CISA Urges Critical Infrastructure to Plant Decoys Inside Networks

CISA has urged critical infrastructure organizations to plant fake files, accounts and credentials inside their networks to catch attackers who are already past the perimeter.

The guidance on cyber decoys , published September 16, is the agency's first detailed treatment of the process. It assumes intruders will eventually gain some level of access.

The approach matters most where adversaries use legitimate credentials and native tools to move around, which conventional monitoring struggles to separate from normal activity.

CISA framed decoys as an addition to Zero Trust rather than a replacement. The new guidance does not contain any mandatory measures.

Focus on Honeytokens Over Honeypots

The guide deliberately narrows its scope around the use of decoys. It covers decoys placed inside an organization's own networks and systems rather than the internet-facing honeypots the term usually evokes.

That pushes honeytokens to the front. CISA defines them as data items with no legitimate business use, such as fake records, credentials or files planted among real assets, where any interaction strongly suggests unauthorized activity.

Its own comparison rates honeytokens low in complexity against medium to high for honeypots, which operate at system level and carry deliberate vulnerabilities. The worked example in the guide is a honeytoken tripwire on a project .

Tripwires are the mechanism. Because staff have no reason to touch a decoy, an alert from one arrives with far less noise than conventional tooling generates, which is how CISA expects organizations to cut mean time to detection (MTTD).

Three Actions and a Testing Loop

CISA sets out three key actions for organizations to take: deploy high-fidelity tripwires in high-value areas, use MITRE ATT&CK and MITRE Engage to map adversary tactics against decoy coverage, and refine the whole thing continuously through threat emulation. Engage is MITRE's framework for planning adversary engagement. It sorts defensive objectives into Expose, which detects intruders, Affect, which disrupts or delays them, and Elicit, which studies their techniques in controlled environments. CISA's practical material covers Expose. The agency describes the guide as an introductory resource for small to medium-sized organizations and for defenders new to decoy operations or to Engage itself. Sysdig senior cybersecurity strategist Crystal Morin pointed to research her team had already run. Investigating exploitation of a marimo flaw , they planted a prompt injection in a vulnerable container, telling any large language model that read the file to echo a hidden marker. "Every AI-driven operator we tracked did exactly that," she said. "AI can't help but follow instructions. That's a notable advantage for defenders against machine-driven attackers." A human attacker in the same research opened the file twice, recognized the bait and stepped over it. Morin said the right decoy in the right place cuts time to detect, but the decoy has to match the adversary, and a distraction is not containment.

CISA Urges Critical Infrastructure Providers to Make Plans to Remain Operational if hit by Cyber-Attack News 6 May 2026

CISA Urges Critical Infrastructure Providers to Make Plans to Remain Operational if hit by Cyber-Attack

CISA's 2024 Review Highlights Major Efforts in Cybersecurity Industry Collaboration News 27 December 2024

CISA's 2024 Review Highlights Major Efforts in Cybersecurity Industry Collaboration

CISA Urges Critical Infrastructure to Patch Urgent ICS Vulnerabilities News 12 January 2024

CISA Urges Critical Infrastructure to Patch Urgent ICS Vulnerabilities

NCSC Warns Against Chinese Cyber Attacks on Critical Infrastructure News 25 May 2023

NCSC Warns Against Chinese Cyber Attacks on Critical Infrastructure

US Urges Critical Infrastructure Firms to Get “Shields Ready” News 8 November 2023

US Urges Critical Infrastructure Firms to Get “Shields Ready”

What’s Hot on Infosecurity Magazine?

Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes

Microsoft Releases Emergency Patch to Fix RDS Vulnerability

Most Fraudulent Hires Receive Credentials Before Detection

Revolut Confirms Data Breach Through Fake Government Requests

Most Firms Unable to Recover Quickly from Ransomware

Cyber-Attacks Cost Organizations $52,000 on Average

Anthropic Reveals Yet Another Cybersecurity Incident

Major Cyber Vendors Turn to New UK Testing Program as MITRE Evaluations Face Changes

FBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Threat Actors

Defense Cyber Spending Set to Surge Amid Rising Attacks on Military Systems

CRA Reporting Rules Take Effect: How to Ensure Your Organization is Ready

A CISO's Lessons in Ransomware Response and Recovery After a Real-World LockBit Attack

Frontier AI: How Cyber Defenders Can Harness the Defender’s Window

Human Risk in Cybersecurity: Protecting Your Organization Beyond Technology

Same Front Door, New Visitors: Securing Humans and AI Agents at the Browser

Your Security Awareness Programme Isn't Failing, It's Just Not Relevant

Financial Services Cyber Resilience: Stress Testing Third Parties Before Attackers Do

How To Enhance Security Operations with AI-Powered Defenses

How Faster Cyber-Attacks Are Reshaping Enterprise Cybersecurity Strategies

Researchers Claim First Fully Agentic Ransomware: JadePuffer

AI is Already Powering Cyber-Attacks. Can it Power Cyber Defense?

Google Cloud's New CISO Chris Betz on Integrating AI in Cyber Defenses

How World Cup Password Trends Can Increase Active Directory Risk

New CISA Guide Helps Agencies Adopt SASE For Zero Trust