CISA guidance on cyber decoy deployment

The Cybersecurity and Infrastructure Security Agency (CISA) has released guidance for critical infrastructure owners and operators regarding the use of cyber decoys to improve detection and response capabilities.

The strategy is based on the assumption that attackers will eventually breach a network. By deploying deceptive assets—such as honeypots, honeytokens, breadcrumbs, and tripwires—organizations can identify malicious actors early in the intrusion lifecycle and collect intelligence on attacker behavior. This approach is noted as being particularly effective against ‘Living off the Land’ (LoL) techniques, where attackers use legitimate system tools to bypass signature-based detection.

CISA advises that organizations should attempt to repurpose existing tools, such as Identity and Access Management (IAM) and Endpoint Detection and Response (EDR), before investing in new technology. The guidance emphasizes that decoys must be designed to prevent attackers from pivoting to actual production systems and that decoy layouts should be documented outside of the production network.