Does your organization actively monitor deception technology (e.g., honeypots, honeyfiles, decoy accounts) for any usage or interaction?

Deception technology creates fake assets that legitimate users should never interact with, making any activity on these decoys a strong indicator of malicious behavior. Monitoring these decoys provides early warning of potential intrusions, lateral movement attempts, or credential theft without generating false positives that plague traditional detection methods.

Evidence could include screenshots of deception technology dashboards showing monitoring configurations, alert logs from deception systems, documentation of response procedures when decoys are triggered, or reports showing historical monitoring of deception assets with timestamps and resolution actions.