CISA has published its first guidance on cyber decoys, aimed squarely at organizations that cannot detect intruders abusing valid credentials, built-in admin utilities and living-off-the-land techniques.
The 22-page document, “Using Cyber Decoys to Strengthen Detection and Response,” makes a simple argument: assume an attacker will eventually get a foothold, then booby-trap the environment with tripwires, honeytokens and fake credentials that no legitimate user would touch. Any interaction raises an alarm.
Cost is the headline for stretched teams. CISA says decoys need no architectural overhaul and no new spending, and tells organizations to repurpose what they already run: EDR platforms, identity and access management systems and data loss prevention tooling. Open-source options cover token generation, deployment and alerting. Better-funded teams can buy commercial products or build custom honeytokens.
The terminology is spelled out. Honeytokens are data elements with no legitimate business use, such as fake records, credentials or files. Honeypots are entire systems or services. Breadcrumbs, a saved connection or a config reference, steer attackers toward them. A tripwire is any of these once rigged to fire on contact.
Starters include admin-only credentials nobody should use, decoy folders on executive desktops, a bogus “Project_Metrics.xlsx” on a monitored share, and alerts on PowerShell running where ordinary users have no reason to touch it. CISA maps all of it to MITRE Engage’s three goals, Expose, Affect and Elicit.
Two cautions come attached. Decoys must not become a route into real systems or privileges, and the documentation describing where they live belongs outside production in case the network falls.
