What is a decoy in cybersecurity?

Direct Answer

A decoy is any asset, digital or otherwise, planted specifically to be found by an attacker and to betray them the moment they interact with it. It's the umbrella term: honeypots, canaries, and honeytokens are all specific types of decoys, distinguished mainly by how heavy they are to build and maintain rather than by what they're for. Every decoy shares the same underlying property — no legitimate reason exists for anyone to touch it, so an interaction is a high-confidence signal rather than something that needs corroborating evidence. Tracebit deploys decoys across cloud accounts, identity providers, and CI/CD pipelines, and the mechanism has held up under real testing: two separate red team engagements against the environment at Riot Games, the video game company behind League of Legends and Valorant, were both caught by Tracebit decoys, the more recent one within minutes of the engagement starting.

What actually counts as a decoy

The format doesn't matter much. A decoy can be a full fake server, a single cloud storage bucket, a credential sitting in a config file, a document nobody has a reason to open, or a user account that was never assigned to anyone. What makes it a decoy isn't its shape, it's that it was placed on purpose, specifically to have no legitimate use.

That last part is the whole mechanism. Compare a decoy to something that merely resembles a real asset by accident, like a staging environment that happens to look similar to production. Nobody watches a staging environment expecting any interaction with it to be malicious, because legitimate engineers use it constantly. A decoy is the opposite: built to be indistinguishable from something real, while having zero legitimate traffic by design.

How "decoy" relates to the other terms

Decoy sits above honeypot, canary, and honeytoken as the general category. A honeypot is a decoy that's a full system. A canary is a decoy that's a lightweight resource. A honeytoken is a decoy that's a piece of data. When a piece of writing, or a vendor, uses "decoy" without qualifying it further, it's usually gesturing at the whole family rather than any one specific member — which is part of why the word shows up so often in general descriptions of deception technology as a category.

What makes a decoy convincing

A decoy only works if an attacker doesn't immediately recognize it as fake. That mostly comes down to matching the environment it's sitting in: a decoy AWS key needs to look like it belongs to the account it's in, with a plausible naming pattern, region, and format. A decoy that's obviously generic, a leftover default name, an outdated credential format, a region nobody actually uses, is exactly what a careful attacker learns to skip past. This is also why static decoys lose effectiveness over time: an environment's naming conventions and account structures shift, and a decoy that doesn't shift with them starts to stand out for the wrong reason.

Conclusion

Decoy is the word that covers the whole idea: something fake, placed on purpose, with no legitimate use, waiting to be found. Honeypot, canary, and honeytoken are just more specific answers to the question of what shape that decoy takes and how much it costs to keep it running. Understanding the umbrella term first makes the more specific ones easier to place, since they're all variations on the same underlying bet: that an attacker, sooner or later, will reach for something that looks worth taking.

Talk to the Tracebit team to see how this applies to your environment.

FAQ

Is 'decoy' just another name for a honeypot?

No — a honeypot is one specific kind of decoy, historically the heaviest one. Decoy is the umbrella term that also covers canaries and honeytokens, which are far lighter to deploy and maintain.

What makes something count as a decoy rather than just a fake copy of something?

Purpose. A staging environment that happens to look like production isn't a decoy, it's a copy meant for real use. A decoy exists specifically to have no legitimate use at all, placed so that any interaction with it is a signal rather than an accident of normal work.

Do decoys need to be technically sophisticated to work?

No. A decoy's job is to look plausible enough that an attacker doesn't immediately dismiss it, not to survive deep technical scrutiny. A fake credential that matches an environment's real naming conventions catches far more than an elaborate decoy that never gets found in the first place because it's placed somewhere no attacker looks.

Can a decoy accidentally get used by a legitimate employee?

It can, and it's rare in a well-run deployment. Employees doing legitimate work already have access to what they need and have no reason to go looking for a resource that was never documented, announced, or referenced anywhere. When it does happen, the false positive is usually worth it, if only as a prompt to ask why someone was looking there.