So after the Okta incident they rotated the leaked credentials... But I think they should have put honeypots on them, and then waited to see what attackers did

So after the Okta incident they rotated the leaked credentials... But I think they should have put honeypots on them, and then waited to see what attackers did. Honeypots discourage the attackers from continuing for fear of being discovered too.