CyberdeceptionAtlas · Question → testES

Cyber deception for security teams

From decoys to measurable decisions.

Explore techniques and solutions for a detection problem, check the evidence behind each option and plan a pilot with defined signals and measures.

Explore by problem →Plan a test →

Every record shows its source and what was reviewed. Vendor claims and test results are identified separately.

01 / Decisions

From question to pilot

Atlas organizes a practical route. Enter at the step you need while keeping the source and limits of each piece of information in view.

01Define the questionStart with the behavior you want to detect and where it could happen.02Explore optionsFind techniques, software, products and services related to that hypothesis.03Check the evidenceSee which source was reviewed and what it supports before comparing options.04Plan the testSet expected signals, a baseline, controls and measures for the next decision.

02 / Example

A credential nobody should use

Here is the route when the question is how to detect unexpected credential use.

Defensive question

How would we know if someone found and used a decoy credential?

Understand honeytokens →
  1. 01
    Locate the technique

    Connect the lure to identity, access and the signal you expect to see.

    See identity and credentials →
  2. 02
    Examine options and sources

    Filter related resources; check what was reviewed in each record.

    Explore related resources →
  3. 03
    Define the test

    Record expected use, legitimate controls, the alert and who responds.

    Open the first deployment guide →

Atlas helps frame and document the test. The result in your environment still has to be measured.

03 / Orientation

Explore by technique and environment

A technique describes what the lure does; an environment describes where it is placed. Use both to narrow the question.

Techniques

Honeypots and honeynetsHoneytokens and decoy credentialsDecoy assets and objectsAdversary engagementMoving target defense

Environments

Networks and servicesIdentity and credentialsCloud and hybrid environmentsApplications and APIsOT, ICS and critical infrastructureEndpoints and workstationsIoT and connected devices
See all topics →

04 / Evidence

An option needs context

A record links a resource to its source and states what was reviewed. That shows what still needs checking.

Example · paper

Honeywords

An academic proposal on decoy passwords and signals of use. The record identifies the source and states the limits of its editorial synthesis.

Examine record and source ↗

01 Where the information comes from.

02 What material was reviewed.

03 What the source supports and what remains open.

Transparency

Visible sources. Visible limits.

This version contains 770 records, including 427 papers. 24 papers have a full-text synthesis; 100 records rely on repository metadata. The 50 critical-reading notes are counted separately. This is an evolving editorial map with visible coverage and limits.

Explore resourcesRead how we research