Why decoys have near-zero false positives
Real users never touch a fake server. The simple logic behind deception-based detection, and why it suits teams with no one watching a SIEM.
In short
- A decoy is a server, file or credential with no legitimate use, so any touch is worth attention.
- Rare false positives come from known sources, such as your own scans, and are quick to rule out.
- Decoys need no tuning or baseline, which suits small teams without a SIEM or security team.
Most security tools try to spot something bad among a huge amount of normal activity. A login from an unusual place, a spike in traffic, a process behaving oddly. Every one of those signals could be innocent, and someone has to decide. Decoys flip the problem around.
The simple logic
A decoy is a system, file or credential that has no legitimate use. A fake server nobody in your company needs. A spreadsheet called "Salary Register" that no real process ever opens. Because no one has a reason to touch it, any touch is worth your attention.
That is why decoy alerts are so reliable. The system isn't guessing whether activity looks unusual. It is reporting that something happened which should never happen at all.
Where the rare false positives come from
"Near-zero" isn't "zero", and it's worth being honest about why. The usual causes are:
- Your own IT team or scripts scanning the network and hitting the decoy
- An authorised security test or vulnerability scan
- Automated link previews or antivirus fetching content from a canary file
Each of these is known and explainable, which makes it quick to rule out. That is very different from an anomaly score that nobody can explain.
Why this suits teams without a SIEM
A SIEM (security information and event management system) gathers logs from everywhere and needs people to tune rules and chase alerts. For a large enterprise with a security operations centre, that makes sense. For a startup with one IT generalist, it mostly produces alerts that nobody reads.
Decoys need no baseline of normal behaviour and no tuning period. You place them, and they stay quiet until something is wrong. When the rules give you 6 hours to report an incident to CERT-In, a quiet system with confirmed alerts is more useful than a loud one you can't keep up with.
What decoys don't do
Decoys detect an intruder moving through your environment. They don't stop malware on a laptop or block a phishing email, so they work alongside antivirus and email security, not instead of them. Their job is to tell you, quickly and with confidence, that someone is inside.
Want to know what an attacker would find in your environment?
Get a free exposure check