CISA Urges Defenders to Plant Decoys and Honeytokens to Catch Intruders Inside Networks

The Cybersecurity and Infrastructure Security Agency wants defenders to assume attackers will get in and make the network a hostile place once they do. Its new guide, Using Cyber Decoys to Strengthen Detection and Response, is the agency’s first detailed explanation of the defensive decoy process, according to CISA’s announcement.

The problem it targets is familiar. “Many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living off the land techniques to conduct discovery, move laterally, and access data,” CISA said. Decoys placed inside networks, especially in high-value areas, are meant to catch intruders early, gather intelligence on their behavior, help allocate defensive resources and cut mean time to detection with high-fidelity alerts. CISA positions them alongside existing Zero Trust models.

“Cyber decoys used in a proactive cyber defense strategy help make critical infrastructure networks unfriendly places for adversaries and enhance resilience to compromise, even against living-off-the-land techniques,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity. He said the guide aims to let “any defensive team regardless of skill level” understand and implement decoy operations.

Honeytokens, honeypots, breadcrumbs and tripwires

The guide sorts decoys into honeytokens (fake files, records, secrets or credentials) and honeypots (fake systems or services). Breadcrumbs, such as a saved connection or a reference in a config file, steer attackers toward them, and a tripwire is any of these rigged to alert on contact, Help Net Security summarized.

Starting points are simple: fake admin-only credentials no one should use, decoy folders on executive desktops, a bogus “Project_Metrics.xlsx” on a monitored share, or alerts on PowerShell running on workstations where ordinary users don’t need it. Effective tripwires should be threat-informed, distinct from normal behavior, detectable by existing monitoring and tied to clear response procedures.

No new spending required

CISA tells organizations to repurpose tools they already own, including EDR platforms, identity and access management systems and data loss prevention tools, to deploy and monitor decoys. Open-source tools for token generation and alerting are an option for tight budgets, while better-resourced teams can use commercial products or custom honeytokens.

Tactics are organized around MITRE Engage’s three goals: Expose (detect adversaries), Affect (impose cost and disrupt them) and Elicit (observe them safely to gather intelligence). The Elicit goal, which draws attackers into controlled environments, requires isolated infrastructure, mature logging and skilled staff to manage operational and legal risks, so CISA positions it as a later step. Teams are encouraged to use MITRE ATT&CK to map likely adversary techniques and place decoys where detection gaps are widest.