CISA Endorses Cyber Decoys to Detect Hackers

The US Cybersecurity and Infrastructure Security Agency has published new guidance endorsing the use of cyber decoys to enhance detection and response to cyber threats. The guidance, released on September 17, 2026, aims to help organizations of varying cybersecurity maturity implement deceptive tactics to counter adversaries using legitimate credentials and living-off-the-land techniques. Cyber decoys are fake systems, accounts, or data designed to appear legitimate, distracting attackers, detecting their presence, and facilitating the collection of threat intelligence. According to CISA, these decoys complement Zero Trust models by supporting continuous monitoring and verification, creating high-fidelity alerts for suspicious activity, and reducing alert fatigue for security teams. The agency emphasizes that decoys are incremental, cost-effective, and scalable, allowing deployment without major architectural changes. The guidance provides concrete examples, such as planting fake admin-only credentials, creating decoy folders on executive desktops, and deploying honeytokens like bogus files on monitored shares.