CISA Tells Defenders to Plant Fake Systems and Wait

Key points

• The Cybersecurity and Infrastructure Security Agency (CISA) published guidance urging organisations to deploy cyber decoys, fake assets designed to lure attackers into revealing themselves.
• The document targets intruders who use stolen credentials and built-in Windows and Linux tools, a technique defenders call living off the land, because those attacks rarely trigger normal alarms.
• CISA maps the advice to MITRE Engage and MITRE ATT&CK so teams can plan decoy work without buying new products.
• The guidance covers tripwires (traps that fire on touch), breadcrumbs (fake clues left for attackers to follow) and honeytokens (bogus credentials or files that alert when used).
• CISA frames decoys as a companion to Zero Trust, the security model built on the assumption that attackers are already inside.

CISA wants defenders to stop chasing intruders and start baiting them.

In guidance published this week under the title Using Cyber Decoys to Strengthen Detection and Response, the agency lays out how organisations of any size can salt their networks with fake assets that look real to an attacker but do nothing except sound an alarm when touched.

The problem it's trying to solve is a familiar one, and one we've tracked closely: our 14 September report on the 3BB breach showed exactly how an attacker using a legitimate IT management tool can sit inside a network undetected for an extended period. Modern intruders log in with valid credentials they bought or stole, then use the same administrative tools a sysadmin would use to move around. It leaves almost no unusual software behind and drowns real attacks in legitimate-looking activity.

Decoys flip that problem. A normal employee has no reason to open a file called domain_admin_passwords.xlsx sitting on a file share. If anyone touches it, something is wrong.

What exactly is a cyber decoy?

A decoy is a fake asset planted to catch intruders. CISA breaks the category into three types.

Tripwires are systems or accounts that exist only to be triggered, a fake server in a quiet corner of the network, for instance. Breadcrumbs are small clues left where an attacker snooping through a real machine will find and follow them, such as a saved connection to a phantom database. Honeytokens are fake credentials or documents that generate a high-confidence alert the moment they're used or opened.

Because no legitimate user should ever interact with these objects, an alert from one is almost never a false alarm. That matters. CISA specifically pitches decoys as a way to cut alert fatigue, the exhaustion that sets in when analysts spend all day dismissing benign warnings.

How does this fit with Zero Trust?

CISA positions decoys as the practical partner to Zero Trust, the security approach built on the assumption that attackers will get in. Zero Trust tells you to verify every request. Decoys tell you when verification alone missed something.

The guidance leans on two frameworks maintained by the non-profit MITRE: MITRE ATT&CK, which catalogues techniques real attackers use, and MITRE Engage, the newer playbook for deception operations. CISA points teams toward its own Best Practices for MITRE ATT&CK Mapping for aligning decoy placement with specific expected behaviours.

Who should be reading this?

Any defender running a network larger than a small office, but especially teams that already feel blind to insider-style activity.

The agency stresses that decoy work doesn't require a big budget or a dedicated deception platform. A single fake service account with a memorable name and a rule that alerts on any authentication attempt is a working honeytoken. A retired server left online with monitoring turned all the way up is a working tripwire. Placement and follow-through are what count: someone has to see the alert and act.

My read: this is CISA nudging defenders toward a discipline the private sector has quietly used for years but rarely documented. The novelty isn't the technique. It's a federal agency saying out loud that prevention will fail and telling teams to plan the catch.

Common questions

Are cyber decoys legal to run?

Yes, on your own network. Decoys sit inside systems you own and monitor. The guidance is aimed at internal defence, not at hacking back or entrapping outside parties.

Do small organisations need this?

A basic honeytoken, a fake admin account that alerts on use, costs nothing and can be stood up in an afternoon. CISA's point is that the barrier to entry is low, not that every business needs a full deception programme.