{"rewrite":{"id":"r_d74e179f729677f5f4a75799","clusterId":"c_11b4ad09b665ac5c7336856c","slug":"cisa-publishes-guide-on-using-decoys-to-catch-intruders","model":"deepseek-v4-1-flash","headline":"CISA Publishes Guide On Using Decoys To Catch Intruders","summary":"The US Cybersecurity and Infrastructure Security Agency published a guide on September 16 for using decoys to detect attackers who sign in with valid credentials. The guide covers honeypots, honeytokens, breadcrumbs, and tripwires, and recommends mapping MITRE ATT\u0026CK techniques to place decoys where coverage is weakest. Fortinet describes FortiDeceptor, which deploys more than 100 decoys and lures, as fitting that framework.","whyItMatters":"The guide treats deception as a process rather than a product purchase, which reframes the buying decision for critical infrastructure operators and the small security teams that support them.","webCardHtml":"\u003cp\u003eThe agency\u0026#39;s guidance arrives with a specific problem attached: attackers who log in with valid credentials and work through tools that already exist in the environment can look like legitimate users, and signature-based controls may not flag that activity at all.\u003c/p\u003e\u003cp\u003eDecoys reverse the logic. Because they serve no business purpose, legitimate users have little reason to touch them, so any interaction becomes a signal worth investigating. CISA breaks the toolkit into honeypots, honeytokens, breadcrumbs, and tripwires, and advises organizations to reuse tools they already own before buying anything new.\u003c/p\u003e","blueskyPost":"CISA's decoy guide hands defenders honeytokens and tripwires, but the frame is valid credentials, not malware. Fortinet pitches FortiDeceptor's 100-plus lures as the layer that catches sign-ins no perimeter rule flags.","twitterPost":"CISA's decoy guide treats valid-credential sign-ins as the threat model. FortiDeceptor's 100-plus lures target that gap.","threadsPost":"CISA's decoy guide assumes the intruder already has valid credentials, so honeypots and tripwires are placed where endpoint tools see nothing unusual. Fortinet pitches FortiDeceptor's 100-plus lures as the layer that catches sign-ins no perimeter rule flags.","newsletterBlurb":"CISA published guidance on September 16 for using decoys to catch attackers who sign in with valid credentials. The document breaks the toolkit into honeypots, honeytokens, breadcrumbs, and tripwires, and recommends placing decoys by mapping MITRE ATT\u0026CK techniques to coverage gaps. It also advises reusing endpoint detection, IAM, and DLP tools before buying more.","attributionJson":"[{\"source\":\"ASCII.jp\",\"url\":\"https://ascii.jp/elem/000/004/441/4441892/?rss\",\"title\":\"FortiDeceptor Practices 'Cyber Deception,' a Defense Premised on Attackers Breaching\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4645,"outputTokens":565,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1792025525,"createdAt":"2026-10-15T00:46:28.000Z","publishedAt":"2026-10-15T00:51:05.000Z","updatedAt":"2026-10-15T00:51:05.000Z"},"cluster":{"id":"c_11b4ad09b665ac5c7336856c","canonicalTitle":"攻撃者が侵入することを前提とした防御「サイバーデコイ」を実践する「FortiDeceptor」","representativeArticleId":"a_d49d6d35707de8fa311899e3","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"other\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-10-15T00:00:00.000Z","lastSeenAt":"2026-10-15T00:00:00.000Z","updatedAt":"2026-10-15T00:51:06.000Z"},"attribution":[{"source":"ASCII.jp","url":"https://ascii.jp/elem/000/004/441/4441892/?rss","title":"攻撃者が侵入することを前提とした防御「サイバーデコイ」を実践する「FortiDeceptor」"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"other","domain":"other","is_roundup":false},"keyFacts":null}