Cyber Deception and Honeytokens: A Practical Guide
Cyber deception plants believable-but-fake assets — credentials, accounts, files, systems — that legitimate users have no reason to touch, so any interaction with them is a high-confidence signal of an intruder. The appeal is signal quality: a well-placed honeytoken produces almost no false positives, because nobody should ever use it. Common techniques include honeytokens (fake credentials, API keys or documents that alert when used), canary accounts (decoy user accounts that should never log in), and honeypots/decoy systems (fake services that attract and reveal attackers). Deception is especially effective against living-off-the-land and lateral-movement activity that blends in with normal traffic. This guide explains the techniques and a low-cost way to start.
Most detection is a fight against false positives: you infer that behaviour is malicious from signals that are also, sometimes, normal. Cyber deception sidesteps that fight entirely. You plant assets that no legitimate user should ever touch — so when one is touched, you know. That is why honeytokens and decoys are some of the highest-signal, lowest-noise detections a defender can deploy, and why guidance increasingly recommends them for catching intruders who otherwise blend in.
The techniques
- Honeytokens: fake credentials, API keys, database records, documents or URLs, instrumented to alert the instant they are accessed or used. The tripwire of choice — cheap, and unambiguous when triggered.
- Canary accounts: decoy user accounts (often named to look privileged) that should never authenticate. A login attempt is a near-certain sign of compromise or reconnaissance.
- Honeypots / decoy systems: fake services or hosts that attract attackers, waste their time, and reveal their tools and techniques while keeping them away from real assets.
Why it works so well against modern attacks
Living-off-the-land techniques — using legitimate tools and credentials — are hard to catch precisely because they look normal. Deception does not care what tools an attacker uses; it cares that they touched something they should not know exists. An intruder doing reconnaissance to find credentials and move laterally is very likely to stumble onto a well-placed honeytoken, and the moment they do, you have a high-confidence, early alert.
Starting on a budget
- Seed a few honeytokens. Plausible fake credentials, a decoy API key, a tempting document — wired to alert on use, placed where recon would find them.
- Add a canary account. An unused, privileged-looking account that should never log in.
- Route alerts to the SOC with runbooks. A honeytoken hit must trigger investigation, not sit unseen — the value is entirely in the response.
- Expand to decoy systems once the basics prove their signal quality.
See the CISA-aligned deployment detail (Sigma rules, scripts) in our CISA cyber decoys guide →, and practise detection triage in the SOC triage tool.
Frequently asked questions
What is cyber deception? Planting fake but believable assets so any interaction with them is a high-confidence sign of an intruder.
What is a honeytoken? A fake credential, key, record or document instrumented to alert the moment it is accessed or used.
Why is it high-fidelity? The asset is designed so no legitimate activity ever touches it, so an interaction is unambiguous — great against living-off-the-land and lateral movement.
How do we start cheaply? Seed a few honeytokens and a canary account wired to SOC alerts with runbooks; expand to decoys later.
Ready to practise the decisions these articles describe?
Run a free War Room →