[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-26":3},{"item":4,"lessons":18,"controls":28,"related":42},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-26","SC-26","Decoys",2,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Systems must include components specifically designed to be targets of malicious attacks, in order to detect, deflect and analyse those attacks.\n\n**In practice.** This means honeypots, honey tokens, decoy credentials or deception platforms placed where attackers are likely to look. Because legitimate users have no reason to touch them, any interaction is a high-confidence signal. Evidence includes a description of deployed decoys, their placement and alert handling records. Decoys should be realistic enough to attract attention and placed in high-value network segments.\n\n**Common gaps.** Decoys are sometimes deployed and then not monitored, so alerts go nowhere. Poorly isolated honeypots can create new risk if attackers use them as a foothold. Decoys that look obviously fake are easily avoided by skilled attackers.","Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.\nDiscussion: Decoys (i.e., honeypots, honeynets, or deception nets) are established to attract adversaries and deflect attacks away from the operational systems that support organizational mission and business functions. Use of decoys requires some supporting isolation measures to ensure that any deflected malicious code does not infect organizational systems. Depending on the specific usage of the decoy, consultation with the Office of the General Counsel before deployment may be needed.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.664+00:00",{"total":9,"list":19},[20,24],{"slug":21,"title":22,"published_at":23},"cisa-endorses-cyber-deception-as-a-detection-and-response-strategy","CISA Endorses Cyber Deception as a Detection and Response Strategy","2026-09-16T22:20:55.835+00:00",{"slug":25,"title":26,"published_at":27},"context-bombing-using-prompt-injection-to-neutralize-ai-hacking-agents","Context Bombing: Using Prompt Injection to Neutralize AI Hacking Agents","2026-07-18T10:20:18.69+00:00",[29,34,38],{"slug":30,"name":31,"problem":32,"stories":33},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":35,"name":36,"problem":37,"stories":33},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",{"slug":39,"name":40,"problem":41,"stories":33},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[43,48,52,56,60,65,70,74],{"family":44,"item":45,"code":46,"title":47,"together":9},"cis","13","Control 13","Network Monitoring and Defense",{"family":44,"item":49,"code":50,"title":51,"together":33},"17","Control 17","Incident Response Management",{"family":44,"item":53,"code":54,"title":55,"together":33},"3","Control 3","Data Protection",{"family":44,"item":57,"code":58,"title":59,"together":33},"6","Control 6","Access Control Management",{"family":61,"item":62,"code":63,"title":64,"together":33},"mitre-atlas","aml-t0051","AML.T0051","LLM Prompt Injection",{"family":66,"item":67,"code":68,"title":69,"together":33},"mitre-attack","t1078","T1078","Valid Accounts",{"family":5,"item":71,"code":72,"title":73,"together":33},"ac-2","AC-2","Account Management",{"family":5,"item":75,"code":76,"title":77,"together":33},"si-3","SI-3","Malicious Code Protection"]