What it asks for. Systems must include components specifically designed to be targets of malicious attacks, in order to detect, deflect and analyse those attacks.
In practice. This means honeypots, honey tokens, decoy credentials or deception platforms placed where attackers are likely to look. Because legitimate users have no reason to touch them, any interaction is a high-confidence signal. Evidence includes a description of deployed decoys, their placement and alert handling records. Decoys should be realistic enough to attract attention and placed in high-value network segments.
Common gaps. Decoys are sometimes deployed and then not monitored, so alerts go nowhere. Poorly isolated honeypots can create new risk if attackers use them as a foothold. Decoys that look obviously fake are easily avoided by skilled attackers.