Pillar 01

Deception Techniques

89 techniques for placing something in your environment that no legitimate user has any reason to touch. Each is rated F1–F5 for how real it needs to be. The rail on the right explains the level of whatever you are reading.

The fidelity model in full

F1

Tripwire

15 techniques

An inert object — a credential, file, token, DNS record or registry key — placed where an attacker will find it during normal reconnaissance or collection. There is no service, no interactivity and no response logic. Detection happens the moment the artifact is accessed or used elsewhere.

SignalBinary. You learn that something touched it, when, and from where. You learn nothing about the attacker's intent, tooling or next move.
CostNegligible. Usually a single API call or file write; no compute, no ongoing spend.
OPSECSmallest surface of any level — there is no service to fingerprint. The only giveaway is placement and metadata: a credential file with a creation date of yesterday in a directory untouched for two years reads as bait.
Use whenYou want broad, cheap coverage across many assets, and a zero-false-positive signal matters more than understanding the adversary.
LimitsGives no dwell time and no behavioural intelligence. An attacker who ignores it is invisible to it.
F2

Facade

32 techniques

A resource that appears in enumeration and responds correctly to metadata and listing operations — it has a name, tags, policies, a plausible configuration — but has no functioning internals. An attacker can see it and query its shape; they cannot meaningfully interact with it.

SignalReconnaissance and discovery. You learn what the attacker is enumerating and in what order, which reveals their tooling and objectives.
CostLow. Control-plane objects only; typically free or a few dollars a month.
OPSECMust match the organisation's real naming, tagging and policy conventions or it stands out in a listing. The absence of any access history is the usual tell.
Use whenYou want to detect discovery activity and shape what an attacker believes the environment contains.
LimitsFalls apart under real interaction. An attacker who tries to use it learns immediately that it is not real.
F3

Shallow Interaction

26 techniques

A decoy that takes a connection, request or query and returns believable but pre-generated output. It emulates the surface of a real service without implementing it — enough to capture the attacker's first several moves before the illusion thins.

SignalInitial tradecraft: the commands issued, the payloads sent, the credentials tried, the paths requested.
CostModerate. Needs a running listener or function, plus content that holds up to a glance.
OPSECResponse timing and error handling are the weak points — canned responses that return instantly, or identical errors for different inputs, are detectable. Content must be internally consistent.
Use whenYou want attacker behaviour, not just presence, without operating a real system.
LimitsSustained interaction exposes it. Not suitable for holding a capable adversary for long.
F4

Interactive

14 techniques

Genuine software on genuine infrastructure, deliberately reachable and deliberately monitored. The attacker gets real responses because the system is real; what they do not get is any path to production. Full telemetry is captured from the host, network and application layers.

SignalComplete tradecraft: exploitation chains, post-exploitation actions, tooling, lateral-movement attempts, and zero-day payloads captured before they reach real assets.
CostSignificant. Real compute and storage, plus the engineering to isolate, instrument and maintain it.
OPSECStrong against fingerprinting if it is genuinely real — but the environment around it must look lived-in. A pristine host with no logs, no users and no history is suspicious regardless of how real the service is.
Use whenYou need to understand an adversary's capability, or you want signature-less detection of exploitation against your actual stack.
LimitsA real system that can be compromised is a real system that can be compromised. Containment is not optional, and a failure of containment is a genuine breach.
F5

Deep Engagement

2 techniques

A coherent, populated environment rather than a single decoy: several hosts, working identities, believable data, internal traffic and a history. It is built to hold a capable adversary for days or weeks while they believe they are progressing through a real estate.

SignalObjectives and campaign-level intent — what they are actually after, how they escalate, what they exfiltrate, and how they establish persistence over time.
CostHighest. An ongoing operation, not a deployment: it needs simulated activity, maintenance, content generation and dedicated analyst attention.
OPSECThe hardest to sustain. Everything must age correctly — logins, file timestamps, mailbox contents, network chatter. Staleness is what gives F5 away, not architecture.
Use whenYou are facing a targeted adversary and the intelligence value of dwell time justifies running a parallel environment.
LimitsExpensive, slow to build, and demands human operators. Overkill for opportunistic threats, and the legal and containment obligations are at their most serious here.