A cyber decoy is a fake or deceptive asset placed in an environment to attract suspicious activity. It may look like a server, account, file share, credential, or application, but it is built to be unused by real business operations. Because legitimate users should not touch it, any interaction is highly suspicious and can trigger an alert.
Cyber decoys matter because they create high-signal detections during reconnaissance, credential abuse, or lateral movement. Attackers may probe or log into them while mapping a network, revealing tools, intent, and paths of movement. Defenders use this telemetry to spot intrusions earlier, study attacker behavior, and support zero-trust monitoring. A decoy works best when it is believable, isolated, and closely watched.