CISA Issues First Cyber Decoy Guidance for Critical Infrastructure and Smaller Security Teams

CISA published its first detailed cyber decoy guidance, "Using Cyber Decoys to Strengthen Detection and Response" (2026-09-16), urging critical infrastructure organizations and small-to-medium security teams to deploy honeytokens, honeypots, breadcrumbs, and…

On 2026-09-16, CISA published "Using Cyber Decoys to Strengthen Detection and Response," its first detailed guidance on cyber decoys, aimed at defensive teams of varying maturity—particularly critical infrastructure organizations, smaller resource-constrained security teams, and small-to-medium organizations new to deception operations—that struggle to detect adversaries using legitimate credentials, built-in utilities, and living-off-the-land (LOTL) techniques. The guidance covers decoy types including honeytokens (fake credentials, records, or files with no legitimate business use), honeypots, breadcrumbs, and tripwires, which trigger alerts when attackers touch fake assets; per Infosecurity Magazine, the guidance focuses on internal honeytokens rather than internet-facing honeypots. CISA frames decoys as a complement to Zero Trust that produces high-fidelity alerts, reduces alert fatigue, and exposes post-compromise activity such as discovery, lateral movement, and data access. Tactics are organized around MITRE Engage's Expose, Affect, and Elicit goals, with MITRE ATT&CK mapping used for detection coverage gap analysis and low-complexity implementation steps, plus continuous refinement through threat emulation. To keep costs down, CISA recommends repurposing existing EDR, IAM, and DLP tools plus open-source token generators rather than new purchases, and the guidance includes a worked water and wastewater scenario. It contains no mandatory measures and cautions that decoys must be threat-informed, distinct from normal behavior, and tied to clear response procedures; that decoys must not let attackers pivot to real systems; and that decoy documentation should be kept outside production.

• Guidance titled "Using Cyber Decoys to Strengthen Detection and Response," published 2026-09-16; Infosecurity Magazine characterizes it as CISA's first detailed cyber decoy guidance
• Targets critical infrastructure organizations, smaller resource-constrained teams, small-to-medium organizations, and defenders new to deception operations
• Covers honeytokens, honeypots, breadcrumbs, and tripwires; honeytokens are fake credentials, records, or files with no legitimate business use
• Infosecurity Magazine reports the guidance focuses on internal honeytokens over internet-facing honeypots, while other reports list honeypots among the recommended decoy types
• Recommends repurposing existing EDR, IAM, and DLP tools plus open-source token generators instead of new purchases
• Maps tactics to MITRE Engage's Expose, Affect, and Elicit goals, with MITRE ATT&CK used for detection coverage gap analysis and low-complexity implementation
• Positions decoys as a complement to Zero Trust: high-fidelity alerts, reduced alert fatigue, and exposure of discovery, lateral movement, and data access
• Includes a worked water and wastewater scenario using MITRE ATT&CK mapping