I read CISA’s new report on using cyber decoys to strengthen detection and response, and it’s very philosophically aligned with the work I’ve done on Intrusion Detection Honeypots (IDHs). I’ve been beating this drum for years: properly deployed internal honeypots are one of the best bargains in detection. They’re low effort. They require very little tuning. And because legitimate users have no reason to interact with them, they can produce incredibly high-confidence alerts with very few false positives. The idea is simple: put something in your environment that nobody should touch, make it interesting to an attacker, and pay very close attention when somebody touches it. If you can control what an attacker sees and thinks, you can control what they do and find them. CISA’s report makes it clear that these techniques are valuable, especially when attackers use legitimate credentials and tools that make malicious activity harder to distinguish from normal behavior. If you want to actually implement these ideas, I wrote the book Intrusion Detection Honeypots specifically around this philosophy. I also have a hands-on course that walks through designing and deploying IDHs in real environments.