CISA Releases Guidance on Deploying Cyber Decoys

CISA issued guidance on deploying honeypots, honeytokens, and decoy systems to detect adversaries and gather threat intelligence in critical infrastructure.

CISA released guidance on deploying cyber decoys, including lures, tripwires, decoy artifacts, honeytokens, and honeypots, within critical infrastructure organizations to complement Zero Trust models. The guidance outlines a three-phase operational process of preparation, execution, and understanding, advising decoys be placed where users rarely interact and configured to produce high-fidelity alerts. It aims to help defenders detect adversaries who use legitimate credentials, native tools, and living-off-the-land techniques, while enabling cost-effective threat intelligence collection.