CISA Just Told Every Organization to Booby-Trap Its Own Network

On September 16, CISA released a guidance document with a title that would have sounded absurd five years ago: "Using Cyber Decoys to Strengthen Detection and Response." The message to critical infrastructure operators and, frankly, every organization with something worth stealing: stop trying to keep attackers out and start planning for the moment they get in.

If you read Cyber Risk Is Business Risk, that advice sounds familiar. The Three Questions framework I use with boards starts with a deceptively simple prompt: How could we be attacked? The follow-up — How would we know? — is where most organizations fall apart. CISA's new guidance is the federal government admitting, in writing, that a lot of organizations still cannot answer it.

The Problem CISA Is Finally Naming

The guidance is blunt about why traditional defenses are failing. Modern attackers do not rely on malware that an antivirus engine can flag. They steal legitimate credentials, abuse built-in administrative tools, and use what the industry calls "living off the land" techniques — essentially, doing their damage with the same PowerShell commands and remote-access utilities your own IT staff uses every day.

When the attacker looks exactly like an employee, your expensive perimeter tools go silent. CISA's guidance frames this not as a theoretical risk but as a detection gap that most organizations already have and do not know about.

The Idea: Make the Attacker Touch Something Fake

CISA's solution is deception — planting fake credentials, bogus files, decoy servers, and phantom administrator accounts throughout your environment. The logic is elegant: no legitimate user should ever touch these assets. The moment someone does, you know you have an intruder.

The guidance introduces three concepts every executive should understand:

Tripwires are assets rigged to trigger an alert on contact. Think of a dormant administrator account that has never been used. If someone suddenly logs in with it, your security team knows something is very wrong.

Honeytokens are fake data items — a spreadsheet labeled "Project_Metrics.xlsx" on a monitored file share, a set of API keys in a configuration file, a password in a document titled "Emergency Admin Credentials." When an attacker exfiltrates or uses these items, they reveal themselves.

Breadcrumbs are clues that lead attackers toward your decoys — a saved connection shortcut, a reference in a config file, a mention of a server name in an internal wiki. They make your fake assets look like the real high-value targets an intruder would seek out.

CISA organizes these tactics around MITRE Engage's three goals: Expose the adversary, Affect their operations by imposing cost and disruption, and Elicit intelligence by observing their behavior in a controlled environment.

What Boards Need to Hear

Here is where this guidance becomes a boardroom conversation, not just a security operations memo.

First, the budget argument just changed. CISA explicitly states that organizations can deploy decoys using tools they already own — EDR platforms, identity and access management systems, and data loss prevention tools. The agency is not asking anyone to buy new technology. It is asking them to use what they have more creatively. For boards weary of "we need more budget" conversations, this is a rare opportunity to improve detection capability without increasing spend.

Second, this is an "assume breach" strategy — and regulators are watching. The SEC's cybersecurity disclosure rules already require companies to describe their processes for assessing, identifying, and managing material cybersecurity risks. A board that can say "we have detection capabilities that identify intruders even when they use stolen credentials" is in a fundamentally stronger position than one that relies solely on perimeter defenses. When the inevitable breach happens, "we had tripwires but the attacker evaded them" is a defensible statement. "We had no way to detect credential-based intrusions" is not.

Third, this guidance exposes a question most boards have never asked. In Cyber Risk Is Business Risk, I argue that the most dangerous cybersecurity gaps are the ones nobody talks about in the boardroom. Here is a question to bring to your next committee meeting: If an attacker stole an employee's credentials today and logged in through the front door, how long would it take us to notice? If the answer is "we don't know" or "probably months," CISA just handed your CISO a roadmap.

Where to Start: The Low-Cost, High-Signal Approach

CISA's guidance is practical about starting small. For organizations just beginning to explore deception, the agency recommends:

• Plant inactive administrator accounts in Active Directory — accounts that look valuable but that no legitimate user would ever touch. Any login attempt becomes an immediate alert.
• Deploy decoy file shares with names that suggest sensitive content. Monitor them for access.
• Insert fake credentials — API keys, passwords, service account tokens — in monitored locations. When they are used, you have confirmed unauthorized access.
• Alert on anomalous tool usage — PowerShell execution on workstations where ordinary users have no business running scripts, for example.

None of these require purchasing new tools. All of them generate high-confidence alerts. That signal-to-noise ratio is exactly what overburdened security teams need.

The Timing Is Not Coincidental

This guidance arrives in a week when Microsoft patched a record 974 CVEs in a single Patch Tuesday — more than 50% higher than July's previous record of roughly 620. The FBI seized domains running NightmareStresser, a DDoS-for-hire service responsible for hundreds of thousands of attacks. Cisco disclosed a maximum-severity vulnerability in its Identity Services Engine that attackers were already exploiting.

The attack surface is growing faster than any organization's ability to patch, monitor, and defend it. CISA's guidance is an acknowledgment that prevention alone is not enough, and it never was. The organizations that survive the next major breach will be the ones that assumed the attacker was already inside — and set traps accordingly.

What to Ask Your CISO This Week

If this guidance prompts one action, make it a conversation. Ask your CISO or security leader these questions:

1. Do we have any form of deception or decoy technology deployed today? If not, why not — and what would it take to start?
2. How would we detect an attacker using stolen legitimate credentials? If the answer is "our SIEM would catch it," push harder. SIEMs miss living-off-the-land techniques every day.
3. Have we mapped our detection gaps against the MITRE ATT&CK framework? CISA's guidance recommends this as the first step. It tells you where your blind spots are.
4. Could we deploy a basic set of tripwires — fake admin accounts, decoy file shares, monitored honeytokens — within 90 days using tools we already own? If the answer is yes, the only thing standing in the way is prioritization.

The federal government does not issue guidance like this on a whim. When CISA tells every critical infrastructure operator in the country to start planting decoys, the threat picture has changed. The question for boards is not whether to act, but how quickly.