By the time ransomware encrypts anything, the operator has already been inside for a while: finding the file servers, stealing credentials, locating the backups, and turning off whatever might stop them. Deception catches that earlier work, because a decoy host and a planted credential have no legitimate purpose, so the first operator who touches one has identified themselves.
That is the whole argument for using deception as a ransomware control. You are not trying to detect encryption. Encryption is the receipt. You are trying to detect the quiet work that pays for it, while the operator is still looking around and has not committed to anything.
The detection window you are actually aiming at
Ransomware is not a single event. It is a chain, and most of the chain looks like administration. The operator is using valid credentials (T1078), native tooling, and the same remote protocols your own engineers use. Behavioral detection has to decide whether an admin running network discovery at 2 AM is an admin or an intruder. It is a probability question, and probability questions produce queues.
Decoys change the question. A decoy file server advertises SMB, answers a discovery scan, and is never mounted by any real user, because no real user has a reason to. A credential planted in a scheduled task is never typed by anyone, because nobody knows it is there. There is no baseline to compare against and no threshold to tune. Something touched it, or nothing did.
Where decoys sit in the chain
The ATT&CK technique IDs below are there so you can line this up against your existing coverage map and see which steps you currently detect twice and which not at all.
Initial access (T1566 phishing, T1190 exploited public-facing app, T1133 external remote services). Deception does not stop this and should not be sold as if it does. Your email security and patching own this step. Deception assumes it already failed.
Discovery (T1046 network service discovery, T1018 remote system discovery, T1135 network share discovery, T1087 account discovery). This is the first place a decoy can fire. Ransomware crews enumerate broadly because they need to know what is worth encrypting, and broad enumeration is exactly what a decoy is positioned to catch. A broad scan hits decoy hosts by definition: they are listening on the ranges being swept. An operator who enumerates shares finds a decoy share. One that queries the directory finds decoy accounts.
Credential access (T1003 OS credential dumping, T1552.001 credentials in files, T1558.003 Kerberoasting). Breadcrumbs live here. An inert credential in a config file, a stale entry in a credential manager, a service account that looks worth roasting. These are planted artifacts on real systems with no production function, so the credential only ever leaves the host if somebody is harvesting. Lokimesh breadcrumbs install nothing on the production system; they are files and entries, not agents.
Lateral movement (T1021.002 SMB admin shares, T1021.001 RDP, T1570 lateral tool transfer). The strongest signal in the sequence, because it is the one that confirms intent. A credential you planted and nobody uses, authenticating from a workstation to a decoy host, is not ambiguous. The operator has stolen something and is spending it.
Collection and exfiltration (T1039 data from network shares, T1567 exfiltration over a web service). Decoy shares holding realistic but fictitious documents will be browsed and copied. You get the dwell signal, and you get a read on what the operator considers valuable.
Impact (T1486 data encrypted for impact, T1490 inhibit system recovery, T1562.001 disable security tools). Last. If the only alert you got arrived here, deception did not help you, and neither did anything else.
Placement table
| Chain step | Deceptive asset | What the touch means |
|---|---|---|
| Discovery | Decoy hosts on unused IP space in each segment | Someone is sweeping internally |
| Discovery | Decoy file shares with plausible names | Enumeration beyond a normal user's scope |
| Credential access | Breadcrumb credentials in configs and credential stores | Harvesting on a real host |
| Credential access | Decoy directory accounts, never used, never logged in | Directory enumeration or roasting |
| Lateral movement | Decoy hosts accepting SMB and RDP | A stolen credential is being spent |
| Collection | Decoy documents in decoy shares | Staging for exfiltration |
| Impact | Decoy backup targets and file servers | Pre-encryption recovery sabotage |
The rows that earn their place in a ransomware program are the credential and lateral movement rows. Those two fire after initial access and before anything is encrypted, and that gap is where incident response still has options.
What the SOC receives
The point of the alert is that an analyst can triage it without a correlation search. It carries the deceptive asset that was touched, the source, the credential or artifact involved, and where that artifact was planted, which tells you the host the operator had already compromised:
severity : high
decoy : fs-arch-02 (decoy file server, 10.42.19.0/24)
event : SMB authentication accepted
source : 10.42.7.118 (WKS-FIN-114)
identity : svc_backup_legacy (breadcrumb credential)
planted at : SRV-APP-07, scheduled task XML, 41 days agoThat last line is the one that shortens the investigation. The credential was planted on SRV-APP-07 and arrived from WKS-FIN-114, so both are in scope and you did not have to go find that out. Alerts arrive enriched and deduplicated in the tooling the SOC already uses, including Splunk, Microsoft Sentinel, IBM QRadar, and Google Chronicle.
Next to EDR, NDR and SIEM
Deception adds a detection layer. It does not replace the ones you already run, and the boundaries matter more than the pitch.
EDR is better than deception at nearly everything that happens on a real endpoint: process lineage, in-memory behavior, the actual encryption event, and blocking. A decoy sees only what touches the decoy. What deception adds is the case EDR struggles with, where the operator is using legitimate credentials and native binaries and therefore does not look like malware.
NDR is better at volumetric and protocol-level analysis across traffic you cannot instrument with agents. Deception does not inspect production traffic at all. It does cover the segments where an NDR sensor is expensive or impossible to place, because a decoy is a host, not a tap.
SIEM is where this lands. Deception does not reduce the number of log sources you have; it adds a source with an unusually high signal-to-noise ratio, which is useful for the detections you escalate automatically. A decoy alert is one of the few things a mid-sized team can reasonably page on.
And the honest limits. Deception will not catch an operator who encrypts a single workstation and leaves, because they never enumerate anything. It depends on placement: decoys in segments the operator never visits detect nothing. Coverage is planned against MITRE ATT&CK for that reason, so placement follows the techniques you are actually exposed to rather than wherever provisioning was easy. An alert with no owner is decoration, which is a process problem and not a product one.
What deployment involves
Nothing is installed on production systems. Decoys run in isolated fabrics with IP-pool validation and conflict detection, so they cannot collide with real assets. Breadcrumbs are inert files and entries placed on real hosts, and they matter only if someone steals them.
The maturity requirement that honeypot-era tooling created does not apply. A honeypot was one trap, built and babysat by an engineer. Decoy Management provisions, blends, and retires decoys across IT, OT, IoT, and cloud from one control plane, which is what makes per-segment placement practical rather than theoretical.
Two operational notes worth planning for before you deploy. Keep the decoy map outside the production environment, because an operator who compromises the network should not also inherit your documentation. And write down the expected benign triggers, usually IT scanning and asset inventory, before the on-call analyst meets them at 3 AM.
For background on where decoys fit in a detection program generally, see a practical guide to modern cyber deception and our read of the CISA decoy guidance, which rates honeytokens as a low-complexity starting point for teams with no deception experience.
Start with the credential row
If you want to test this against your own environment, the fastest proof is the credential and lateral movement pair: plant breadcrumb credentials on a handful of real servers, stand up decoy hosts that accept them, and run your own discovery sweep. Either the alert fires with the planting host attached, or it does not.