Most detections wrestle with false positives because normal activity looks a lot like attack activity. Deception sidesteps that: plant decoys that no legitimate user or process should ever touch, so any interaction is almost certainly malicious - near-zero false positives.
Types of deception
- Honeypots - fake systems/services that look real; connections to them are suspicious by definition.
- Honey tokens - fake credentials, API keys or documents seeded in plausible places; use them and you trip an alert.
- Honey accounts - a decoy admin/service account no one should authenticate as (great for catching Kerberoasting or credential theft).
- Canary files/shares - decoy documents whose access fires an alert (excellent early ransomware/exfil signal).
Why it's powerful
The signal-to-noise ratio is exceptional: there's no legitimate reason to touch a canary. That makes deception alerts high-priority and low-fatigue - the opposite of most rules.
Deploy it well
- Place decoys where an attacker doing recon would find them (a "passwords.xlsx" on a file share, a honey SPN in AD).
- Make them believable but isolated (a honeypot must not become a real foothold).
- Wire the alerts straight to high-severity - a canary hit means someone is already inside.