BLUF: On September 16, CISA published new guidance telling critical infrastructure operators to plant decoys inside their own networks. The agency frames decoys as a complement to Zero Trust, not a replacement for it.
The target failure mode: attackers who get in using stolen credentials and native tools, and who look exactly like legitimate users once they’re inside.
Mid-market organizations without a red team or a deception platform budget can apply the same logic at a fraction of the scale. The hard part isn’t the technology. It’s knowing what a real attacker goes for first.
What CISA Actually Released
CISA’s guidance describes cyber decoys as assets designed to look like legitimate systems, accounts, or data. Their job is to distract an adversary, detect their presence, or collect threat intelligence once they’re in.
The agency is explicit: decoys complement Zero Trust rather than substitute for it. The whole premise depends on assuming an adversary has already gained some level of access to the environment.
That assumption is the part worth sitting with. Zero Trust asks a system to verify every request instead of trusting a perimeter. It’s an architecture built around not letting the wrong actor in.
Decoys start from a different premise: someone got in anyway. Now the job is to make them reveal themselves before they reach anything that matters.
CISA built this guidance for a problem its own language names directly: organizations struggling to detect adversaries who use legitimate credentials, native tools, and living-off-the-land techniques to move around a network. That’s not a malware problem. Malware gets caught by tools built to catch malware. A logged-in user opening a file share, checking a directory, or querying a database doesn’t trip anything, because it looks like the thousand other times someone did the same thing for a legitimate reason.
The guidance lays out a three-phase process:
- Preparation — evaluating the threat landscape and setting goals
- Execution — deploying the decoys themselves
- Understanding — turning what happened into actionable intelligence
It also covers several decoy types, from honeytokens and tripwires to full honeypot environments, with example deployment scenarios for each.
Why This Matters Past the Federal Fence Line
It would be easy to read this as infrastructure-scale guidance that doesn’t translate to a 400-person regional business. We’d push back on that reading, not because the technology is identical at every scale (it isn’t), but because the reasoning behind it travels.
Every mid-market environment we’ve assessed has the same blind spot CISA is naming. Once an attacker is authenticated, whether through a phished credential, a reused password, or a session token lifted from an unpatched endpoint, most monitoring stacks stop asking hard questions.
The tooling was built to flag anomalies against a baseline of normal behavior, and a competent attacker’s first move is almost always to look as close to normal as possible. Continuous verification, the core Zero Trust promise, checks whether a request is authorized. It doesn’t check whether the authorized-looking request is the one a real employee would actually make.
A decoy closes a different gap than a detection rule does. A detection rule has to be tuned against a threshold, which means it will always trade false positives against false negatives somewhere. A decoy account that nobody legitimate has a reason to touch doesn’t need a threshold. Any interaction with it is the signal.
That’s what CISA means when it describes decoy techniques as incremental and cost-effective enough to deploy without major architectural changes. You’re not retuning a SIEM. You’re placing something specific and watching whether anyone touches it.
Think about how most mid-market intrusions actually get discovered today, when they get discovered before serious damage at all. It’s rarely a rule firing on the exact malicious action. More often, it’s:
- A help desk ticket about a locked account
- A finance team member noticing a wire request that doesn’t match the usual pattern
- A forensic review after the fact, reconstructing a dwell time measured in weeks
A decoy account with admin-sounding privileges that nobody on staff has ever logged into removes the guesswork from that first category entirely. Either someone touches it, in which case you have a near-certain signal worth investigating within minutes, or nobody does, in which case it costs you nothing ongoing.
That asymmetry, cheap to maintain and unusually reliable when it fires, is a big part of why CISA is pushing this now instead of treating it as a niche technique reserved for organizations with dedicated deception engineering teams.
What Separates a Decoy That Works From a Decoy That’s Theater
This is where the idea gets harder than it sounds, and where we’d urge some skepticism toward anyone selling it as a plug-in product.
A decoy only works if it’s believable enough that an attacker who’s already done real reconnaissance inside your environment would plausibly go for it. That requires knowing, specifically:
- Which file shares get checked first during lateral movement
- Which naming conventions signal a privileged account
- Which systems an insider threat or a credentialed intruder would assume hold something valuable
That’s offensive knowledge. It comes from having done the reconnaissance yourself, on someone else’s network, under an engagement scope, not from a vendor’s default decoy template dropped into your directory structure.
CISA’s guidance is direct about this too: decoys should be placed where legitimate users rarely or never interact with them, configured to produce high-fidelity alerts, and designed to divert an adversary toward data or environments that look real but aren’t.
A decoy that’s obviously fake to anyone who’s done real network reconnaissance won’t fool an attacker who has. A decoy nobody’s watching is worse than no decoy at all, because it creates a false sense of coverage without producing an alert that reaches a human who can act on it.
That’s the actual gate for mid-market adoption. Not “can we afford deception technology.” Most of the mechanics CISA describes cost closer to an afternoon of configuration than a platform purchase:
- A honeytoken credential
- A fake share with a name that sounds important
- A dormant admin account nobody should ever log into
The real cost is the judgment required to place them somewhere an attacker would actually go, and the discipline to make sure an alert on that decoy reaches someone who’ll respond to it in minutes, not someone reviewing a weekly report.
There’s a version of this that fails quietly, and it’s worth naming directly. An IT team stands up a single honeytoken because a blog post or a vendor demo made it look easy, checks the box, and moves on without ever revisiting whether the placement still makes sense as the environment changes.
Six months later a new file server exists that the decoy strategy never accounted for, the one person who knew the alert routing has left, and the “deception program” is a line item on a slide with no operational teeth behind it.
CISA’s own three-phase framework exists precisely to prevent that drift. Skipping straight to execution without the preparation and review phases is how a genuinely useful technique turns into exactly the kind of compliance checkbox it was meant to replace.
The Decision This Actually Requires
CISA framed this guidance around organizations at varying levels of security maturity. That’s the agency implicitly admitting that most defenders, federal or commercial, don’t have visibility into what happens after an attacker gets past the front door. That’s a candid thing for a government agency to say out loud, and it’s worth taking seriously instead of filing it under “nice-to-have for enterprises with red teams.”
For a mid-market security leader, the practical question isn’t whether to add decoys to a roadmap. It’s narrower than that: where in your environment are you most likely to be wrong about what you’d actually see if someone with a valid login started moving somewhere they shouldn’t.
Put something there worth watching. Make sure the alert goes somewhere that gets checked in real time. Treat the exercise as a test of your own assumptions about what normal looks like on your network.
That’s a smaller project than it sounds, and it’s a more honest one than another round of tuning alerts against a baseline that an attacker who’s done their homework already knows how to blend into.
References
- Mascellino, A., “CISA Urges Critical Infrastructure to Plant Decoys Inside Networks,” Infosecurity Magazine, September 16, 2026.
- CISA, “Using Cyber Decoys to Strengthen Detection and Response,” September 16, 2026.
- Arghire, I., “CISA Releases Guidance on Deploying Cyber Decoys,” SecurityWeek, September 17, 2026.