CISA Issues First Official Guide on Cyber Decoys for Detection and Response
On 16 September 2026, CISA released Using Cyber Decoys to Strengthen Detection and Response, its first official guide on defensive decoys. The document maps decoy, tripwire, honeytoken, honeypot, and breadcrumb techniques to MITRE ATT&CK and MITRE Engage for critical infrastructure operators.
On 16 September 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) published *Using Cyber Decoys to Strengthen Detection and Response*. It is the agency's first official technical guide that sets out a process for defensive cyber decoys.
The document is written for critical infrastructure operators, security analysts, and incident responders. It starts from an assume-breach model: organizations should plan for the possibility that an intruder already has some access, then place decoy assets inside the network to detect and disrupt malicious activity earlier and to reduce mean time to detect (MTTD). The guide maps practices to MITRE ATT&CK and MITRE Engage.
CISA said many intrusions now rely on valid credentials, built-in system tools, and living-off-the-land techniques rather than novel vulnerabilities. Signature-based detection often misses that activity, so organizations may notice an intrusion only after a long delay.
Chris Butera, Acting Executive Assistant Director for Cybersecurity at CISA, said active use of decoys in a defense strategy can make critical infrastructure networks unfriendly to attackers, including those who use living-off-the-land techniques. He said the guide is meant to be usable by defense teams at any skill level.
Decoy categories
The guide defines several asset types:
- Decoy: an asset that mimics a legitimate system, account, or data set, used to divert attention, expose an intruder, or collect threat intelligence.
- Tripwire: a decoy that generates an alert when it is accessed, used for authentication, or used to run a command.
- Honeytoken: fake data or credentials with no legitimate business use, such as fabricated accounts, passwords, files, or email addresses. Any use indicates unauthorized activity.
- Honeypot: a decoy system or service with limited real function, used to attract and observe an intruder and to draw activity away from production assets.
- Breadcrumb: a planted decoy clue that points an intruder toward other decoys or a controlled environment.
Mapping to MITRE Engage
CISA maps defensive goals to three MITRE Engage categories:
- Expose: place decoys in high-value areas so that interaction produces a high-fidelity alert and reveals the intruder early.
- Affect: use decoy accounts, services, and credentials to waste the intruder's time and raise cost.
- Elicit: draw the intruder into a realistic but isolated environment to observe tactics, techniques, and procedures and to collect threat intelligence.
The guide describes MITRE Engage's 10-step adversarial engagement process in three phases: Prepare, Operate, and Understand. Prepare covers assessing knowledge of attackers and of the organization, setting operational goals, deciding how the attacker should react and what the attacker should perceive, choosing presentation channels, and defining success and gating criteria. Operate is execution. Understand covers turning raw data into usable intelligence, feeding that intelligence back, and reviewing what worked and what failed.
Two example scenarios are included. One covers intellectual property protection at a high-technology firm. The other covers ransomware defense in the water sector. In the high-technology example, the defense team places decoy files and fabricated credentials on executive desktops, in email, and on shared drives that are frequent phishing targets. Interaction with those items is treated as an early-stage alert.
Detection quality and operations
CISA said decoys can produce high-fidelity alerts because they have almost no legitimate business use, which can cut noise and shorten MTTD. The guide advises organizations to test and refine deployments with threat simulation and red-team or purple-team exercises. It also advises keeping the inventory of decoy locations outside the production environment so that a breach of production systems does not disclose the decoy map.
The guide is aimed in part at small and midsize organizations and teams that are new to deception. CISA describes decoy use as incremental and scalable, without a large architecture overhaul, and lists open-source, commercial, in-house, and existing-tool options. It recommends building basic expose capability first, then considering affect and elicit operations.
Stated limits
The document states that decoys cannot stop an intruder from entering a network and cannot replace perimeter controls, endpoint detection, or incident response. They serve as a detection and disruption supplement. CISA notes legal and operational risk, especially for elicit-style operations, and the need for monitoring capacity and trained staff. Capture is not guaranteed. Results depend on design, placement, and operations.