CISA issues new guidance to help critical infrastructure detect and disrupt cyber threats

The Cybersecurity and Infrastructure Security Agency has issued new guidance urging critical infrastructure owners and operators to deploy “decoy” systems and data inside their networks to spot intrusions sooner and blunt attackers’ movement once inside. The publication, Using Cyber Decoys to Strengthen Detection and Response, marks the agency’s first in-depth guidance focused on designing and running defensive cyber decoy operations.

CISA frames decoys as a complement to Zero Trust architectures and an acknowledgement that determined intruders may eventually obtain some level of access—often by abusing legitimate credentials and so-called living-off-the-land techniques. By planting realistic lures in high-value parts of an environment, the agency says organizations can accelerate early-stage detection, capture useful intelligence about adversary behavior, focus defensive resources where they matter most, and cut mean time to detection with higher-fidelity alerts.

“Cyber decoys used in a proactive cyber defense strategy help make critical infrastructure networks unfriendly places for adversaries and enhance resilience to compromise, even against living-off-the-land techniques,” said CISA Acting Executive Assistant Director for Cybersecurity Chris Butera. “With this guide, CISA is raising awareness of cyber decoy techniques and enabling any defensive team regardless of skill level to understand the value and steps to implementing decoy operations. CISA encourages critical infrastructure organizations to review this guide and implement a cyber decoy strategy.”

The guide is intended for defenders with a basic grasp of the MITRE ATT&CK Matrix and common enterprise security tools. It outlines a practical, step-by-step approach that maps decoy design and deployment to the MITRE ATT&CK knowledge base and the MITRE Engage framework.

Deception techniques—ranging from full-fledged honeypots to lightweight “honeytokens” embedded in directories, cloud storage, or identity systems—are increasingly used to generate high-signal alerts when touched and to reveal an intruder’s tactics, techniques, and procedures. CISA’s guidance seeks to make those approaches more accessible to operators of critical services that remain prime targets for credential-theft and lateral movement campaigns.

Using Cyber Decoys to Strengthen Detection and Response is available on CISA’s website.