CISA Releases Guidance on Cyber Decoy Strategies to Enhance Detection and Response

The Cybersecurity and Infrastructure Security Agency (CISA) has published new guidance titled 'Using Cyber Decoys to Strengthen Detection and Response.' The advisory is intended to help defensive teams at varying levels of cybersecurity maturity plan and implement cyber decoy strategies that strengthen detection and response capabilities.

Many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living-off-the-land (LOTL) techniques to conduct discovery, move laterally, and access data. Cyber decoys are assets that appear to be legitimate systems, accounts, or data, but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence (CTI).

As organizations adopt Zero Trust models, they should assume that a malicious threat actor may gain some level of access to their environment and plan accordingly. Cyber decoys complement Zero Trust by supporting continuous monitoring and verification, creating high-fidelity alerts for suspicious activity, reducing alert fatigue, and helping defenders detect post-compromise activity, including adversary LOTL techniques.

The guidance introduces decoy concepts—including tripwires, breadcrumbs, and honeytokens—and uses the MITRE Engage and MITRE ATT&CK frameworks to provide practical, low-complexity steps for planning, implementing, and refining decoy operations.

Note: CISA is committed to providing access to our web pages and documents for individuals with disabilities. If the format of any elements or content within this document interferes with your ability to access the information, please email contact@cisa.dhs.gov to indicate the nature of your accessibility problem and the preferred format in which to receive the material.