Inside the Detection Gap: CISA's Guidance on Cyber Deception
Updated: 2 days ago
CISA's September 2026 guidance, “Using Cyber Decoys to Strengthen Detection and Response”, examines how Cyber Deception supports detection of post-compromise activity by placing decoys inside the environment where unauthorized interaction can be detected.
The guidance covers tripwires, breadcrumbs, honeytokens, MITRE ATT&CK and MITRE Engage, with a focus on detection, adversary engagement and threat intelligence.
The Detection Gap After Initial Compromise
After gaining access to an environment, an attacker can use legitimate credentials, native tools and living-off-the-land techniques to conduct discovery, move laterally and access data.
This creates a challenge for detection. Legitimate credentials and living-off-the-land techniques can make malicious activity harder to distinguish from normal operations. CISA identifies post-compromise activity, particularly activity involving native tools and legitimate credentials, as a detection challenge that decoy-based Expose operations address.
When an attacker interacts with a decoy credential, file or service, that interaction generates a high-fidelity signal because the asset should not be used in normal operations.
Where Traditional Detection Struggles
Three conditions make post-compromise detection particularly difficult:
Alert volume: High numbers of alerts and false positives compete for analyst attention.
Legitimate access: An attacker using valid credentials can look like a legitimate user.
Native tools: Living-off-the-land techniques can rely on tools already present in the environment.
CISA highlights decoy-based detection as a way to generate high-fidelity alerts around activity that has no legitimate use. Effective tripwires should be distinct from normal behaviour, connected to existing monitoring and tied to a defined investigation and response process.
Because legitimate users should not interact with these assets, the resulting alert provides clear context for investigation.
What Cyber Deception Adds
CISA defines cyber decoys as assets that appear to be legitimate systems, accounts or data but are designed to detect adversaries, influence their activity or support CTI collection.
Different Deception mechanisms serve different purposes:
Decoys generate alerts when an adversary interacts with a decoy.
Breadcrumbs direct an adversary toward other decoy assets or engagement opportunities.
Honeytokens are data elements or logical objects with little or no legitimate business purpose, such as credentials, files, accounts, records, or URLs.
These mechanisms place deceptive assets along paths an attacker is likely to explore, while keeping interaction with them outside normal user behaviour.
CISA gives examples including fake administrator credentials, decoy folders and fake network-scanning tools. Interaction with these assets can provide a high-fidelity detection signal.
Deception Is More Than Honeypots
Cyber Deception is often associated with honeypots. Honeypots are one form of Deception, but they are only part of the model.
CISA uses MITRE Engage to frame adversary engagement around three objectives: Expose, Affect and Elicit.
Expose: Detect the attacker
Expose focuses on detecting adversary activity.
Decoys are placed where legitimate users rarely or never interact with them. An interaction then becomes a clear signal for defenders. This can include decoy accounts, credentials, files, services and other assets.
Affect: Influence the attack
Affect focuses on changing what an attacker can achieve.
Decoy accounts, services and data can divert attacker effort, delay progress and create additional opportunities for detection. CISA describes Affect activities as a way to increase the cost and difficulty of an attack while reducing the value of adversary actions.
Elicit: Learn from the attacker.
Elicit focuses on observation and CTI collection.
A controlled environment can be designed to encourage realistic adversary behaviour and provide defenders with information about TTPs.
This requires stronger operational capabilities, including isolation, mature monitoring and logging, and the ability to manage operational and legal risks. CISA recommends establishing Expose capabilities before moving into Elicit activities.
Together, these three objectives show that Deception can support more than detection. It can also influence adversary activity and provide intelligence about how an attack develops.
Build Deception Around the Threat
Decoys should be selected to address a specific detection requirement.
CISA recommends starting with the environment, existing defenses, monitoring coverage, previous testing and relevant CTI. Teams can then map adversary behaviour to MITRE ATT&CK and identify gaps in existing detection coverage.
The logic is:
CTI + ATT&CK + Detection Gaps → Deception Strategy
If network service discovery is a known technique with limited detection coverage, decoy services can expose connection attempts.
CISA's planning example follows this approach. The team maps relevant ATT&CK techniques against existing detection capabilities and then uses MITRE Engage to determine which Deception activities to deploy, where they should appear and what adversary behaviour they are intended to expose.
The key principle is to make Deception threat-informed rather than deploying decoys in isolation.
From Alert to Intelligence
A decoy alert starts the investigation.
CISA recommends collecting information about the interaction and reconstructing the adversary's sequence of actions. The findings can then inform detection content, correlation logic and incident response workflows.
In practice, this creates a cycle such as:
Decoy interaction → Investigation → TTPs → CTI → Detection improvement
The interaction provides evidence about adversary behaviour that can feed detection and response decisions.
The same information can then be used to refine Deception placement, detection logic and response procedures. CISA recommends reviewing both successful and unsuccessful operations to identify gaps and improve future coverage.
Test the Detection, Not Just the Decoy
Deploying a decoy is not enough. Security teams need to verify that the decoy triggers as expected, that the alert reaches the right monitoring systems and that defenders can investigate and respond.
CISA recommends threat emulation, red teaming and purple teaming using relevant ATT&CK techniques to test both the Deception operation and the defensive response.
In practice, this means asking questions such as:
Does the interaction trigger the expected detection?
Does the alert reach the right team with enough context to investigate?
Does the response workflow start as expected?
Can the team reconstruct the adversary's activity?
The results should then feed into the next iteration, helping teams refine their decoy operations, detection logic and response procedures.
What CISA's Guidance Means for Advanced Deception
CISA's guidance shows how Cyber Deception can be used as part of detection and response: start with the threat, identify detection gaps, place decoys where attacker interaction can be detected, and use the resulting information to refine defensive capabilities.
This approach is closely aligned with how LABYRINTH applies Advanced Deception.
LABYRINTH applies Advanced Deception across IT, OT and cloud environments, connecting deceptive assets to the surrounding infrastructure, threat model and existing detection capabilities.
The result is a detection capability built around attacker behaviour: interactions with deceptive assets can generate high-confidence signals and provide context for investigation and response.
See Advanced Deception in Action. Explore how LABYRINTH uses Deception to turn attacker interaction into high-fidelity detection signals.
Resource:
