CyberdeceptionAtlas · Question → testES

Library / Paper

Paper

Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK

The authors examine the assumption that decoys can be placed wherever attacker behavior occurs, applying a four-criterion rubric to all 250 MITRE ATT&CK v18.1 techniques. They find only 32% of techniques admit a plausible decoy and describe two placement patterns, Sweep and Seek, offering a simple rule for decoy deployment.

DecoyAdversary engagementNetworkEndpoint

What we know

The authors examine the assumption that decoys can be placed wherever attacker behavior occurs, applying a four-criterion rubric to all 250 MITRE ATT&CK v18.1 techniques. They find only 32% of techniques admit a plausible decoy and describe two placement patterns, Sweep and Seek, offering a simple rule for decoy deployment.

Evidence limits

This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the rubric or its findings have not been independently validated.

Reviewed: author abstract. Full-text results were not analyzed.

Sources and provenance

  1. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK
    abstract · 2026-10-04

Reviewed: 2026-10-04. This record may change when new evidence is found.

RIS · BibTeX