Let’s be honest: Traditional defense is exhausting.
Set your firewall to automatically drop traffic from any internal IP that attempts to connect to a known "honey-port."