CISA has urged critical infrastructure organizations to plant fake files, accounts and credentials inside their networks to catch attackers who are already past the perimeter.
The guidance on cyber decoys, published September 16, is the agency's first detailed treatment of the process. It assumes intruders will eventually gain some level of access.
The approach matters most where adversaries use legitimate credentials and native tools to move around, which conventional monitoring struggles to separate from normal activity.
CISA framed decoys as an addition to Zero Trust rather than a replacement. The new guidance does not contain any mandatory measures.
Focus on Honeytokens Over Honeypots
The guide deliberately narrows its scope around the use of decoys. It covers decoys placed inside an organization's own networks and systems rather than the internet-facing honeypots the term usually evokes.
That pushes honeytokens to the front. CISA defines them as data items with no legitimate business use, such as fake records, credentials or files planted among real assets, where any interaction strongly suggests unauthorized activity.
Its own comparison rates honeytokens low in complexity against medium to high for honeypots, which operate at system level and carry deliberate vulnerabilities. The worked example in the guide is a honeytoken tripwire on a project share.
Tripwires are the mechanism. Because staff have no reason to touch a decoy, an alert from one arrives with far less noise than conventional tooling generates, which is how CISA expects organizations to cut mean time to detection (MTTD).
Read more on cyber deception: NCSC Plugs Gap in Cyber Deception Guidance
Three Actions and a Testing Loop
CISA sets out three key actions for organizations to take: deploy high-fidelity tripwires in high-value areas, use MITRE ATT&CK and MITRE Engage to map adversary tactics against decoy coverage, and refine the whole thing continuously through threat emulation.
Engage is MITRE's framework for planning adversary engagement. It sorts defensive objectives into Expose, which detects intruders, Affect, which disrupts or delays them, and Elicit, which studies their techniques in controlled environments.
CISA's practical material covers Expose. The agency describes the guide as an introductory resource for small to medium-sized organizations and for defenders new to decoy operations or to Engage itself.
Sysdig senior cybersecurity strategist Crystal Morin pointed to research her team had already run. Investigating exploitation of a marimo flaw, they planted a prompt injection in a vulnerable container, telling any large language model that read the file to echo a hidden marker.
"Every AI-driven operator we tracked did exactly that," she said. "AI can't help but follow instructions. That's a notable advantage for defenders against machine-driven attackers."
A human attacker in the same research opened the file twice, recognized the bait and stepped over it. Morin said the right decoy in the right place cuts time to detect, but the decoy has to match the adversary, and a distraction is not containment.