Today, the construction industry increasingly depends on digital tools to improve data sharing among team members; however, this also increases the risk of cyber-attacks. Therefore, this study aims to propose using a honeypot to help detect evolving cyber threats and respond effectively to protect the industry. The objective of this study was achieved through a bibliometric analysis using the Scopus database over a four-year period (2021–2025) to identify three key themes and trends. The research focused on peer-reviewed, Scopus-indexed literature within architecture, engineering, and the construction sector. The findings showed that empirical research on honeypot-based security in construction data systems is limited both in the Global North and South, highlighting underexplored areas and indicating that this field is still in its early stages. The results further emphasised that Malaysia and India are the leading countries in honeypot research, demonstrating their strong engagement with the topic. The study also suggests that cybersecurity concerns (malware) are mainly seen as isolated technical issues, revealing a gap in integrating digital threat management into construction projects. Stakeholders should implement a honeypot to redirect cyberattacks away from their critical and sensitive project databases while also detecting suspicious activities. Additionally, it is recommended that professionals, with the help of IT specialists, develop customised honeypots to simulate all stakeholders’ data storage and exchange platforms, creating resilient threat intelligence. This study offers a roadmap for construction-specific honeypot models, highlighting geographical trends where investments and adoption are low, and thus requiring focused attention.