The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued guidance that advises organizations to utilize cyber decoys to expose intruders who have gained a foothold within their networks. The document, released on September 16, 2026, suggests that decoys function as a supplementary measure to Zero Trust programs, enabling the identification of lateral movement conducted with legitimate credentials and administrative tools. CISA's "Using Cyber Decoys to Enhance Detection and Response" highlights a significant defensive gap: attackers are increasingly avoiding easily detectable malware and instead employing living-off-the-land (LOTL) techniques.
CISA Recommends Deploying Cyber Decoys Once inside, these intruders can enumerate systems, probe Active Directory, access file shares, and move between hosts using valid accounts, remote-management utilities, and normal network protocols.
If an operator or malware uses the account to query directory services or access a host, the resulting alert could reveal post-compromise discovery or credential misuse earlier than endpoint detections alone. Teams should identify the assets and adversary behaviors they wish to detect, ensure decoys are realistic but segmented, define alert triage and incident-response procedures, and validate that the decoys remain visible to attackers but inaccessible for pivoting. The agency maps the approach to the MITRE Engage and MITRE ATT&CK frameworks, allowing defenders to link decoy placement to anticipated adversary behaviors and assess detection coverage.
