Cyber decoys are systems, accounts, credentials, files, or data that appear valuable but have no legitimate use. Interaction creates a high-confidence signal that someone is exploring or abusing the environment. Honeytokens are lightweight decoys such as planted API keys, database records, links, or documents.
Why decoys are timely
Attackers increasingly use valid credentials and legitimate administration tools. Those actions can blend into normal operations. A credential that no legitimate process should ever use produces a much clearer signal than another generic anomaly score.
Examples
- a disabled-looking administrator account monitored for login attempts;
- a fake cloud key that alerts when validated;
- a decoy file named like a sensitive export;
- a nonproduction host placed in an attractive network segment;
- breadcrumb credentials pointing toward an instrumented service.
Safe deployment
Decoys must not contain real sensitive data, reusable production secrets, or uncontrolled attack capability. Document ownership, expected zero-use behavior, alert routing, legal and privacy considerations, and cleanup.
Make alerts actionable: include the decoy, source, identity, time, and immediate containment guidance. Test regularly and rotate designs when normal tools begin touching them.
Limitations
Decoys detect only interaction with the decoy. Skilled attackers may avoid them, and poorly designed lures can generate noise or reveal themselves. They complement endpoint, identity, network, and cloud monitoring rather than replacing it.
The bottom line
A good decoy turns unauthorized curiosity into a high-signal alert. Start small, keep it isolated from real privilege, connect it to a rehearsed response, and measure whether analysts act quickly.
