The Cybersecurity and Infrastructure Security Agency has a new piece of advice for network defenders, and it doesn’t involve another patch or another firewall rule: build traps. In guidance published September 16, 2026 titled “Using Cyber Decoys to Strengthen Detection and Response,” CISA is formally encouraging organizations to plant fake credentials, fake systems, fake files and fake data assets throughout their environments — not to stop an intruder from getting in, but to catch them the moment they start poking around after they already have.

Why deception, and why now

The rationale behind the guidance tracks a broader shift CISA and other agencies have been flagging for a while: attackers are increasingly avoiding malware altogether. Rather than dropping a payload that endpoint detection tools might flag, intruders are abusing legitimate user accounts, built-in Windows and Linux administrative tools, and other so-called living-off-the-land techniques that look, to most monitoring systems, like ordinary IT activity. That makes early-stage discovery, lateral movement and privilege escalation — the steps an attacker takes after the initial compromise but before the damage — much harder to spot using signature- or behavior-based detection alone.

Deception technology is CISA’s answer to that blind spot. The idea is straightforward: if an attacker can’t easily tell a real asset from a fake one, and the fake ones exist purely to be touched by someone who shouldn’t be touching them, then any interaction with a decoy is close to a guaranteed signal of compromise — with none of the false-positive noise that plagues most detection rules.

The vocabulary of deception

CISA’s guidance lays out a small taxonomy of techniques that fall under the broader “cyber decoy” umbrella:

• Cyber decoys — assets deliberately planted to look legitimate and valuable but that serve no real business function, existing purely to attract and expose intruders.
• Tripwires — conditions or assets configured to generate an alert the moment they’re accessed or modified, regardless of whether the asset itself looks especially valuable.
• Breadcrumbs — small clues, like a fake configuration file referencing a decoy server, deliberately left where an attacker who is already exploring the network is likely to find them and follow them toward a trap.
• Honeytokens — individual fake data items, such as credentials, API keys, or documents, seeded specifically so that any attempt to use them reveals unauthorized access.

In practice, CISA points to fairly concrete, low-effort examples: an administrator account that’s never actually used for anything, a set of VPN credentials that don’t correspond to a real employee, a database stocked with plausible-looking but fabricated records, or an entire simulated server sitting on the network solely to be found and probed.

Mapping decoys to how attackers actually operate

Rather than leaving deployment entirely to instinct, CISA is pointing defenders toward two existing frameworks to plan where and how decoys should go: the widely used MITRE ATT&CK framework, to map specific decoy placements against the tactics and techniques real intrusions tend to follow, and the more specialized MITRE Engage framework, which is purpose-built for planning deception and adversary-engagement operations. Used together, the frameworks give security teams a way to reason about which stage of an intrusion — initial access, discovery, credential access, lateral movement — a given decoy is meant to catch, rather than scattering traps at random.

An addition, not a replacement

CISA is careful to frame deception as a complement to existing security investment rather than a substitute for it. The guidance explicitly states that decoys should “not replace core controls such as multifactor authentication, endpoint monitoring, logging, segmentation, patching, and incident response planning.” The intended audience is organizations, particularly those defending high-value network segments, that already have foundational controls in place and are looking for an added layer that specifically targets the post-compromise phase of an attack — the part of the intrusion lifecycle where an attacker has already gotten past the front door and is deciding what to do next.

What defenders should take away

For security teams weighing whether to act on the guidance, a few practical starting points stand out: begin with a small number of high-fidelity honeytokens around the most sensitive systems rather than attempting a network-wide rollout immediately; ensure every decoy is wired into alerting so an interaction actually triggers a response rather than sitting unmonitored; and use ATT&CK and Engage to make sure decoys are placed along the paths an attacker realistically would take, not just wherever is administratively convenient. Done well, deception doesn’t need to be elaborate to be effective — its value comes almost entirely from the fact that a legitimate user never has a reason to touch it, so anyone who does has already told you something important.