Using Cyber Decoys to Strengthen Detection and Response

Summary

CISA has published guidance to help organizations implement cyber decoy strategies, strengthening their detection and response capabilities. These decoys, which mimic legitimate assets, are designed to distract adversaries, detect their presence, and collect threat intelligence, especially against 'living off the land' techniques. The guidance integrates concepts like tripwires and honeytokens with the MITRE Engage™ and ATT&CK® frameworks to aid in planning and implementation.

Full text

Using Cyber Decoys to Strengthen Detection and Response Publish DateSeptember 16, 2026 Using Cyber Decoys to Strengthen Detection and Response Related topics: Cybersecurity Best Practices , Critical Infrastructure Security and Resilience , Zero Trust CISA developed this guidance to help defensive teams at varying levels of cybersecurity maturity plan and implement cyber decoy strategies that strengthen their detection and response capabilities. Many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living off the land (LOTL) techniques to conduct discovery, move laterally, and access data. Cyber decoys are assets that appear to be legitimate systems, accounts, or data, but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence (CTI). As organizations adopt Zero Trust models, they should assume that a malicious threat actor may gain some level of access to their environment and plan accordingly. Cyber decoys complement Zero Trust by: Supporting continuous monitoring and verification, Creating high-fidelity alerts for suspicious activity, Reducing alert fatigue, and Helping defenders detect post-compromise activity, including adversary LOTL techniques. This guidance introduces decoy concepts—including tripwires, breadcrumbs, and honeytokens—and uses the MITRE Engage™ and MITRE ATT&CK® frameworks to provide practical, low-complexity steps for planning, implementing, and refining decoy operations. For additional information, visit CISA’s Best Practices for MITRE ATT&CK Mapping. Resource Materials Resource Name File Type File Size Language Using Cyber Decoys to Strengthen Detection and Response PDF, 950.72 KB 950.72 KB English Tags Audience: Executives, Federal Government, Industry, Small and Medium Businesses, State, Local, Tribal, and Territorial Government Topics: Critical Infrastructure Security and Resilience, Cybersecurity Best Practices, Incident Response, Zero Trust Related Resources Sep 02, 2026 Publication Communicating Under Pressure: Best Practices for Service Providers Apr 29, 2026 Publication Adapting Zero Trust Principles to Operational Technology Feb 04, 2025 External, Publication Guidance and Strategies to Protect Network Edge Devices Dec 18, 2024 Publication Mobile Communications Best Practice Guidance

Entities