CISA issues guidance on using cyber decoys to deter attackers

The Cybersecurity and Infrastructure Security Agency (CISA) has issued its first guidance on using cyber decoys to strengthen detection and response. The 22-page document, titled ‘Using Cyber Decoys to Strengthen Detection and Response’, advises critical infrastructure owners and operators to deploy phony systems, accounts, and data to distract and expose hackers.

Chris Butera, acting executive director of CISA’s cybersecurity division, noted that decoys serve as a low-cost, high-fidelity method for detecting adversaries who have already breached a network. This strategy is intended to complement zero-trust and assume-compromise security models. The guidance is particularly aimed at critical infrastructure sectors with limited personnel or financial resources.

The document defines various decoy types, including honeytokens—fake records, credentials, or files with no legitimate business use. Any interaction with these elements serves as a strong indicator of unauthorized activity or data exfiltration.