Make attackers reveal themselves

Make attackers reveal themselves.

CISA (Cybersecurity and Infrastructure Security Agency) released new guidance on September 16 for using cyber decoys to strengthen detection and response.

The challenge is clear.

Attackers increasingly use valid credentials, native administrative tools, and living-off-the-land techniques. Their activity often resembles normal work.

Cyber decoys create assets with no legitimate business purpose:

• Fake user or service accounts
• Decoy credentials
• Monitored files and records
• Simulated systems and services
• Breadcrumbs leading toward controlled environments

Any interaction becomes a high-confidence signal requiring investigation.

CISA positions this approach as a complement to Zero Trust.

Zero Trust controls and continuously verifies access. Cyber decoys help expose unauthorized activity after an attacker enters the environment.

Organizations should start small:

• Identify high-value attack paths
• Place honeytokens near sensitive assets
• Connect every decoy to monitored alerts
• Assign an incident-response owner
• Test each alert and response workflow
• Map placement to relevant MITRE ATT&CK techniques
• Review decoys as systems and identities change

The goal is not to create more alerts.

The goal is to create better signals.

My takeawaysecurity teams should design environments where unauthorized exploration exposes itself.

Would your SOC recognize an attacker using valid credentials before sensitive data moves?