CISA Says Cyber Decoys Offer High-Confidence Threat Detection at Low Cost

The U.S. Cybersecurity and Infrastructure Security Agency is urging organizations of all sizes to deploy cyber decoys as a frontline detection strategy — arguing the technique eliminates the signal-to-noise problem that has plagued security operations for decades.

CISA released its first detailed guidance on the topic, Using Cyber Decoys to Strengthen Detection and Response, on September 21, 2026. The document makes a pointed case: plant a digital asset no legitimate user has any reason to touch, and every interaction with it becomes an unambiguous red flag.

The timing is deliberate. Adversaries are increasingly abandoning malware in favor of valid credentials, built-in administrative tools, and living-off-the-land (LOTL) techniques that blend seamlessly into normal network traffic. Signature-based detection tools were never designed to catch that kind of intrusion. Decoys were.

---

What the Guidance Actually Says

CISA introduces a focused taxonomy to help organizations understand what cyber deception looks like in practice.

Honeytokens are fake data elements — credentials, files, or records — that have no legitimate business use. Any interaction with one is a strong indicator of compromise. Honeypots are decoy systems or services that operate with greater complexity but serve the same purpose. Breadcrumbs are artifacts — such as a saved connection string or a line in a configuration file — that steer an adversary toward either type of decoy. Any of these assets becomes a tripwire once wired to generate an alert on contact.

Understanding how these decoy types integrate with broader cybersecurity detection strategies and frameworks helps security teams position deception as a genuine architectural layer rather than an isolated tactic.

The agency organizes its strategy around three goals drawn from the MITRE Engage framework:

• Expose — detecting adversaries early in the kill chain
• Affect — imposing cost and disrupting adversary operations
• Elicit — safely observing attackers to gather actionable threat intelligence

For most organizations, CISA recommends starting with Expose. The Elicit goal requires isolated infrastructure along with legal and operational maturity that most security teams do not yet have.

Practical Examples That Require No New Architecture

The practical examples CISA offers are deliberately unglamorous — and that is precisely the point. Fake admin-only credentials that should never be used. A decoy folder sitting on an executive's desktop. A bogus file named "Project_Metrics.xlsx" seeded on a monitored file share. None of these require new architecture or a significant budget line.

A worked scenario in the guidance follows a mid-sized water and wastewater organization mapping its ATT&CK vulnerability gaps and layering Engage tactics on top. The organization:

• Plants fake low-privilege accounts to catch Valid Accounts abuse
• Seeds decoy listening ports to catch network discovery activity
• Embeds beaconing elements in login portals to flag cloned phishing pages

This scenario is a useful illustration of how deception scales down to resource-constrained environments without sacrificing detection quality. Organizations evaluating intrusion detection systems and network security monitoring tools will find that cyber decoys complement — rather than replace — those existing controls, filling the visibility gaps that conventional signature-based tools consistently miss.

---

The Case for Starting Now — Not Later

Donald McFarlane, a board member at Xcape Inc. and a longtime advocate for deception-based security, framed the core advantage in precise terms.

"Most security monitoring tries to distinguish malicious activity from an enormous volume of legitimate activity," McFarlane said. "Well-designed deceptive controls turn that problem on its head: nobody conducting legitimate business should be touching certain combinations of decoy accounts, identities, credentials, servers, systems, or data. When someone does, the signal can be extraordinarily high confidence."

McFarlane added a line that captures the asymmetry defenders gain from this approach: "The attacker has to distinguish the real from the fake every time. The defender only needs them to touch the wrong thing once."

He also drew a comparison to military doctrine that most cybersecurity frameworks overlook. Effective defense is not about building higher walls and defending every point equally. It is about deception and maneuver — shaping the battlespace and channeling adversaries toward ground the defenders choose. This framing echoes concepts from active defense theory, where the goal is not passive resistance but deliberate adversary manipulation.

Cost Is Not the Barrier — Sequencing Is

CISA's most pointed message may be directed at teams who assume deception is an enterprise-budget capability. The guidance explicitly tells organizations to repurpose tools they already operate — including endpoint detection and response (EDR) platforms, identity and access management (IAM) systems, and data loss prevention (DLP) tools — rather than procure anything new. Open-source token generation and alerting are named as a legitimate starting point for resource-constrained teams.

John Strand, owner of Black Hills Information Security and a deception instructor at Black Hat and Anti-Siphon Security Training, has been making the same argument for years.

"You don't need some massive commercial product to get started," Strand said. "You can create accounts in Active Directory that should never be used and trigger an alert the second somebody tries to authenticate with them. You can deploy simple honey tokens for free. Yes, there are great commercial offerings too, but cost should not be the reason you aren't doing deception."

Strand's deeper concern is about sequencing rather than budget. Too many security teams treat deception as a control to bolt on once everything else reaches maturity. He argues that thinking is backward. Deception belongs in the environment from day one alongside every other control — because it produces something almost no other tool can: evidence of an attacker touching something no legitimate user would ever touch.

---

The Risks of Doing It Wrong

CISA does not present cyber deception as a set-and-forget solution. The guidance outlines several conditions that must be met for decoys to function as intended.

Four Conditions for Effective Tripwires

Effective tripwires must be:

1. Threat-informed — built from actual cyber threat intelligence about likely adversaries, not generic templates
2. Distinct — different enough from normal behavior that any interaction is unambiguous
3. Properly instrumented — wired so that existing monitoring infrastructure actually captures the alert
4. Response-ready — tied to a documented incident response procedure before the first alert ever fires

The guidance also flags a significant operational risk that teams eager to move quickly should not overlook. Documentation mapping decoy locations must be stored outside the production environment. That map becomes an attacker's cheat sheet the moment the network it is meant to protect is compromised. A tripwire that an adversary can identify by reading the wrong internal wiki page is not a detection improvement — it is a false sense of one.

Where This Fits in Your Broader Security Program

For security leaders evaluating where to direct limited resources, the question of how deception integrates with threat detection and incident response planning is worth examining closely. Decoys without a tested response workflow attached to them create dangerous overconfidence — the alert fires, and no one knows what to do next.

The CISA guidance ultimately makes three things clear for teams ready to act:

• Repurpose existing tools first. EDR and IAM platforms can support basic decoy deployment without new procurement.
• Treat deception as foundational, not advanced. Integrate it early in the security program lifecycle, not as a late-stage addition.
• Pair every decoy with a tested response procedure. An unmonitored tripwire delivers no real protection — it creates the illusion of it.

The MITRE Engage framework provides a publicly available, structured methodology for teams that want to move beyond ad hoc decoy placement and build a defensible, documented deception strategy from the ground up.