CISA promotes a fresh way to deter cyberattackers: Lie to them

CISA's new guidance highlights a critical gap in traditional security postures: organizations often lack high-fidelity mechanisms to detect adversaries who have already breached their perimeter. Cyber decoys such as honeypots and honeytokens address this by creating false targets that attract and expose attackers operating inside the network, generating alerts with very low false-positive rates. This 'assume-compromise' philosophy acknowledges that prevention alone is insufficient, and that early detection of lateral movement is essential to limiting damage. The strategy is particularly valuable for critical infrastructure, where dwell time — the period between initial compromise and detection — can be devastatingly long. By embedding deception into the environment, defenders shift the asymmetry of advantage back toward the defender.