Sep 23, 2026 · 24 min · 12 segments
CISA just released its first guide on cyber decoys: fake accounts, fake files and fake servers built to catch attackers who are already inside. The headline says it all. Lie to them. In this episode…
Let's start with the story of what actually happened.
On Wednesday, September 16th, 2026, the CISA, which is the Cybersecurity and Infrastructure Security Agency, released a guide called Using Cyber Decoys to Strengthen Detection and Response.
To those who don't know, the CISA is the agency that helps protect the stuff society runs on, such as water, power, hospitals, pipelines, etc.
Just the important stuff, right? According to the CISA, it's the first guide they've put out that walks through the decoy process in detail, 22 whole pages of it.
So, what's a decoy? It's fake stuff.
Fake systems, fake accounts, fake files, fake data.
Things that look real and tempting to an attacker, but no real employee has any reason to touch.
Because the second somebody touches one, the alarm goes off.
Like a tripwire.
CyberScoop ran the story under a great headline.
Quote, lie to them, unquote.
So, that's basically the whole guide.
So...
Where did this come from? It came out of conversations inside the CISA between their threat hunters, the people who go looking for attackers inside networks, and their penetration testers, the people who get paid to break in.
They kept landing on the same idea.
Decoys are a cheap, effective way to mess with an attacker.
And to those in the know, it's kind of like a honeypot operation.
Chris Batura, who's leading cybersecurity at the CISA in an acting role, told CyberScoop that decoys are a low cost, but, and I love this phrase, high fidelity.
Let me translate this.
High fidelity means when an alarm goes off, it's almost always real.
No questionable A, it's probably nothing.
Somebody who shouldn't be there is there.
He also made a point that matters if you're not a giant company.
This is especially useful for sectors that don't have big teams or big budgets.
And he said, you can build your own honey tokens yourself.
Let's start with the story of what actually happened.
On Wednesday, September 16th, 2026, the CISA, which is the Cybersecurity and Infrastructure Security Agency, released a guide called Using Cyber Decoys to Strengthen Detection and Response.
To those who don't know, the CISA is the agency that helps protect the stuff society runs on, such as water, power, hospitals, pipelines, etc.
Just the important stuff, right? According to the CISA, it's the first guide they've put out that walks through the decoy process in detail, 22 whole pages of it.
So, what's a decoy? It's fake stuff.
Fake systems, fake accounts, fake files, fake data.
Things that look real and tempting to an attacker, but no real employee has any reason to touch.
Because the second somebody touches one, the alarm goes off.
Like a tripwire.
CyberScoop ran the story under a great headline.
Quote, lie to them, unquote.
So, that's basically the whole guide.
So...
Where did this come from? It came out of conversations inside the CISA between their threat hunters, the people who go looking for attackers inside networks, and their penetration testers, the people who get paid to break in.
They kept landing on the same idea.
Decoys are a cheap, effective way to mess with an attacker.
And to those in the know, it's kind of like a honeypot operation.
Chris Batura, who's leading cybersecurity at the CISA in an acting role, told CyberScoop that decoys are a low cost, but, and I love this phrase, high fidelity.
Let me translate this.
High fidelity means when an alarm goes off, it's almost always real.
No questionable A, it's probably nothing.
Somebody who shouldn't be there is there.
He also made a point that matters if you're not a giant company.
This is especially useful for sectors that don't have big teams or big budgets.
And he said, you can build your own honey tokens yourself.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
