CISA Releases First Detailed Guide on Using Cyber Decoys for Threat Detection

The US Cybersecurity and Infrastructure Security Agency (CISA) published its first comprehensive guide on defensive cyber decoys on September 16, 2026, targeting critical infrastructure operators. The guide focuses on detecting adversaries who use legitimate credentials and native tools, which traditional security measures often miss. CISA recommends placing decoys in high-value network areas — such as credential stores, privileged service accounts, and sensitive file shares — where legitimate activity would never normally occur. The guidance aligns decoy strategies with the MITRE Engage framework and ATT&CK matrix to help organizations identify specific coverage gaps in their threat detection. CISA cautions that decoys carry operational risks, including the possibility of being mistaken for production systems or inadvertently creating new attack paths if improperly configured.