CISA releases guidance on using cyber decoys for defense

The Cybersecurity & Infrastructure Security Agency (CISA) has released new guidance focused on enhancing detection and response capabilities through the use of “cyber decoys.” This strategy operates on the assumption that attackers will eventually breach a network, aiming to create an environment where their subsequent activities expose them.

CISA recommends that critical infrastructure owners and operators deploy deceptive assets—such as honeypots, honeytokens, breadcrumbs, and tripwires—to identify malicious actors early in the intrusion lifecycle. By using these decoys, organizations can collect intelligence on attacker behavior, improve alert accuracy, and reduce the Mean Time to Detect (MTTD). This approach is particularly effective against “Living off the Land” (LoL) techniques, where attackers use legitimate system tools to avoid signature-based detection.

The guidance suggests that organizations should first look to repurpose existing tools like Identity and Access Management (IAM) and Endpoint Detection and Response (EDR) before investing in new technology. Furthermore, decoys must be designed to prevent attackers from pivoting to actual production systems, and decoy layouts should be documented outside of the production network for security.