The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has rolled out new guidance urging organizations to deliberately plant fake credentials and deceptive systems—also known as cyber decoys—to more reliably catch intruders who’ve already gained some access. The guidance, titled Using Cyber Decoys to Strengthen Detection and Response, was published on September 16, 2026. It aims to shift detection strategies upstream, especially for threats that don’t rely on malware.
Why Decoys Are Needed
Modern threat actors continue to evolve, often skipping obvious malware in favor of using legitimate user credentials, built-in administrative tools, or “living-off-the-land” techniques to reduce detection. These methods enable stealth: once inside, attackers can explore networks, escalate privileges, move laterally, and access sensitive data while blending into typical network traffic. Traditional perimeter defenses and signature-based detection often miss these kinds of intrusions.
What Decoys Look Like—and How They Work
Decoys are assets placed inside an environment that appear valuable but serve no real business purpose. Examples include inactive admin accounts, phony VPN credentials, decoy databases or servers, fake cloud storage paths, honeytokens, and bogus documents. Because legitimate users shouldn’t interact with these decoys, any access or use is a highly reliable signal of suspicious behavior.
CISA recommends placing decoys in or near high-value segments of the network, where an attacker is likely to roam if breached. One scenario involves creating a fake privileged account and embedding its credentials in a location visible to attackers—triggering alerts when someone tries to use them. This helps security operations centers respond more quickly after an initial compromise.
The guidance integrates deception tools into existing security models, such as Zero Trust. While Zero Trust assumes that attackers could already have some access, decoys give defenders added capability to validate behavior in real time, map out possible attacker movements, and reduce reliance on traditional threat detection alone.
Benefits and Best Practices
Decoy technology tends to generate higher-confidence alerts than many standard systems, which often flood teams with false positives. Because decoys are unlikely to be interacted with during normal business operations, any triggered alert is more likely to represent a real breach, helping reduce alert fatigue and speed up detection—shrinking mean time to detection significantly.
CISA also introduces deception constructs like tripwires (conditions that raise alerts when crossed), breadcrumbs (traces leading offenders toward decoys), and honeytokens (fake credentials or documents that expose misuse). The MITRE ATT&CK and MITRE Engage frameworks are cited to help organizations map decoys to known adversary tactics and to plan deception operations more effectively.
Importantly, decoys don’t replace essentials like multi-factor authentication, segmentation, patching, monitoring, logging, and robust incident response. They supplement these controls—giving defenders additional chances to spot an attacker before critical systems, data, or operational technology are compromised.
This proactive approach helps organizations catch intruders earlier, especially in cases where perimeter defenses may fail or attackers are already inside but flying under the radar.
Why this matters: The use of fake credentials and decoy assets represents a growing recognition in cybersecurity: when attackers find ways around standard defences, defenders need to be able to detect breach behavior rather than simply try to prevent it. As malicious actors increasingly rely on stealthy, legitimate-looking methods, decoys provide a low-cost, high-signal tool that complements existing security posture. Organizations that adopt these tactics should do so carefully: decoys must be well designed, monitored, and aligned with frameworks like Zero Trust, or otherwise risk being overlooked or mismanaged. Keep an eye out for adoption case studies in coming months—how organizations integrate decoys at scale and measure their impact on detection speed will be key.
