<p> Security analysts have a tendency to believe they are safe because the red alert light hasn’t blinked on their IDS/IPS device. This remains true even when organizations have invested the time and budget to deploy a myriad of different tools to defend against the overwhelming number of network defense issues we all tend to face. A key pain point among these issues is keeping malware and the subsequent bot herders who spread it off of your corporate network. </p> <p> Nepenthes is an open source honeypot that allows for the collection of malware “in the wild.” It emulates known vulnerabilities and will download and capture the malware when it is attempting to compromise the honeypot. This collection process allows for further analysis and understanding of the malware in question. This presentation introduces this powerful and flexible tool and will discuss malware collection techniques attendees will immediately be able to take home and implement within their network environment and add another layer to their “defense in depth” strategy. </p>