Security · 18 Sep 2026 · Rob Nidschelm

Set a Trap for the Login That Should Never Happen

The login succeeds. The tool is legitimate. The connection looks ordinary. CISA cyber-decoys guidance addresses the difficult situation in which an intruder’s activity resembles authorised work, by placing assets that legitimate business activity should not need to use.

In guidance published on 16 September, CISA describes tripwires, breadcrumbs and honeytokens as part of planning, implementing and refining a decoy strategy. These measures complement Zero Trust and help expose post-compromise activity, including abuse of legitimate credentials and native tools. They are not a replacement for preventing compromise.

Make the suspicious action less ambiguous

CISA’s premise is that an apparently legitimate system, account or item of data can be designed to detect contact or collect useful threat information. The business value is not the theatrical appearance of a trap. It is the opportunity to create an observation with fewer legitimate explanations.

BlackTree recommends starting with a defined hypothesis. Which action would warrant investigation because no ordinary workflow should perform it? Who would receive the alert? What evidence would be available? If those questions have no answer, deploying another decoy is unlikely to fix the monitoring process around it.

For example, a team might use a controlled canary artefact in a location worth monitoring, with contact routed to a separately managed detector. Its design should avoid granting genuine privileged access or exposing customer information. This is a planning example, not a universal installation recipe.

Give the trap an owner before giving it a location

• Choose one useful scenario. Tie the pilot to a defined concern such as unauthorised discovery or access. Do not start by scattering credentials across the estate.
• Keep real authority out of the bait. Avoid production secrets, unnecessary permissions and genuine sensitive records. Assess whether interaction could create an unwanted route into other systems.
• Document authorised contact. Record security testing, scanners and maintenance that might touch the artefact. Give responders enough context to distinguish a test from an unexplained event.
• Connect it to a staffed response. Establish the alert destination, escalation owner and evidence to collect. A signal sent to an unmonitored mailbox is not a completed detection.
• Test the complete path. In an authorised exercise, verify contact detection, alert delivery and triage. Record the expected result and any gaps.
• Maintain or retire it deliberately. Review ownership after migrations and staff changes. Remove obsolete traps through the normal change process and preserve relevant records.

Agree monitoring scope, retention and privacy expectations with the appropriate teams before deployment. Deception should improve evidence quality without creating an undocumented collection system or an unmanaged new attack surface.

An alert is the beginning of the investigation

A decoy contact should prompt the response process agreed for that design. It does not, by itself, identify an attacker or establish the full extent of an intrusion. Correlate the observation with independently held identity, endpoint and network evidence. Preserve relevant records before changing the system under investigation.

Nor should the absence of contact become a clean bill of health. A trap covers the route it was designed to observe, not every possible path. Keep the ordinary identity controls, logging and incident-response capability around it.

The useful managerial test is therefore simple: if the account nobody should use is touched tonight, will somebody know what happened, what to do next and what the signal cannot prove?

Sources

• CISA, Using Cyber Decoys to Strengthen Detection and Response, published 16 September 2026. No publication clock or separate update time was provided on the reviewed primary page.
• SecurityWeek, independent reporting on the guidance, published 17 September 2026 at 03:53 ET, 09:53 Europe/Madrid. No separate update time was verified.