CISA publishes a guide to trap attackers who are already inside

September 16, 2026. The CISA published “Using Cyber Decoys to Strengthen Detection and Response,” its first guide to cyber decoys aimed at critical infrastructure operators. The same day. Chris Butera, acting executive director of the cybersecurity division, framed decoys as “a very low-cost but actually high-fidelity way to detect an adversary who’s already gained access to networks.” September 2026. The 22-page document formalizes concepts — tripwires, breadcrumbs, honeytokens — that mature teams have practiced for years. Why it matters: conventional detection fails against attackers who move with valid credentials and native tools, and CISA answers with a weapon anyone can build themselves.

The problem detection does not see

Modern detection was built on a promise: an attacker leaves a signature. A malicious hash, a connection to a known address, an unusual tool. Yet the most damaging campaigns of recent years rely on the opposite: legitimate credentials, native system tools, and LOTL (living off the land) techniques that carry no signature of their own.

An attacker who logs in with a real Active Directory account, uses PowerShell or wmic for discovery, then RDP to move laterally, triggers almost nothing. They look like an administrator. Decoys attack exactly this blind spot: instead of hunting for a signature, you plant bait that has no legitimate reason to be touched, and any interaction becomes a signal.

Chris Butera puts it directly: “we believe that decoys can be both a very low-cost but actually high-fidelity way to detect an adversary who’s already gained access to networks.” The operative word is “high-fidelity”: a well-placed decoy produces no false positives, because no one, in normal use, has any reason to touch it.

What the guide defines

The document distinguishes three families of decoys, often wrongly conflated:

• Tripwires: assets placed like trip wires, whose access triggers an immediate alert. Their value is signal purity — access has no legitimate justification.
• Breadcrumbs: clues deliberately left behind (a credential in a configuration store, a reference in a script) to lead the attacker toward a decoy. They turn the adversary’s discovery into a marked path.
• Honeytokens: the CISA definition is worth quoting — “data elements or logical objects with no legitimate business use (e.g., fake records, credentials, or files) planted to detect unauthorized access or exfiltration. Any interaction strongly suggests malicious or otherwise unauthorized activity.”

The guide anchors everything in two frameworks teams already know: MITRE Engage, the offensive counterpart to adversary emulation, and MITRE ATT&CK, to tie each decoy to the technique it is meant to catch. The through-line is assume compromise: you accept that the attacker is already there, and you shape the terrain so they announce themselves.

Why CISA is speaking to critical infrastructure

The choice of audience is deliberate. The guide is aimed first at critical infrastructure operators, and Butera owns the economic targeting: these organizations “don’t have the most personnel or money” of a large enterprise. A commercial honeypot, a deception platform, or a dedicated threat hunting team is out of reach for many of them.

CISA’s answer fits one sentence: “you can create your own honey tokens yourself.” The guide aims to make the technique accessible to a team of any size and maturity, without depending on a vendor. It is a rare stance for an agency: rather than mandating a product, it documents a practice you can implement with whatever you have.

The link to Zero Trust is explicit. A Zero Trust model starts from the principle that no user or device is trustworthy by default; decoys are its natural complement, providing the continuous verification the model demands — permanent checking, not checking at the door. CISA lists four direct benefits: supporting continuous monitoring, producing high-fidelity alerts, reducing alert fatigue, and detecting post-compromise activity, including LOTL techniques.

Where to start without a platform

The guide demands no budget. The first cost-effective brick is the honeytoken, because it deploys in hours and needs no hardware:

• A fake account in the directory, never used, with rights that look interesting but are actually isolated. Any login attempt is an intrusion signal.
• A bait file — a fake “password list” or “configuration backup” — placed on a share, whose mere opening raises an alert.
• A fake DNS entry pointing at a decoy, to catch internal reconnaissance.
• A fake database credential, injected into a field that should never be read.

The rule that holds the whole thing together: the decoy must have no legitimate use. The moment an employee has a reason to touch the bait, the signal degrades into a false positive, and the alert fatigue you were trying to reduce returns. The guide insists on this discipline — a poorly isolated decoy is worse than none.

Only then does the heavier work of system decoys come in: a virtual machine that looks like a file server, an apparent SMB or RDP service, a phantom workstation in the fleet. At that point the team shifts from passive detection to threat intelligence collection: watching what the attacker seeks, which commands they run, where they come from. It is the same principle as an internet-facing honeypot, applied inside the network.

The traps that break the strategy

The guide is candid about the ways decoys fail, and most of them are organizational rather than technical. The first is scope creep: a team plants a honeytoken, gets one useful alert, then plants fifty more without isolating them — at which point a helpdesk technician resets a “stale” decoy account and the signal drowns in false positives. The guide’s “zero legitimate use” rule exists to prevent exactly this, and it is worth treating as a hard gate before adding any decoy.

The second is neglect. A decoy is not a set-and-forget asset. Its value depends on it being indistinguishable from the real environment it mimics, so a fake service account that has not been touched in three years — or a phantom workstation that never patches — becomes a marker of deception rather than a trap. A practiced adversary who notices a too-clean honeypot will simply route around it, and the decoy becomes a liability instead of a sensor. The guide’s answer is to treat decoy operations as an ongoing cycle: plant, monitor, and rotate or retire decoys as the environment changes.

The third is the one CISA flags most directly for small teams: alerting without ownership. A honeytoken that fires but has no one assigned to respond is worse than a log entry, because it creates the illusion of detection. The guide ties every decoy back to an existing incident response path rather than a separate dashboard — a deliberate choice that makes the technique adoptable by teams that already struggle with alert volume. If the alert has no owner, the decoy has no purpose.

Verdict

If you have no post-compromise detection at all, start this week with homemade honeytokens — a fake account, a bait file, a fake DNS entry — and wire their alerts into your existing incident channel. It is the best signal-to-cost ratio in the entire guide, and CISA explicitly recommends it for budget-constrained organizations. If you already run ad-hoc decoys, the guide is worth a read for two reasons: the “zero legitimate use” discipline, and the MITRE Engage mapping that turns isolated bait into a coherent strategy. If you already run a commercial deception platform, the document still serves as a shared reference for the teams that do not — and as a reminder that the value comes from placement rigor, not the price of the tool.

References

• CISA — Using Cyber Decoys to Strengthen Detection and Response (PDF)
• CISA — Using Cyber Decoys to Strengthen Detection and Response (resource page)
• CyberScoop — CISA promotes a fresh way to deter cyberattackers: Lie to them
• MITRE Engage — Starter Kit
• CISA — Identifying and Mitigating Living Off the Land Techniques