Earlier quoted context omitted.
Each decoy is configured to look exactly the way that makes sense for the network it's in. An example is a git server with interesting code or an employees pc that shares files that are crafted to draw attackers to that decoy. The decoys themselves can be placed within the customers network or hosted in the cloud by us. The real trick is "breadcrumbs" which is specific data/files that you can place on the real machin…
> "breadcrumbs" which is specific data/files that you can place on the real machines If the breadcrumbs are realistic then you will end up having employees mistake them for real data, and the employees being mistaken for an attack, no? If the decoys are realistic then they will have realistic behaviour, for instance, doing an auto update. Now, let's say I'm a malicious actor on the network, and I fake the auto-update…
For example in windows there is a cache of used credentials along with passwords, it is a known infection spreading technique to read that of an infected machine and use t across the network.
A breadcrumb would put a decoy's credentials in that cache. Thereby never doing any side effect to the user and definitively flag attackers by looking at any usage of those credentials.