CISA guidance on cyber decoys: tripwires, honeytokens and MITRE Engage planning

In two minutes

• CISA says organizations should add internal decoys alongside Zero Trust, on the expectation that attackers may eventually get some access (p. 5).
• The stated aims are to detect intruders, gather threat intelligence, direct defensive resources, and cut mean time to detection with high-fidelity alerts (p. 5).
• The guide is introductory and aimed at small and medium organizations and teams new to decoys. It covers decoys inside the network, not internet-exposed honeypots (p. 5).
• It uses MITRE Engage's three goals: Expose (detect), Affect (impose cost), and Elicit (observe safely). Organizations should build Expose first and consider Elicit last (pp. 7-8).
• Tripwires should be threat-informed, distinct from normal behavior, detectable and actionable (p. 12). Honeytokens such as fake files, accounts, credentials and URLs are the low-complexity, low-maturity option compared with honeypots (pp. 13-14).
• Two worked scenarios walk through the Engage 10-step process: a high-technology firm protecting intellectual property (pp. 9-12) and a water and wastewater organization mapping gaps in ATT&CK terms (pp. 16-21).
• The guide advises testing decoys with threat emulation, red teaming or purple teaming, and treating decoy operations as continuous and iterative (p. 21).
• The document gives no statistics or measured results. The scenarios are notional.

Key numbers

• 10 steps in 3 phases: Engage adversary engagement process: Prepare, Operate, Understand (p. 9).
• 3 goals: Engage goal categories: Expose, Affect, Elicit (p. 7).
• 4 qualities: Traits of an effective tripwire: threat-informed, distinct from normal behavior, detectable, actionable (p. 12).
• 4 approaches: Ways to source honeytokens: open-source, commercial, in-house, and living off the land (existing tools) (p. 15).

What to do with it

• Start with Expose: place tripwires where legitimate users should rarely or never go, such as decoy shares, fake admin credentials and decoy folders on executive desktops (pp. 7, 13).
• Map your vulnerabilities, defensive coverage and likely adversary techniques to ATT&CK, then use the overlap to find high-risk gaps and set decoy objectives (pp. 17-19).
• Use honeytokens for a low-complexity start. Consider using existing EDR, identity and DLP tools to deploy them before buying new tooling (p. 15).
• Write down decoy locations and expected alerts, keep that record outside production, and plan for known false positives such as IT testing (p. 11).
• Test the decoys with red team, purple team or threat emulation exercises. Then feed the results into detection logic, response playbooks and decoy placement (pp. 11-12, 21).
• Set success criteria up front, including whether a decoy alert is the first sign of an intrusion and whether MTTD falls against prior incidents (p. 11).

Read the full document if

• you want a plain, low-complexity starting plan for decoys and honeytokens in an internal network.
• you want worked examples of mapping gaps in ATT&CK and choosing Engage activities for specific techniques such as PowerShell misuse or valid accounts.
• you run security for a small or medium organization or a critical infrastructure operator, including water and wastewater.

What it relies on

The guide rests on the MITRE Engage framework and the MITRE ATT&CK knowledge base. It points readers to NIST SP 800-160 Vol. 2 Rev. 1 and SP 800-53 Rev. 5 as related resources (p. 6). It presents no original data, sample or measurement. Its two scenarios are notional (pp. 9, 16). CISA is a government agency and the document says it does not endorse any commercial product. It also says the guidance is voluntary and creates no requirements (p. 22).

Our read

A practical primer for teams that have not run decoys before. It is useful for its step-by-step scenarios and its advice to build detection first and observation later. It offers no evidence on how well decoys work, so any detection gains you expect will need your own testing.