CISA is telling critical-infrastructure defenders to plant decoys where attackers may already be: inside the network.

On September 16, 2026, the agency released new guidance on using cyber decoys to strengthen detection and response, its first detailed guide to the defensive decoy process. The document frames decoys as a complement to existing Zero Trust models, built on the premise that adversaries may eventually gain some level of access.

The target is a specific detection gap. CISA points to attackers who use legitimate credentials, native tooling, and living-off-the-land techniques to move laterally and reach data without tripping conventional defenses. Decoys placed in high-value internal zones are meant to catch that activity early, generate high-fidelity alerts, and cut mean time to detection.

For security leaders, the practical point is cost. CISA describes decoy techniques as incremental, scalable, and deployable without major architectural changes, using tools most teams already own: Endpoint Detection and Response (EDR), identity and access management, and DLP. The guidance is voluntary, but it gives Zero Trust programs a cheap answer to a hard question: how do you spot an intruder who logs in with valid credentials?

The guide covers honeytokens, honeypots, breadcrumbs, and tripwires, and organizes tactics around MITRE Engage’s three goals: expose, affect, and elicit. It uses MITRE ATT&CK to help teams find detection gaps and place decoys where coverage is thinnest. Starting points include fake admin credentials no one should ever use and decoy files on monitored shares. A three-phase process (prepare, execute, understand) turns triggered decoys into refined detection logic.