CISA urges businesses to use cyber decoys to detect intrusions

The US Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to use honeypots and other cyber decoys to detect intrusions and occupy attackers with spoofed systems, accounts, or data. TechRadar reports that CISA recently published guidance for businesses with different sizes and levels of cybersecurity maturity.

CISA said many organizations struggle to detect adversaries who use legitimate credentials, native tools, and living-off-the-land (LOTL) techniques to discover systems, move laterally, and access data. Its advisory describes cyber decoys as assets designed to distract attackers, detect their presence, or support the collection of cyber threat intelligence (CTI).

The guidance says decoys fit Zero Trust models, which assume that no user, device, or network segment is inherently trustworthy and that an attacker may gain some access. It says decoys can complement Zero Trust Network Access (ZTNA) by supporting continuous monitoring and verification, generating high-fidelity alerts, reducing alert fatigue, and helping defenders identify post-compromise activity.

CISA also describes the approach as incremental, cost-effective, and scalable, saying it can be added to an existing cybersecurity stack without major architectural changes. The guidance covers tripwires, breadcrumbs, and honeytokens, and uses the MITRE Engage and MITRE ATT&CK frameworks to outline how organizations can plan, implement, and refine cyber-decoy operations.