@chrissanders88@infosec.exchange
2026-09-18 14:15 UTC
I read CISA’s new report on using cyber decoys to strengthen detection and response, and it’s very philosophically aligned with the work I’ve done on Intrusion Detection Honeypots (IDHs).
I’ve been beating this drum for years: properly deployed internal honeypots are one of the best bargains in detection.
#DFIR #IDS #Honeypots
Replies (1)
-
@chrissanders88@infosec.exchange 2026-09-18 14:15
They’re low effort. They require very little tuning. And because legitimate users have no reason to interact with them, they can produce incredibly high-confidence alerts with very few false positives. The idea is simple: put something in your environment that nobody should touch, make it interesting to an attacker, and pay very close attention when somebody touches it. If you can control what an attacker sees and thinks, you can control what they do and find them.