CISA now tells critical infrastructure to plant fake credentials for attackers to trip over
The federal cyber agency now recommends planting fake records, credentials and files across critical infrastructure networks, and its pitch to understaffed teams is that an alert on a decoy needs no analyst to interpret it.
The Watch · Security desk
What happened
- CISA published "Using Cyber Decoys to Strengthen Detection and Response" on Wednesday, its first guidance telling critical infrastructure owners and operators how to set up phony systems, accounts and data.
- The document runs 22 pages and covers decoy principles and goals, definitions of the different decoy types and how to use them, and deployment scenarios.
- It introduces tripwires, breadcrumbs and honeytokens, and maps the implementation steps onto the MITRE Engage and MITRE ATT&CK frameworks.
- Chris Butera, acting executive director of CISA's cybersecurity division, said the guidance came out of internal discussions with the agency's threat hunters and penetration testers.
Why it matters
- What's now possible capability A team with no hunt capacity gets one alert class it can act on the first time it fires, because nothing in production has a reason to read a planted credential or file.
- What it limits constraint Decoys report after someone is already inside, so they shorten dwell time. Closing the initial access route takes other means.
- What it sets up precedent With CISA on record encouraging implementation, assessors, boards and insurers now have a federal baseline to ask against, and operators will be asked what decoys they run without any rule requiring them.
Next story · Security · Oct 8
Ten agencies tie China-linked intrusions across several sectors to Integrity Technology GroupConfirmed13 publishers
Deception works because a planted record has no legitimate reader. An alert on one does not require a behavioral baseline. CISA's definition in the document is narrow. Honeytokens are "Data elements or logical objects with no legitimate business use (e.g., fake records, credentials, or files) planted to detect unauthorized access or exfiltration. Any interaction strongly suggests malicious or otherwise unauthorized activity" [12].
The case CISA wants covered is the one where behavioral detection has the least to work with. The agency writes that many organizations struggle to detect adversaries who use legitimate credentials, native tools and living-off-the-land techniques to run discovery, move laterally and access data [6]. Decoys, in the guidance's terms, are assets that look like legitimate systems, accounts or data but exist to distract an adversary, detect their presence, or help collect threat intelligence [13]. Under Zero Trust the agency credits them with four things: continuous monitoring and verification, high-fidelity alerts for suspicious activity, reduced alert fatigue, and detection of post-compromise activity including living-off-the-land tradecraft [8].
"We've been looking at it for a while, and we believe that decoys can be both a very low-cost but actually high-fidelity way to detect an adversary who's already gained access to networks," Chris Butera, acting executive director of CISA's cybersecurity division, told CyberScoop at Google Cloud's Cyber Defense Summit 26 [5]. He said the approach is complementary to zero-trust and assume-compromise programs [2]. The guidance is "really relevant for everyone," Butera said, and especially useful in critical infrastructure sectors that do not have the most personnel or money [7]. "This could be something to prioritize as a lower cost solution," he said. "You can create your own honey tokens yourself" [9].
CISA published no detection rates, deployment counts or cost figures for decoy programs. The low-cost, high-fidelity framing rests on Butera and the guide itself. In the news release Butera said decoys "help make critical infrastructure networks unfriendly places for adversaries and enhance resilience to compromise, even against living-off-the-land techniques" [4]. The agency "encourages critical infrastructure organizations to review this guide and implement a cyber decoy strategy" [11]. No date comes with that, and CISA says it will update the document once Section 508 compliance is finished [15].
What to watch
- Whether CISA turns the encouragement into a directive or folds decoy checks into its free assessment services.
- Whether the Section 508 update changes the deployment scenarios operators are copying from the current PDF.
- Whether the guide starts appearing in sector assessment questionnaires and insurer application forms.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives30
- Confidence75
Perspective Coverage
5 publishers- Builder
- Builder 46%
- Operator
- Operator 47%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The 22-page guidance includes decoy principles and goals, definitions of the different kinds of decoys and how to use them, and scenarios for deployment.
- [2]
Butera said decoys are especially complementary for zero-trust and assume-compromise approaches.
- [3]
For the first time, CISA is advising critical infrastructure owners and operators on how to set up phony systems, accounts and data to deceive would-be hackers into being distracted and discovered; the guidance, "Using Cyber Decoys to Strengthen Detection and Response," was published Wednesday.
- [4]
"Cyber decoys used in a proactive cyber defense strategy help make critical infrastructure networks unfriendly places for adversaries and enhance resilience to compromise, even against living-off-the-land techniques," Butera said in a news release.
- [5]
"We've been looking at it for a while, and we believe that decoys can be both a very low-cost but actually high-fidelity way to detect an adversary who's already gained access to networks," Butera told CyberScoop at Google Cloud's Cyber Defense Summit 26.
- [6]
CISA writes that many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living off the land (LOTL) techniques to conduct discovery, move laterally, and access data.
- [7]
Butera said the guidance is "really relevant for everyone" but is something that can be especially useful in critical infrastructure sectors that do not have the most personnel or money.
- [8]
CISA says cyber decoys complement Zero Trust by supporting continuous monitoring and verification, creating high-fidelity alerts for suspicious activity, reducing alert fatigue, and helping defenders detect post-compromise activity including adversary LOTL techniques.
- [9]
"This could be something to prioritize as a lower cost solution," Butera said. "You can create your own honey tokens yourself."
- [10]
The guidance introduces decoy concepts including tripwires, breadcrumbs, and honeytokens, and uses the MITRE Engage and MITRE ATT&CK frameworks to provide practical, low-complexity steps for planning, implementing, and refining decoy operations.
- [11]
In the news release Butera said "CISA encourages critical infrastructure organizations to review this guide and implement a cyber decoy strategy," and that the guide enables any defensive team regardless of skill level to understand the value and steps of decoy operations.
- [12]
The guidance defines honeytokens as "Data elements or logical objects with no legitimate business use (e.g., fake records, credentials, or files) planted to detect unauthorized access or exfiltration. Any interaction strongly suggests malicious or otherwise unauthorized activity."
- [13]
CISA defines cyber decoys as assets that appear to be legitimate systems, accounts, or data but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence.
- [14]
The guidance arose from internal discussions with CISA's threat hunters and penetration testers about how decoys can be a cheap, effective way to disrupt attackers, said Chris Butera, acting executive director of the cybersecurity division.
- [15]
CISA says it will update "Using Cyber Decoys to Strengthen Detection and Response" when the Section 508 compliance work has been completed.
Sources
5 independent publishers whose own reporting we read for this story.
- cisa.govUsing Cyber Decoys to Strengthen Detection and Response
1 article · September 16, 2026
- cyberscoop.comCISA promotes a fresh way to deter cyberattackers: Lie to them
1 article · September 16, 2026
- helpnetsecurity.comCISA wants critical infrastructure orgs and smaller security teams to start using cyber decoys
1 article · September 17, 2026
- infosecurity-magazine.comCISA Urges Critical Infrastructure to Plant Decoys Inside Networks
1 article · September 17, 2026
- securityweek.comCISA Releases Guidance on Deploying Cyber Decoys
1 article · September 17, 2026