[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftDp3GiOxK9x7hPS8i2vcDWmuqPtEngY4U3z5x1nzGDc":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":77},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":33},"06e98713-da1a-4368-bdae-f274667cefca","Using Cyber Decoys to Strengthen Detection and Response","using-cyber-decoys-to-strengthen-detection-and-response-c3c3b1","CISA developed this guidance to help defensive teams at varying levels of cybersecurity maturity plan and implement cyber decoy strategies that strengthen their detection and response capabilities. Many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living off the land (LOTL) techniques to conduct discovery, move laterally, and access data. Cyber decoys are assets that appear to be legitimate systems, accounts, or data, but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence (CTI). As organizations adopt Zero Trust models, they should assume that a malicious threat actor may gain some level of access to their environment and plan accordingly. Cyber decoys complement Zero Trust by: Supporting continuous monitoring and verification, Creating high-fidelity alerts for suspicious activity, Reducing alert fatigue, and Helping defenders detect post-compromise activity, including adversary LOTL techniques. This guidance introduces decoy concepts—including tripwires, breadcrumbs, and honeytokens—and uses the MITRE Engage™ and MITRE ATT&CK® frameworks to provide practical, low-complexity steps for planning, implementing, and refining decoy operations. For additional information, visit CISA’s Best Practices for MITRE ATT&CK Mapping. Note: CISA is committed to providing access to our web pages and documents for individuals with disabilities, both members of the public and federal employees. If the format of any elements or content within this document interferes with your ability to access the information, as defined in the Rehabilitation Act, please email contact@cisa.dhs.gov. To enable us to respond in a manner most helpful to you, please indicate the nature of your accessibility problem and the preferred format in which to receive the material. CISA will update Using Cyber Decoys to Strengthen Detection and Response when the 508 compliance has been completed.","CISA has published guidance to help organizations implement cyber decoy strategies, strengthening their detection and response capabilities. These decoys, which mimic legitimate assets, are designed to distract adversaries, detect their presence, and collect threat intelligence, especially against 'living off the land' techniques. The guidance integrates concepts like tripwires and honeytokens with the MITRE Engage™ and ATT&CK® frameworks to aid in planning and implementation.","CISA releases guidance on using cyber decoys to enhance detection and response capabilities.","https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fresources\u002Fusing-cyber-decoys-strengthen-detection-and-response",null,"2026-09-16T12:00:00+00:00","2026-09-16T18:00:18.490305+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"CISA","vendor",{"name":21,"type":22},"Zero Trust","technology",{"name":24,"type":22},"living off the land",{"name":26,"type":22},"MITRE ATT&CK",{"name":28,"type":22},"MITRE Engage","c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73",{"id":29,"icon":12,"name":31,"slug":32},"Incident Response","incident-response",[34,39,41],{"category":35},{"id":36,"icon":12,"name":37,"slug":38},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":40},{"id":29,"icon":12,"name":31,"slug":32},{"category":42},{"id":43,"icon":12,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":49,"vendors":76},[50],{"slug":51,"name":52,"problem":53,"products":54},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-deception","Zscaler Deception","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fdeception-technology","Decoys built into the Zscaler platform that turn any attacker interaction into a confirmed alert.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":72,"product_name":73,"url":74,"description":75},"shadowplex-advanced-threat-defense","ShadowPlex Advanced Threat Defense","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fadvanced-threat-defense\u002F","Deception that detects lateral movement and insider threats early, using AI to place and tune decoys.",[],{"slug":78,"title":79,"body":80,"framework_refs":81,"framework_notes":91},"cisa-guidance-deploy-cyber-decoys-to-detect-and-disrupt-adversaries","CISA Guidance: Deploy Cyber Decoys to Detect and Disrupt Adversaries","Organizations are often unable to detect adversaries who use 'living off the land' techniques because these attackers blend in with normal system activity, making traditional signature-based detection ineffective. CISA's new guidance promotes the use of cyber decoys — such as honeypots, tripwires, and honeytokens — that mimic legitimate assets to lure, detect, and gather intelligence on attackers early in the intrusion lifecycle. This matters because early detection dramatically reduces dwell time, limiting the damage attackers can cause before being identified. Without proactive detection strategies, organizations remain reactive, often discovering breaches only after significant harm has occurred.",[82,83,84,85,86,87,88,89,90],"CISA Cyber Decoy Implementation Guidance (2024)","MITRE Engage™ Framework","MITRE ATT&CK® Framework – Living Off the Land Techniques (T1218, T1059)","NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide","NIST SP 800-94 – Guide to Intrusion Detection and Prevention Systems","CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","NIST DE.CM-1 – Network Monitoring (CSF Detect Function)","NIST DE.AE-2 – Anomaly and Event Detection",{}]