A threat actor is quietly moving through a compromised network and stumbles across a file labeled passwords.xlsx. Jackpot, they think. What they don't realize is that opening it just tipped off the security team — the file was never real. It was bait.
That scenario is the opening frame for CISA's newest guidance, "Using Cyber Decoys to Strengthen Detection and Response," a 22-page document released September 16, 2026 — the agency's first detailed treatment of defensive cyber deception. Decoy-based defense has existed for decades, but as DarkReading notes, it has slipped out of the security mainstream in recent years. CISA's guide signals a deliberate push to bring it back, particularly for organizations that can't afford a full-blown commercial detection stack.
What the Guide Recommends
CISA uses "cyber decoys" as an umbrella term covering four related techniques, each defined with an eye toward practical deployment:
- Honeypots — decoy systems or services with limited but realistic functionality and intentional vulnerabilities, built to attract and observe adversaries while diverting them from real assets. CISA rates these medium-to-high complexity since they operate at the system level.
- Honeytokens — fake data elements with no legitimate business use: bogus credentials, API keys, documents, database records, or cloud access tokens. Any interaction with one is a near-certain signal of malicious activity, since no real employee or process should ever touch it. CISA rates these low complexity — the guide's worked example is a honeytoken tripwire planted on a project file share.
- Breadcrumbs — planted clues, such as a fake configuration file pointing to a nonexistent server, designed to lead an attacker deeper into a decoy environment.
- Tripwires — assets or conditions that fire an alert the moment they're touched, tying the other three techniques together into an early-warning layer.
Built for Resource-Constrained Teams
The guidance is aimed broadly at critical infrastructure owners and operators, federal agencies, and enterprises of varying sizes — but CISA is explicit that it's written with smaller, under-resourced security teams in mind. Chris Butera, CISA's Acting Executive Director of the Cybersecurity Division, framed the pitch directly: "We believe that decoys can be both a very low-cost but actually high-fidelity way to detect an adversary." He added that deception "could be something to prioritize as a lower-cost solution. You can create your own honey tokens yourself."
The guide lays out three deployment paths: free open-source frameworks for token generation and alerting (suited to pilots and tight budgets), commercial platforms for teams that want turnkey tooling, and homegrown implementations built around an organization's existing environment. CISA points out that much of this can run on tools defenders already own — endpoint detection, identity and access management, and data loss prevention platforms — rather than requiring new spend.
Why Deception Is Having a Moment
The driving problem is detection blindness: attackers increasingly use valid, stolen credentials and built-in administrative utilities rather than malware, a pattern known as living-off-the-land (LOTL). Those techniques routinely slip past signature- and behavior-based defenses because, on paper, the activity looks legitimate. Decoys sidestep that problem entirely — a honeytoken or tripwire has no legitimate use case, so any interaction is inherently suspicious. CISA frames the approach as a natural fit for Zero Trust and "assume breach" strategies, where the goal shifts from keeping attackers out entirely to catching them fast once they're already inside.
Getting Started
CISA's guide sets out three recommended actions for organizations adopting deception:
- Deploy high-fidelity tripwires around high-value assets and data first, rather than spreading decoys thin.
- Use the MITRE ATT&CK and MITRE Engage frameworks to map adversary tactics against existing decoy coverage and find gaps.
- Continuously refine placement and realism through threat emulation, rather than treating deployment as a one-time project.
The guide's overall message, echoed across coverage of its release, is that cost isn't a legitimate excuse to skip deception anymore — a handful of fake Active Directory accounts wired to trigger an alert on first use costs nothing but time to set up, and can catch an intruder that every other control in the stack missed.
Sources
- Deception by Design: CISA's Guide to Tricking Cybercriminals — DarkReading
- CISA promotes a fresh way to deter cyberattackers: Lie to them — CyberScoop
- CISA releases Cyber Decoys guide detailing tripwires, honeytokens to strengthen critical infrastructure detection and response — Industrial Cyber
- CISA wants critical infrastructure orgs and smaller security teams to start using cyber decoys — Help Net Security