[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flSgW-G-ipwBkkRO9GUPmVFWUiQy8lX63D_aNeMBfa5A":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":85},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"3d3b1fa8-a38a-4033-a090-591276e07d6c","CISA promotes a fresh way to deter cyberattackers: Lie to them","cisa-promotes-a-fresh-way-to-deter-cyberattackers-lie-to-them-6a30ae","It’s the first guidance from the Cybersecurity and Infrastructure Security Agency on deploying decoys, like honeypots, to detect and distract adversaries. The post CISA promotes a fresh way to deter cyberattackers: Lie to them appeared first on CyberScoop.","The Cybersecurity and Infrastructure Security Agency (CISA) has released new guidance encouraging critical infrastructure organizations to deploy cyber decoys, such as honeypots and honeytokens, to detect and distract adversaries. This strategy, detailed in the \"Using Cyber Decoys to Strengthen Detection and Response\" guide, aims to provide a low-cost, high-fidelity method for identifying attackers who have already gained network access, complementing zero-trust and assume-compromise approaches.","CISA releases guidance on using cyber decoys to detect and deter attackers.","https:\u002F\u002Fcyberscoop.com\u002Fcisa-guidance-cyber-decoys-critical-infrastructure\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F09\u002FGettyImages-2284444181-1.jpg","2026-09-16T20:22:03+00:00","2026-09-16T22:00:39.579353+00:00",7,[17,20,23,25,27],{"name":18,"type":19},"CISA","vendor",{"name":21,"type":22},"honeypots","technology",{"name":24,"type":22},"honeytokens",{"name":26,"type":22},"zero-trust",{"name":28,"type":19},"Google Cloud","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":29,"icon":31,"name":32,"slug":33},null,"Threat Intelligence","threat-intelligence",[35,40,45,50],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":51},{"id":29,"icon":31,"name":32,"slug":33},[],[18,28],{"controls":55,"vendors":84},[56],{"slug":57,"name":58,"problem":59,"products":60},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-advanced-threat-defense","ShadowPlex Advanced Threat Defense","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fadvanced-threat-defense\u002F","Deception that detects lateral movement and insider threats early, using AI to place and tune decoys.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-deception","Zscaler Deception","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fdeception-technology","Decoys built into the Zscaler platform that turn any attacker interaction into a confirmed alert.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":79,"url":82,"description":83},"thinkst-canary","Thinkst Canary","\u002Fvendor-logos\u002Fthinkst-canary.png","canary","https:\u002F\u002Fcanary.tools\u002F","Hardware, virtual and cloud honeypots that pose as servers, routers or file shares and alert the moment an attacker interacts with them.",[],{"slug":86,"title":87,"body":88,"framework_refs":89,"framework_notes":100},"cisa-endorses-cyber-deception-as-a-detection-and-response-strategy","CISA Endorses Cyber Deception as a Detection and Response Strategy","CISA's new guidance highlights a critical gap in traditional security postures: organizations often lack high-fidelity mechanisms to detect adversaries who have already breached their perimeter. Cyber decoys such as honeypots and honeytokens address this by creating false targets that attract and expose attackers operating inside the network, generating alerts with very low false-positive rates. This 'assume-compromise' philosophy acknowledges that prevention alone is insufficient, and that early detection of lateral movement is essential to limiting damage. The strategy is particularly valuable for critical infrastructure, where dwell time — the period between initial compromise and detection — can be devastatingly long. By embedding deception into the environment, defenders shift the asymmetry of advantage back toward the defender.",[90,91,92,93,94,95,96,97,98,99],"NIST SP 800-160 Vol. 2 (Cyber Resiliency — Deception)","NIST SP 800-53 SC-26 (Honeypots)","NIST SP 800-53 SI-4 (System Monitoring)","NIST CSF DE.CM-1 (Network Monitoring)","NIST CSF RS.AN-1 (Incident Analysis)","CIS Control 13 (Network Monitoring and Defense)","CIS Control 17 (Incident Response Management)","MITRE ATT&CK T1078 (Valid Accounts — detectable via honeytokens)","CISA 'Using Cyber Decoys to Strengthen Detection and Response' Guide (2024)","Zero Trust Architecture — NIST SP 800-207",{}]