not identified in the system of record, emulating the network system resources using the honeypot to understand the attack vector, wherein the emulating of the network system resources is based on the signatures.