What this is about
On September 16, 2026, CISA published new guidance explaining how organizations can better protect their networks using cyber decoys, which are digital lures and traps designed to detect, divert, and study attackers. The document explicitly targets small and mid-sized organizations as well, providing a practical step-by-step guide based on the MITRE Engage framework and the MITRE ATT&CK knowledge base.
The fundamental premise is straightforward: if you assume that attackers will eventually gain access to your network (and you should), you need mechanisms that detect that access as quickly as possible. Cyber decoys are exactly that kind of mechanism, and compared to many other security measures they are relatively simple and inexpensive to implement.
What are cyber decoys
Cyber decoys are digital lures that look like legitimate systems, accounts, or data but exist solely to detect attackers, divert them, or gather intelligence about their methods. The decisive advantage is that any interaction with a decoy is suspicious by definition, since no legitimate user has any reason to touch these resources. This produces alerts with an extremely low false-positive rate, which is a significant benefit given the alert fatigue that plagues many SOCs (Security Operations Centers).
CISA distinguishes several types in the guidance:
Tripwires are decoys that immediately trigger an alert upon any interaction (e.g., access, login attempt, command execution). Essentially, any decoy can be configured as a tripwire provided it is properly connected to the monitoring infrastructure.
Honeytokens are data elements or logical objects with no legitimate business purpose that are placed among real data. These include fake documents on network shares, dummy credentials in password stores, decoy database records interspersed with real ones, fake email addresses in directories, or crafted URLs with no business function. Honeytokens have the advantage of requiring minimal complexity and can be deployed even by organizations with limited resources.
Honeypots are full decoy systems or services with limited but realistic functionality and sometimes deliberately built-in vulnerabilities. They are considerably more expensive to operate and maintain than honeytokens, but they provide more detailed intelligence about attacker behavior.
Breadcrumbs are deliberately planted lure artifacts designed to entice attackers into following a false trail that leads to additional decoys or controlled environments.
The MITRE Engage framework
CISA bases its guidance on the MITRE Engage framework, which categorizes adversary engagement activities into three goals:
Expose aims to detect attackers quickly and unambiguously. Decoys are placed in locations where legitimate users normally don’t go, and any interaction generates a high-priority alert. This could be a fake admin account (any use signals a compromise), a decoy folder on an executives desktop (any access is suspicious), or a fake network scanning tool on a non-technical employees workstation (any execution indicates malicious activity).
Affect aims to increase the cost and difficulty of an attack by redirecting attackers toward decoy systems and fake data. The attackers waste time analyzing worthless information, and the defenders gain time for their response.
Elicit is the most advanced category and involves the controlled observation of attackers in realistic but isolated environments in order to study their tactics, techniques, and procedures (TTPs) in detail. This category requires experienced personnel and a mature security organization; CISA recommends building Expose capabilities first before attempting Elicit.
The 10-step process
The document describes a structured process in three phases (Prepare, Operate, Understand) comprising 10 steps in total, and illustrates it using a concrete scenario: a mid-sized technology company that wants to protect its intellectual property from targeted attacks.
In the Prepare phase (steps 1-6), the organization gathers knowledge about its adversaries and its own environment: which threat actors are relevant, which TTPs they typically employ, and where the gaps in existing defenses lie. Based on this, operational objectives are defined, the desired adversary responses are specified (e.g., that they feel drawn to the decoy assets), and success criteria are established.
In the Operate phase (step 7), the decoys are deployed and tested during a planned maintenance window. CISA emphasizes an important point here: documentation of decoy locations should be stored outside the production environment so that it is not exposed if the network is compromised.
In the Understand phase (steps 8-10), the collected data is transformed into actionable insights that feed back into improving the decoy operations, detection logic, and incident response processes.
Honeytokens vs. honeypots
CISA presents honeytokens as the more pragmatic entry point, which is likely the more relevant option for most SMEs. The comparison in the guidance is instructive:
Honeypots operate at the system and network level, require moderate to high complexity, and presuppose a mature security organization. Honeytokens, by contrast, operate at the data and asset level, are simple to implement, and are suitable for organizations just beginning with adversary engagement.
CISA describes a concrete example: a project manager has a personal network share with monthly management briefings for a sensitive project. The security team places decoy files there with names like “Project_Metrics.xlsx” and “Budget_Data.docx”, informs the project manager that these are decoys, and instruments the files so that any access triggers an alert. Since only the project manager has access to the share and knows not to open the files, any interaction is a strong indicator of unauthorized activity.
Planning with ATT&CK and Engage
Perhaps the most valuable part of the document is the detailed description of how ATT&CK and Engage can be used together for planning decoy operations. CISA illustrates this using a water utility and describes a systematic process:
First, the organizations own vulnerabilities are mapped to ATT&CK techniques (e.g., “our email systems are susceptible to Phishing T1566”). Then existing defensive capabilities are also mapped to ATT&CK. Next, the known capabilities of relevant threat actors are mapped to ATT&CK as well. By overlaying these three maps, so-called “heatmaps” emerge that reveal where the largest gaps lie: techniques for which the organization is vulnerable, that known adversaries employ, but for which no or insufficient detection exists.
These gaps determine where decoys should be placed. In the example, the water utility identifies gaps in detecting phishing activity (beyond user reports), in detecting Living-off-the-Land techniques using PowerShell, and in detecting exfiltration via cloud backups. Based on these findings, specific decoys are then designed: fake accounts to detect Valid Accounts T1078, decoy TCP ports to detect Network Service Discovery T1046, beaconing elements in login portals to detect Phishing T1566, and sensitive command tokens on workstations to detect PowerShell-based command execution T1059.
Threat emulation
CISA emphasizes that decoy operations must be continuously tested and refined, and recommends threat emulation, red teaming, or purple teaming with the relevant ATT&CK techniques for this purpose. In the example scenario, the organization engages an external red team to emulate a ransomware campaign. During the reconnaissance phase, the execution of a planted network scanning tool triggers a decoy alert, and further alerts follow when the red team attempts to access a decoy service and authenticate with a fake AD account.
This iterative approach, where the results of each exercise feed into improving decoy placement, detection logic, and response procedures, is critical for long-term effectiveness.
Relevance for Swiss organizations
What makes this CISA guidance relevant for Swiss organizations as well is that cyber decoys address a problem that particularly affects SMEs: the detection of attackers who move through the network using valid credentials and native tools (“Living off the Land”). These techniques generate very few alerts in conventional security systems because the individual actions (login, file access, PowerShell execution) appear legitimate in isolation.
The implementation does not need to be elaborate. An organization can start with simple honeytokens: a few fake documents on critical shares, a dummy admin account in Active Directory, a few decoy credentials in a password manager. When these lures are properly connected to existing monitoring (SIEM, EDR), they deliver high-quality alerts with minimal effort..
The full CISA guide is freely available and contains considerably more detail than can be summarized here: Using Cyber Decoys to Strengthen Detection and Response (CISA, September 2026)
Want to implement cyber decoys in your network? Contact us for guidance on optimal placement and configuration.