For most of the security operations center's existence, detection has been a signal-to-noise problem: sift through a mountain of legitimate activity for the sliver that isn't. U.S. CISA's newest guidance, Using Cyber Decoys to Strengthen Detection and Response, argues that decoys break that math entirely. Plant an asset nobody legitimate has any reason to touch, and the noise problem disappears—any interaction is the signal.
It's the agency's first detailed guidance on cyber decoys, and it lands at a moment when attackers increasingly don't need malware to get what they want. CISA's framing is blunt: adversaries are leaning on valid credentials, built-in admin tools, and living-off-the-land (LOTL) techniques precisely because those blend into normal traffic and evade signature-based detection. Decoys are pitched as the countermeasure purpose-built for that blind spot.
Deception flips the usual detection problem on its head, according to Donald McFarlane, board member at Xcape Inc. "Most security monitoring tries to distinguish malicious activity from an enormous volume of legitimate activity," McFarlane said. "Well-designed deceptive controls turn that problem on its head: nobody conducting legitimate business should be touching certain combinations of decoy accounts, identities, credentials, servers, systems, or data. When someone does, the signal can be extraordinarily high confidence."
"The attacker has to distinguish the real from the fake every time. The defender only needs them to touch the wrong thing once."
McFarlane, who's advocated for deception for decades, called it one of the highest-ROI controls in cybersecurity—and argued the discipline has more to learn from military doctrine than most defenders assume. Effective defense isn't building higher walls and defending every point equally, he said; it's deception and maneuver, shaping the battlespace, and channeling adversaries toward ground the defenders choose.
What CISA actually means by 'decoy'
The guidance defines a small taxonomy worth knowing. Honeytokens are fake data elements—records, credentials, files—with no legitimate business use; any interaction with one is a strong indicator of compromise. Honeypots are decoy systems or services, generally with more operational complexity. Breadcrumbs are the artifacts (a saved connection, a line in a config file) that steer an adversary toward either one. Any decoy becomes a tripwire once it's wired to alert on contact.
[RELATED: Why SMBs Need Cyberattack Early Warning Systems More Than Ever]
CISA organizes the strategy around three goals borrowed from the MITRE Engage framework: Expose (detect adversaries early), Affect (impose cost and disrupt their operations), and Elicit (safely observe them for threat intelligence). For most organizations, the guidance is clear: Expose is the place to start, whereas Elicit requires isolated infrastructure and legal and operational maturity most teams don't yet have.
The examples CISA gives are deliberately unglamorous: fake admin-only credentials that should never be used, a decoy folder on an executive's desktop, a bogus "Project_Metrics.xlsx" seeded on a monitored file share. None of it requires new architecture. A worked scenario in the guidance walks through a mid-sized water and wastewater organization mapping its ATT&CK vulnerability gaps and layering Engage tactics on top—planting fake low-privilege accounts to catch Valid Accounts abuse, seeding decoy listening ports to catch network discovery, embedding beaconing elements in login portals to catch cloned phishing pages.
No excuse not to start
The guidance's most pointed message may be aimed at the assumption that deception is an enterprise-budget capability. CISA tells organizations to repurpose tools they already run—such as EDR, identity and access management, DLP—rather than buy anything new, and calls out open-source token generation and alerting as a legitimate starting point for resource-constrained teams.
John Strand, owner of Black Hills Information Security, has been making that same case for years, teaching deception at Black Hat and through Anti-Siphon Security Training. "You don't need some massive commercial product to get started," Strand said. "You can create accounts in Active Directory that should never be used and trigger an alert the second somebody tries to authenticate with them. You can deploy simple honey tokens for free. Yes, there are great commercial offerings too, but cost should not be the reason you aren't doing deception."
Strand's bigger objection is to sequencing, not cost. Too many teams treat deception as a control to bolt on once everything else is mature, he said, and he thinks that's backward. It belongs in the environment from day one, alongside every other control, precisely because it produces something almost nothing else does: an attacker touching something no legitimate user would ever touch.
The catch: getting decoys wrong is worse than not having them
CISA doesn't pretend this is set-and-forget. Effective tripwires have to be threat-informed—built from actual CTI about who's likely to target the organization, not generic templates—distinct enough from normal behavior that any interaction is unambiguous, properly instrumented so existing monitoring actually catches it, and tied to a response procedure before the first alert ever fires. The guidance also flags a real operational risk: decoy-location documentation has to live outside the production environment, because that map becomes an attacker's cheat sheet the moment the network it's meant to protect is compromised.
That last point is worth underscoring for teams eager to move fast on this. A tripwire nobody's ready to respond to, or one an attacker can map by reading the wrong internal wiki, isn't a detection improvement—it's a false sense of one.
