If malicious actor tries to deploy malware on it's victim (our honeypot), we will quarantine it and submit to our threat intel engine. We know the "clean state" of honeypot and if attacker goes in somehow undetected, but changes honeypot state, we know that we got something valuable inside. We will have a fantastic malware/virus data bank very soon. We can further analyze it / match with other available databases of malware and quickly identify and prevent this infestation to a "real" system