Cyber deception: from question to measurable test

Editorial update: 1 October 2026

A cyber deception test starts with a defensive question: what unexpected interaction do we want to observe, and what would we do if it happened? Decoy systems, data and signals can expose actions such as reconnaissance or credential use. Results depend on placement, realism, maintenance and the team's ability to investigate alerts. The UK NCSC called for outcome measures and impartial guidance.

A route for the security team

1. Define the question. Identify unexpected behavior and where it could occur.
2. Explore options. Connect the hypothesis to a technique, an environment and documented resources.
3. Check the evidence. Distinguish what each source claims and what material was reviewed.
4. Plan a test. Set the expected signal, baseline, controls, response owner and decision criteria.
5. Measure and revise. Record useful alerts, missed events, operational load and changes needed to keep the lure credible.

Reading the options

Atlas distinguishes open software, products and services. OpenCanary and Cowrie are open tools with different purposes. Thinkst Canary and FortiDeceptor are commercial examples. Vendor pages describe capabilities; comparable outcomes require tests under defined conditions.

What Atlas contributes to the decision

Atlas helps readers explore techniques and environments, find related resources and inspect the source and reviewed material behind each record. Guides help specify a test and its measures. Research documents the collection's limits and open questions. Inclusion in Atlas is neither an endorsement nor evidence of effectiveness in a particular environment.