TL;DR: On September 16, 2026 CISA published Using Cyber Decoys to Strengthen Detection and Response, an introductory how-to whose stated audience includes small to medium-sized organizations and defenders new to decoys. The idea: plant a credential or a file that nothing legitimate has a reason to touch, wire it to an alert, and you can catch somebody already signed in with a working password, if they touch the bait. Three of these cost nothing in licensing. Before you plant any of them, though, write down what already touches the share you plan to bait, because your own vendors and staff will set it off first, which in our experience is what kills these projects.
What are the first three decoys to plant?
Three, from what you already own. Each needs administrative access, so the first question is who has it in your building.
- A decoy service account that is actually discoverable. A name matching your real service accounts and a long random password, with an alert on every authentication attempt. The common trap: an account with no group membership and no permissions will not show up when somebody enumerates administrators, so the bait nobody can find never fires. Make it visible without making it useful. Register a service principal name on it, which is what puts an account in front of the SPN enumeration attackers run before Kerberoasting, and alert on the Kerberos ticket request. Nest it in a group whose name reads privileged but grants no rights. Neither step grants a usable permission.
- A decoy file on the share people would grab first. In a fab shop, the quotes folder or the CAD directory. One document with a plausible name, read auditing on that single file.
- A fake credential where an intruder will read it. A connection string in a scripts folder, a password in a note on the workstation used for wire transfers. If it is ever used, the attempt tells you both that you are compromised and which machine they reached first.
Many readers cannot create an account or turn on file auditing. Here is the paragraph to forward to whoever holds your domain administrator password:
Please create a decoy service account following our existing naming convention, with a long random password and no usable permissions, but make it discoverable: register a service principal name on it and nest it in a group that reads privileged and grants nothing. Alert on any authentication attempt and on the Kerberos ticket request for that SPN. Please also enable read auditing on one bait document I will place on the finance share. Confirm in writing where those alerts go and who acts on them outside business hours.
Where not to start: the plant floor. A decoy PLC is a real technique and the wrong first project, because OT traffic is odd by default and your sense of normal is weaker there. Office side first.
Your own people will trip it first
In our experience this is what kills these projects, and why preparation matters more than planting.
In a 60 to 250 person manufacturer the legitimate-but-strange access is everywhere. The pattern we meet repeatedly in plants this size, as illustration and not as anybody's file: a machine vendor whose backup script walks the file server on Sunday nights; a departed ERP consultant's account that still signs in at month-end close; a supervisor keeping the pricing folder on a USB stick because the VPN is slow. Bait a share those three touch and the alerts stop being read, which is worse than never building them.
CISA reaches the same requirement from the other side. Its criteria for effective tripwires: threat-informed, distinct from normal behavior, detectable by existing monitoring, and actionable, meaning tied to clear investigation and response procedures. "Distinct from normal behavior" is only knowable if somebody wrote down what normal is. It also tells teams to identify expected false positives, IT testing among them, and tune thresholds to reduce benign triggers.
So the inventory comes first, and it is not an afternoon of asking around. With legacy equipment and staff who have moved on, budget a week and expect to miss two things. Five questions:
- What has a backup agent on the file server?
- Which outside parties can reach the network remotely, and who authorized each?
- Which accounts belong to people who no longer work here?
- What runs on a schedule against the shares at night?
- Which machine vendor got a port forward or remote session during a commissioning trip?
If you cannot answer those, do not build the decoy. Build the list. We would rather bill for the inventory than for a detection you stop reading in three weeks.
Key takeaway: The inventory is worth more than the decoy, because it is also what you hand your insurer, your auditor and the incident responder you hope never to call.
What did CISA publish, and what does it actually say?
An operational how-to, worth reading for where it starts. CISA's framing: "cyber decoy strategies operate on the expectation that malicious actors may eventually gain some level of access," and it places decoys "alongside existing Zero Trust models" rather than in place of anything.
The document defines five terms, adapted from the MITRE Engage glossary, so both vocabulary and framework are MITRE's. It hangs the process on the Engage 10-step adversary engagement process across three phases, Prepare, Operate and Understand, and maps its examples to MITRE ATT&CK techniques including Phishing and Valid Accounts. Three of the five are what a small team will build:
| Term | What CISA says it is | What a hit tells you |
|---|---|---|
| Tripwire | Any decoy wired to monitoring so that any interaction with it, an access, an authentication attempt, a command execution, raises an alert | Somebody is moving through your environment now |
| Breadcrumb | A deliberately placed decoy artifact an intruder is encouraged to follow, leading to other decoys | Your bait is being followed, which tells you what they want |
| Honeytoken | Fake records, credentials or files with no legitimate business use, planted to detect unauthorized access or exfiltration | Specific planted material is in use, often with the source machine attached |
It endorses no products, and says so in its own disclaimer. It gives four ways to source honeytokens: open-source, commercial, homegrown, and living off tools you already own. Help Net Security's September 17 write-up picked up that last one, where CISA names EDR platforms, identity and access management systems and data loss prevention tooling. Open-source tooling it calls suitable for pilot projects and limited budgets.
Mapped against what a manufacturer already licenses, the options look like this. The first row is CISA's own list; the rest is our mapping, not theirs.
| What you already pay for | What it can also do |
|---|---|
| EDR, identity and access management, data loss prevention | CISA names these as sources for deploying and monitoring honeytokens |
| Microsoft Entra ID or on-prem Active Directory | Host the decoy account and log every authentication attempt |
| Windows file server auditing | Audit reads on one bait document with no new software |
| Open-source canary tooling | Cover what the above cannot, at no license cost |
Why bother, when you already have EDR and a firewall?
They answer a different question. EDR asks whether software on a machine looks malicious. An intruder signed in as your controller runs nothing malicious all day; what they do not know is which share is real.
Mandiant's M-Trends 2026 puts global median dwell time at 14 days, up from 11, and the median gap between a break-in and hand-off to a second threat group at 22 seconds, against more than eight hours in 2022. The mechanism Mandiant describes is pre-staging: initial access partners plant the second group's preferred malware or tunnels during the initial infection, so the follow-on operator is equipped the moment they touch the network. All of it comes from Mandiant's own incident investigations, not a census of small companies, and we know of no published dwell-time median for 70-person manufacturers. Our inference: treat 14 days as a figure from organizations that brought in an incident responder, not as yours.
On arrival, Mandiant puts exploits first at 32 percent, then voice phishing at 11 and prior compromise at 10, with email phishing down to 6. Two of those, voice phishing and prior compromise, describe somebody arriving with something that already works: a password handed over on the phone, or access another party established first. Exploits still lead, so this argues for adding detection, not for spending less on patching.
Want to know what an intruder would find interesting on your network? Preferred Data Corporation has worked out of High Point since 1987 with manufacturing, construction and industrial businesses, on-site within 200 miles and remotely for clients across the US and worldwide, average client relationship past 20 years. Call (336) 886-3282, or see cybersecurity, managed IT and network infrastructure.
It fires at 2:10 on a Wednesday morning. Then what?
Decide this before you plant anything, because a decoy alert is not automatically worth stopping a job.
Two tiers. An office laptop with nothing running on it gets isolated immediately by whoever is on call. A machine attached to a running cell is not touched without the owner's decision, because forty minutes into a job the cost of being wrong is scrap. Write both rules down with names against them, and who reaches the owner at 2am.
Then the routing, because an alert into an unwatched mailbox is a log entry. With no security staff you have two choices: a phone carried by a named person, or managed detection so somebody else carries it. What you do not get is a next-business-day option for a real hit. An authentication against the decoy account, or a read of the bait file, means somebody may be in your network now; single shift or not, leaving it until morning leaves them the night. The owner decides whether containment may interrupt plant equipment, never whether anyone looks.
Size does not buy this for you. By its own notice, a public health system far larger than the manufacturers this post is written for found suspicious activity on February 2, 2026 from an unauthorized actor whose access began around November 25, 2025.
What if you have no Active Directory and no Windows file server?
Plenty of 70-person shops have neither. The CAD lives on a Synology in the electrical room and on the programmer's workstation, the machines are in a workgroup, and there is no domain for a decoy account.
Two of the three still work. A bait file on the NAS can be watched if the device supports file access logging and can forward it, which many NAS devices can; check yours before relying on it. The fake credential needs no directory, because detection happens wherever it gets used. What you lose is the decoy account, and the substitute is a fake login on whatever does hold accounts: the ERP, the accounting package, the remote access tool.
And if the nesting software walks the CAD folder every time somebody loads a job, put the bait somewhere it does not walk. That constraint is why the inventory comes first.
What does this cost?
In licensing, close to nothing: three decoys built from an existing directory, file auditing and endpoint console need no purchase order.
We will not print a monthly figure for the part that costs money: after-hours response pricing turns on how many sites you run and what hours need covering, and a made-up number is worse than none. The money goes to alert routing, the on-call arrangement, and one named person accountable for reading the output. Ask any provider for those three as line items and quotes become comparable. A SIEM nobody can staff and three decoys nobody answers fail the same way.
Monday morning: open a blank page and start the list. Every automated job and outside party that touches your most sensitive share. Give it the week it needs. When it exists, call (336) 886-3282 or contact us and we will wire the first three decoys to it.
Frequently Asked Questions
Is a honeypot the same as a honeytoken?
No, and the difference is cost. A honeypot is a whole fake system an intruder interacts with, which takes real work to maintain convincingly. A honeytoken is one fake credential, file or record in your real environment. Under 250 people, start with tokens.
Could a decoy get us in legal trouble for entrapment?
Entrapment is a defense against inducement by law enforcement or a state agent, not a limit on a company logging access to its own data. The care you owe is to your staff: document the decoys so nobody is disciplined over one they could not have recognized, and create that record before the first alert. CISA advises keeping decoy location records outside the production environment, so store it off the network it describes.
Can our existing IT provider set this up?
Anyone who administers your directory, file server and endpoint console can build all three. What is usually missing is the alert routing and after-hours response, so ask for those two specifically, in writing.
How would we know a decoy had quietly stopped working?
You would not, so test it quarterly. Authenticate against the decoy account, open the bait file, confirm the alert reaches whoever should receive it.
Does this help with a cyber insurance renewal or CMMC?
Indirectly. Decoys are not a line item on the insurance questionnaires we see. CMMC is narrower than people assume: it binds Department of Defense contractors, not manufacturers generally, and the level a covered contractor needs, 1, 2 or 3, depends on the contract and the information involved. No CMMC level requires deception. NIST SP 800-172 does address it in requirement 3.13.3e, which calls for means to confuse and mislead adversaries and whose discussion names deception environments, but that requirement is not among the selected SP 800-172 requirements CMMC Level 3 adopts. What the questionnaires we see do ask about is monitoring, logging and incident response, and this project produces two artifacts that answer them: an inventory of what touches your data, and a written response procedure with names on it.
Related Resources
- SIEM and SOC options for a small business, for what happens after a decoy fires
- EDR versus MDR, the staffing question underneath all of this
- A health-system breach timeline, examined
- Network monitoring for NC businesses
- Preferred Data Corporation, 1208 Eastchester Drive, Suite 131, High Point, NC 27265, (336) 886-3282, serving Greensboro, Winston-Salem, Thomasville, Lexington, Charlotte, Raleigh and the Piedmont Triad