CISA Urges Critical Infrastructure to Use Cyber Decoys

The agency says low-cost fake accounts, files and systems can expose attackers who operate with stolen credentials or built-in tools.

Overview

CISA published a 22-page guide on Sept. 16–17 that formally recommends deploying decoy systems, accounts, files and honeytokens to detect and study intruders.
The guidance defines four decoy types and maps their goals to MITRE Engage so teams can place decoys to expose, disrupt, or safely observe adversaries.
CISA prescribes a three-phase model—prepare, execute, understand—to plan deployments, turn decoy interactions into high-fidelity alerts, and feed findings into response workflows.
The document gives low-cost starter steps for small teams, such as planting fake admin credentials, monitored decoy folders and alerting on unexpected PowerShell use, while warning about legal and operational risks for intrusive monitoring.
CISA frames decoys as a complement to Zero Trust and assume-compromise defenses that help resource-constrained water, energy and other infrastructure operators find attackers who evade traditional telemetry.