CISA published 'Using Cyber Decoys to Strengthen Detection and Response' (TLP:CLEAR), dated 16 September 2026, for critical infrastructure organisations.

CISA says organisations should incorporate cyber decoy capabilities alongside existing Zero Trust models: decoys operate on the expectation that malicious actors may eventually gain some level of access, and placing them within internal networks and systems lets defenders detect, observe and impede malicious activity early in an intrusion. CISA lists key actions as deploying high-fidelity decoy tripwires in high-value areas, using MITRE ATT&CK and MITRE Engage to plan decoy coverage, and continuously testing and refining decoy operations through threat emulation.

The guidance covers decoys deployed inside an organisation's environment, including honeypots and honeytokens, rather than traditional internet-exposed honeypots. No CVE. (source: CISA)

Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; the card is now dated 16 September 2026, the publication date shown in CISA's document, instead of 17 September.