CISA Wants Defenders to Plant Fake Credentials and Systems to Catch Hackers

CISA has urged organizations to deploy fake credentials, systems, files, and data assets inside their environments to expose attackers after an initial compromise. The agency published its new guidance, Using Cyber Decoys to Strengthen Detection and Response, on September 16, 2026.

CISA said many attackers now avoid malware-heavy intrusion methods and instead abuse legitimate user accounts, built-in administrative tools, and living-off-the-land techniques.

These methods can help threat actors blend into normal network activity. At the same time, they perform discovery, move laterally, escalate privileges, and access sensitive information.

CISA Urges Fake Credentials to Catch Hackers

Cyber decoys are intentionally planted assets that appear real but have no legitimate business use. They can include inactive administrator accounts, fake VPN credentials, decoy databases, bogus sensitive documents, false cloud storage locations, honeytokens, and simulated servers.

Treat any attempt to access or use these assets as a high-confidence security signal because legitimate employees and applications should not need them.

The guidance recommends that defenders use decoys as part of a proactive detection strategy, particularly inside high-value network segments.

For example, an organization could create a fake privileged account and place its credentials in a monitored location that looks attractive to an attacker. If someone attempts to authenticate with that account, the security operations center can receive an immediate alert and begin investigating.

CISA described cyber decoys as a useful complement to Zero Trust security models. Zero Trust assumes an attacker may eventually gain some access, rather than relying only on perimeter controls to stop every intrusion.

Decoys can help security teams continuously verify activity, identify suspicious behavior, and detect post-compromise movement inside the environment.

The agency said decoy technology can reduce mean time to detection by producing high-fidelity alerts. Unlike many endpoint or network alerts, activity involving a carefully deployed fake account or server is less likely to be caused by normal business operations.

This can reduce alert fatigue and help analysts focus on events that are more likely to represent genuine malicious activity.

CISA’s guidance introduces several deception concepts, including tripwires, breadcrumbs, and honeytokens. Tripwires are assets or conditions that generate an alert when touched.

Breadcrumbs are clues that guide attackers toward a decoy, such as a fake configuration file referencing a nonexistent server. Honeytokens are fake data items, such as credentials, API keys, or documents, that reveal unauthorized access when used.

The document uses the MITRE ATT&CK framework to help defenders map decoys to common adversary actions, including credential access, remote service use, network discovery, and lateral movement. It also references the MITRE Engage framework to support planning and refining deception operations.

CISA stressed that decoys should not replace core controls such as multifactor authentication, endpoint monitoring, logging, segmentation, patching, and incident response planning. Instead, they give defenders another opportunity to identify an intruder before sensitive systems, operational technology, or critical data are harmed.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC