At a time when critical national infrastructure (CNI) is under threat from nation states including Iran, China, and Russia, the US Cybersecurity and Infrastructure Security Agency (CISA) is advocating the use of cyber decoys.

Its guidance on cyber decoys, published in September, assumes intruders will eventually gain some level of access.

As part of its advice, CISA says organisations should plant fake files, accounts and credentials inside their networks to catch attackers in the act.

The advice comes after a coordinated wave of cyber-attacks on US water companies in July and August blamed on Iran. In July, a small UK power plant was taken offline for four days due to a similar attack.

The grid was unaffected, but the incident highlights a growing risk as UK generation shifts toward smaller, distributed sites, according to Stefan Liversidge, solutions engineer at OPSWAT.

 He says CNI faces “sustained, systematic attacks” from state-sponsored adversaries. “Their focus has shifted from immediate disruption to gaining and holding access, positioning them to launch widespread disruptive or destructive campaigns aligned with geopolitical aims,” he says.

Amid this real and present threat, how can cyber decoys help?

Cyber Decoy Theory

Rather than working as presentative measure, the theory behind cyber decoys is to assume that a breach will happen. Andy Smith co-founder and CEO at Tracebit describes how using cyber decoys makes it as difficult as possible for adversaries who have already breached defences by “detecting, deterring and delaying attacks.”

The first part, detecting adversaries, would see firms using a decoy as ‘tripwire’: “You plant material that’s tempting to an attacker, which can be a human or AI agent,” says Smith.

This could be fake buckets, secrets, credentials and identities. “Trigger that and you know an attacker is in and remediating action can begin,” he says.

The deterring element of cyber decoys has a psychological effect on attackers. “A human attacker who knows canaries may be present has another question to resolve before using a credential or opening a promising resource: They have to ask, 'will this help me or give me away?’,” explains Smith.

The uncertainty can affect decisions across the environment. Checking takes time, and proceeding without doing so risks an alert, Smith says. “And this psychological effect extends to the AI models, which are essentially trained on human behaviours.”

Finally, delaying allows businesses to “tie attackers up in knots,” Smith tells SC Media UK. “They go chasing dead ends, burning their time and frustrating them, making their attacks more ‘noisy’ and likely to trigger endpoint detection and response systems and other defences. If they’re using an agent, they’ll see tokens rapidly dissipate, making their attacks more expensive. Ultimately with this combination, you want attackers to make a decision about whether it’s really worth it and move on to another target."

Zero Trust

CISA framed decoys as an addition to the preventative nature of the ‘zero trust’ model – which instructs businesses to trust no one and always verify – rather than a replacement.

Zero trust assumes attackers will gain access and therefore focuses on blocking intrusion at each point of authorisation, says Alistair Macrae OT security principal e2e-assure. He says decoys complement this by “creating non-existent or illegitimate assets that no authorised user, application, or business process has a reason to touch, meaning that an alert from these decoys means an attacker is likely already in the system.”

While zero trust reduces the attack surface, decoys improve detection and response within that, according to Daniel dos Santos, VP of research at Forescout. He says this combination is valuable in the operational technology (OT) environments of critical infrastructure where some zero trust controls are harder to apply.

“There, decoys can provide additional monitoring points without disrupting operations,” says dos Santos. “If an attacker scans an OT network, interacting with a decoy can provide an early warning before operational assets are affected.”

Liversidge says zero trust and decoys are most useful together, when the two defences close the “living off the land” gap, where attackers use stolen but legitimate credentials and native functions and commands to cause disruption. “Zero trust won’t flag this, as the attack appears as normal behaviour. Decoys will: A honeytoken credential or decoy file has no legitimate use, so any interaction is a clear signal, however valid the attacker's access looks.”

UK CISO Action

Cyber decoys are certainly useful, but overall, experts emphasise that they should complement, rather than replace, other core controls. These include patching edge devices, segmenting IT from OT, behavioural monitoring, and “immutable offline backups”, according to Macrae.

Dos Santos concurs: “Decoys do not reduce risk by preventing attacks and they are not valuable if there's no Security Operations Centre to analyse their alerts, for instance. But they can be very useful as part of a mature cybersecurity programme.”

 He advises CISOs to deploy cyber decoys strategically. “High-value use cases include decoy credentials, engineering workstations, remote access systems, and industrial control assets. The objective is to create opportunities to detect reconnaissance and lateral movement at critical stages of the attack lifecycle.”

Smith advises starting with the UK National Cyber Security Centre’s (NCSC) advice. He believes the UK watchdog is ahead of CISA in its guidance, pointing out that the NCSC has conduced a trial of 121 organisations in the UK. “Essentially their conclusion was that cyber deception can work provided they have the right data and context.”

As a starting point, UK CNI operators should adopt a zero trust posture, assuming attackers will eventually breach the perimeter, and use cyber decoys within it, advises Macrae. Because no legitimate user or process should ever touch a decoy, any interaction is inherently suspicious, he says. “This is particularly useful in OT environments, where active scanning risks disrupting physical processes.”

In practice, this means planting fake SCADA files and engineering documents on staging servers, and setting up fake gateways and login portals near the IT-OT boundary, Macrae explains. “If an attacker touches any of them, the alert can trigger automatic containment, such as cutting the link between IT and OT, before they reach real equipment.”

Kate O'Flaherty Cybersecurity and privacy journalist