CISA Wants You to Leave a Trap Out for Hackers
America's cyber-defence agency has published detailed guidance on using decoys, fake password files, and tripwire accounts to catch attackers who have already slipped inside a network.
Key points
- CISA published guidance in 2025 urging organisations to deploy cyber decoys, including fake files, fake user accounts and tripwire alerts, to catch attackers already inside their networks.
- The guidance directly addresses "living off the land" techniques, where criminals use a victim organisation's own legitimate tools and accounts rather than malware, making them nearly invisible to standard defences.
- Decoys complement Zero Trust, a security model that assumes some attackers will always get in, by creating high-quality alerts from activity that should simply never happen.
- Even a single fake user account or a file labelled "passwords.XLS" can trigger an alert the moment an attacker touches it, with almost no false alarms.
- Security consultants who reviewed the guidance warn that decoys only work if they're carefully documented and managed, or they quietly disappear during routine IT housekeeping.
Imagine a thief breaking into a warehouse and finding a safe with the combination written on a Post-it note stuck to the front. They open it. An alarm goes off. Nothing inside was valuable. Stripped to its bones, that's what CISA is now recommending every organisation consider building into its defences.
The U.S. Cybersecurity and Infrastructure Security Agency, the federal body responsible for protecting critical American infrastructure, published guidance this year on what it calls "cyber decoys": fake assets planted inside a network to distract criminals, gather intelligence about how they operate, and lure them away from real systems. It covers tripwires (assets that silently alert defenders the instant someone touches them), breadcrumbs (trails of convincing but false information designed to lead attackers in circles), and honeytokens (fake login credentials or files that look valuable but trigger an alarm when used). We covered the framework's foundations in our 17 September piece on CISA's fake-systems guidance.
Why do standard defences miss so many attacks?
Most security tools are built to spot malicious software, and they're much weaker when an attacker skips the malware entirely.
Criminals increasingly rely on stolen usernames and passwords, then use the target organisation's own built-in software to move from computer to computer and copy data. Security researchers call this "living off the land": no unusual programmes are installed, so standard detection tools see nothing obviously wrong. CISA's guidance argues that decoys are one of the few methods that work specifically against this approach, because a fake account that no legitimate employee ever touches will produce an alert the moment a criminal tries to use it.
Joshua Prager, a managing consultant at SpecterOps, made the point to Dark Reading that most corporate detection tools still look for malware signatures and have almost nothing to say when an attacker is simply walking around with a stolen key.
What does a decoy actually look like in practice?
Simple ones cost almost nothing to set up.
John Strand, who owns the security firm Black Hills Information Security, describes the lowest-effort version: create one fake user account inside the company's staff directory, give it a long random password, block it from ever logging in successfully, and then watch for any login attempt. Any attempt means an attacker found the account, which means they're inside the network and hunting. Dropping a file called "passwords.XLS" on a server and monitoring for anyone who opens it can catch automated scanning tools that criminals use to hoover up credentials. Strand calls it a "low interaction but high value" activity. He also tells Dark Reading that AI-powered attacks can be slowed by these same decoys, because automated systems waste time analysing fake assets while defenders get an early warning.
CISA's guidance maps these techniques to two widely used security frameworks. MITRE ATT&CK catalogues the tactics criminals use to attack systems; MITRE Engage is a companion framework specifically focused on deceiving attackers and learning from their behaviour.
| Decoy type | What it looks like to an attacker | What it signals to defenders |
|---|---|---|
| Honey user account | A real-looking staff login in the directory | Any login attempt: attacker is active inside the network |
| Honeytoken file (e.g. Passwords.XLS) | A file full of apparently useful credentials | File opened or credentials used: attacker found and ran the bait |
| Breadcrumb trail | False but convincing clues pointing to a fake system | Attacker is following the trail rather than finding real data |
| Tripwire network share | A folder that looks like sensitive storage | Any access attempt triggers an immediate alert |
What can go wrong?
Decoys fail quietly when no one is minding them.
Prager's concern isn't the setup but the upkeep. A fake account that isn't clearly labelled in the organisation's records will eventually get deleted during a routine password-reset drive or switched off by someone who has no idea it's a trap. When that happens, the decoy disappears without anyone noticing, and the organisation loses the protection it thought it had. His recommendation: register every decoy in the same identity management system the organisation already uses, restrict knowledge of its true purpose to a small named group, and treat it with the same ownership rules as any production account.
Strand's concern is different. He finds the guidance reads like a government document, which can make straightforward techniques look daunting. His advice to smaller organisations is to ignore the elaborate scenarios and start with one fake account and one fake file. That alone is high-value detection with almost no running cost and almost no false alarms.
My read: CISA getting behind deception is genuinely useful, not because the techniques are new (honeypots are older than most people reading this) but because a federal endorsement gives security teams at under-resourced organisations something to cite when asking management for permission to try it. The guidance's real audience is the hospital IT department and the regional manufacturer, not a well-staffed security operations centre that already runs a deception platform. That framing should probably be more explicit in the document itself.
Common questions
Does this affect ordinary employees at all?
Not directly. Decoys sit inside the company's internal systems and are invisible to normal users. The only change an employee might notice is an occasional reminder not to touch files or accounts they don't recognise, which is good practice anyway.
Could a decoy accidentally trip up a legitimate employee?
A well-designed one almost never does. A fake account that no real person is supposed to use produces virtually no false alarms, because no genuine workflow ever touches it. The moment it does get touched, that contact itself is the alert worth investigating.
