West Midlands Cyber
The West MidlandsCyber Cluster
Join the Cluster

Cyber Deception

Deception technologies can expose attackers and improve detection, but they demand mature security operations. We examine where they can add value — and where expectations should be tempered.

Contents

Table of Contents

Cyber Deception at UK Scale: Where It Fits in a Mature Defence

Cyber deception occupies an unusual position in the security control landscape. Most defensive technologies attempt to prevent malicious activity, identify it through behavioural indicators or reduce the damage once compromise has occurred. Deception takes a different approach: defenders deliberately introduce systems, identities, credentials or other digital artefacts that legitimate users have no reason to access, creating opportunities for attackers to reveal themselves through interaction.

The underlying idea is not new. Honeypots have been used for decades to attract and observe hostile activity. What has changed is the breadth of the technique. Modern deception can extend across cloud environments, identity systems, endpoints, data and operational technology, while integrating alerts into established security operations. That expansion has increased its potential value, but also the expertise required to deploy it safely.

The National Cyber Security Centre has been testing that proposition through a national-scale cyber deception research programme. Its trials involved 121 UK organisations, 14 commercial providers and ten product trials spanning environments from cloud infrastructure to operational technology. The NCSC’s conclusion is deliberately qualified: deception can provide defensive value, but it is not a technology that organisations can simply install and expect to work without strategy, operational integration and appropriate safeguards.

The originating analysis, Cyber Deception at UK Scale: What the NCSC Trials Tell Us — and What They Still Don’t, examined that qualification closely. The evidence supports continued development of deception as part of layered defence, while providing much less support for presenting it as a general-purpose control suitable for organisations at every level of cyber maturity.

For the West Midlands, this distinction matters. The region contains organisations operating sophisticated enterprise, cloud and industrial environments in which deception may provide useful additional detection capability. It also contains a much larger population of businesses still developing basic risk management, monitoring and incident-response capability. Regional cyber strategy should therefore understand where deception adds genuine value without allowing an advanced technique to distract from more fundamental resilience priorities.

Key Takeaways

  • The NCSC’s trials involved 121 organisations, 14 commercial providers and ten product trials across environments including cloud and operational technology, providing an unusually broad real-world evidence base for cyber deception.
  • Deception can improve observability, support threat hunting and potentially influence attacker behaviour, but the NCSC explicitly cautions that effective deployment requires planning, strategy and operational support rather than simple product installation.
  • Modern deception extends the honeypot principle across identities, credentials, cloud services, data and other attack surfaces, making it potentially more useful but also more operationally demanding.
  • The principal unresolved issues concern measurement, terminology, safe deployment and the extent to which deception can be standardised without losing the contextual characteristics that determine whether it works.
  • For the West Midlands, deception is most relevant to organisations with established monitoring and response capability, including larger enterprises, critical or operational environments and mature managed-security arrangements; it should not be treated as a substitute for baseline cyber controls.

Modern Deception Extends the Honeypot Principle

The essential principle behind deception is straightforward. A defender creates something that appears valuable or legitimate to an attacker but serves no ordinary business purpose. Interaction with that artefact consequently produces a signal with a potentially high degree of confidence.

A traditional honeypot might expose a deliberately instrumented server or service. Modern implementations can distribute that logic much more widely. False credentials can be positioned where an attacker conducting reconnaissance might discover them; decoy identities can appear to possess privileged access; files or tokens can trigger alerts when opened or used; cloud resources can resemble genuine infrastructure; and controlled environments can be constructed to observe subsequent attacker behaviour.

The conceptual continuity with honeypots is important because it prevents cyber deception being treated as an entirely new category of security. Honeypots demonstrated that malicious interaction with a resource that legitimate users should never touch can produce unusually clear evidence of hostile intent.

Modern deception attempts to make that principle operational across contemporary technology estates.

The difference is significant because attackers no longer move exclusively through conventional networks and servers. Identity systems, cloud control planes, API credentials, software repositories and remote-management services can all become part of an intrusion path. Deception can therefore be positioned around the pathways an attacker is likely to explore rather than confined to a dedicated machine waiting to be discovered.

That broader reach also introduces greater responsibility. A poorly isolated honeypot creates risk; a poorly designed deception environment distributed through identities, credentials and production-adjacent systems can create considerably more complicated failure modes. The sophistication of the technique therefore increases the importance of deployment discipline.

The NCSC Is Testing Three Distinct Forms of Defensive Value

The NCSC’s programme is useful because it does not reduce the question of effectiveness to whether a deception product can generate an alert.

Its trials examined three propositions: whether deception can uncover compromises already hidden within networks, whether it can identify new attacks as they occur, and whether the presence of deception can influence attacker behaviour.

These correspond to different defensive outcomes.

The first is discovery. An attacker who has already gained access may encounter a decoy identity, credential or system during reconnaissance or lateral movement. That interaction can reveal activity that existing monitoring has failed to identify.

The second is detection. Because legitimate users should not normally interact with deception artefacts, an alert can carry greater confidence than signals generated from behaviours that have both benign and malicious explanations.

The third is adversary friction. An attacker uncertain about which assets, credentials or pathways are genuine must spend additional effort validating information. The NCSC sees potential for this uncertainty to increase attacker cost and contribute to wider national resilience.

The distinction is important because each benefit requires different evidence. Detection can be evaluated through alert quality and time to discovery. Intelligence value depends on whether interaction reveals useful information about attacker behaviour. Claims about imposing cost require evidence that deception actually changes adversary decisions rather than merely creating additional infrastructure for defenders to maintain.

The NCSC’s work strengthens the case that these outcomes are plausible while also demonstrating why more systematic measurement is required before their economic value can be compared consistently.

High-Confidence Signal Is Deception’s Strongest Operational Proposition

Modern security operations face an abundance problem. Endpoint tools, identity systems, networks, cloud platforms and applications can generate enormous quantities of telemetry. The operational challenge is often not obtaining another signal but determining which signals deserve investigation.

Deception can alter that calculation because the artefact generating the alert has been designed specifically not to attract legitimate interaction.

If an employee accesses a production database, the event may be routine or suspicious depending on context. If an identity attempts to use a credential created solely as a lure, the range of benign explanations can be considerably narrower.

This makes deception potentially valuable in environments where analysts already possess substantial telemetry but struggle to distinguish malicious activity quickly.

The NCSC’s trials found that participating organisations saw particular potential in detecting novel threats and enriching threat intelligence, and the agency is considering further Active Cyber Defence capability in response to that evidence.

The operational value nevertheless depends on what happens after the alert. An organisation needs sufficient monitoring and response capability to investigate the interaction, understand how the actor reached the deception artefact, determine whether production systems are affected and contain the intrusion where necessary.

Without that response chain, high-confidence detection merely produces high-confidence knowledge that something is wrong.

Deception Is a Capability Programme Rather Than a Product Deployment

This is the most important qualification in the NCSC’s findings. Cyber deception can work, but it is not plug-and-play.

That limitation is structural.

Effective deception needs to resemble the environment in which it operates sufficiently well that an attacker regards the artefacts as plausible. Those artefacts must remain safe, isolated where necessary and consistent with changes to real systems. Alerts need to reach people capable of interpreting them. Response procedures need to account for what interaction with a particular lure means.

An organisation also needs to decide what problem it is trying to solve.

A business concerned about privileged identity compromise might deploy deception differently from an organisation seeking visibility of lateral movement inside an operational network. A cloud-heavy technology company faces different opportunities from an industrial organisation whose priority is detecting unauthorised exploration of segmented production systems.

Buying a deception platform before defining those objectives reverses the appropriate sequence.

This is why the technology should be understood as part of a defensive programme rather than another security appliance. Placement, telemetry, maintenance, response and evaluation are integral to the control itself.

The implication for procurement is substantial. Buyers should assess not only product features but the operating model required to obtain value from them.

The Market Still Lacks a Consistent Language

The NCSC identified inconsistent terminology as another barrier to adoption. That may appear secondary to technical effectiveness, but it has important consequences for a developing security market.

If vendors use terms such as deception, decoy, lure, breadcrumb, honeytoken and engagement differently, buyers cannot compare offerings easily. Procurement requirements become difficult to specify, and claims about product capability can become broader than the technical function actually delivered.

A useful taxonomy needs to distinguish between at least several layers of capability.

There are the deceptive artefacts themselves: systems, identities, credentials, documents or other resources intended to attract unauthorised interaction. There is the instrumentation used to identify and record that interaction. There is the engagement model, determining whether the attacker is simply detected or allowed to interact further within a controlled environment. Finally, there are the operational safeguards governing isolation, access, data handling and response.

These distinctions matter because two products marketed as cyber deception may create very different levels of operational complexity and risk.

Greater standardisation would also make evidence easier to compare. A national research programme cannot establish useful outcome benchmarks if nominally similar deployments are measuring fundamentally different defensive activities.

The NCSC therefore has an important role not in selecting winning products, but in helping establish a vendor-neutral language through which organisations can specify what capability they actually require.

Measurement Is the Critical Unfinished Problem

Deception has an intuitive appeal. An attacker wastes time on false assets; defenders receive a clear alert; hostile behaviour becomes observable. Translating that intuition into an investment case is harder.

The original analysis identified measurement as one of the most important unresolved questions, and the NCSC itself noted the need to develop outcome-based metrics.

A useful measurement framework would need to separate several forms of value.

Detection performance could examine how quickly deception identifies activity that other controls miss and how frequently alerts represent genuinely malicious interaction. Investigation value could measure whether deception reduces analyst triage time or provides information that materially improves understanding of an intrusion.

Claims about attacker cost require different evidence. Time spent exploring decoy systems, use of false credentials, changes in lateral-movement behaviour or abandonment of particular pathways might indicate that deception is imposing friction, although interpreting adversary intention from observed behaviour requires caution.

Safety and maintainability also belong in the calculation. A technique that produces valuable alerts but requires extensive engineering effort, suffers configuration drift or introduces additional exposure may have a very different economic case from one producing similar detection benefits with low operational overhead.

Without comparable metrics, procurement risks being driven by compelling demonstrations and vendor claims rather than defensible evidence about outcomes.

Deception Depends on Knowing What Normal Looks Like

The maturity requirement follows directly from the operating model.

To place deception effectively, an organisation needs reasonable visibility of its own systems, identities and data. To distinguish a meaningful interaction from operational noise, it needs some understanding of legitimate behaviour. To investigate an alert, it needs monitoring and incident-response capability. To prevent a decoy becoming an unintended vulnerability, it needs competent configuration and maintenance.

These requirements place deception above the baseline controls that many organisations are still trying to establish.

The 2025/26 Cyber Security Breaches Survey illustrates the wider maturity environment. Only 30% of businesses conducted a cyber risk assessment during the previous year and 25% had a formal incident-response plan. Forty-five per cent had none of the incident-response measures examined by the survey.

Those figures do not establish which individual organisations could deploy deception successfully. They do demonstrate why presenting it as a general solution for the business population would be difficult to justify.

A company without reliable asset visibility, effective identity controls or a workable response process has more immediate security priorities. Adding deliberately deceptive assets to an environment that is already poorly understood can increase complexity without resolving the underlying weaknesses.

Deception should therefore amplify an established security capability rather than compensate for its absence.

The SME Question Requires More Precision Than a Smaller Product

The possibility of making cyber deception accessible to SMEs deserves careful treatment because technological simplification alone does not solve the maturity problem.

Narrow forms of deception can certainly become easier to deploy. Managed providers could operate lures on behalf of customers. Cloud-based services can reduce infrastructure requirements. Simple canary credentials or monitored artefacts can generate high-confidence alerts without the complexity associated with a large engagement environment.

That does not automatically make deception an appropriate baseline SME control.

The relevant comparison is opportunity cost. An organisation with limited cyber resources needs to decide whether its next unit of investment should fund stronger authentication, vulnerability management, backups, incident preparation, monitoring or an advanced detection technique.

Where fundamentals remain incomplete, deception is unlikely to be the priority.

The position changes for a smaller organisation whose risk profile is unusually high or whose security is substantially delivered through a capable managed provider. An SME participating in a sensitive defence supply chain, for example, may justify controls that would be disproportionate for another company of identical size.

Maturity and consequence are therefore better criteria than headcount alone.

For regional support programmes, this argues against presenting advanced security technologies as universal progression milestones. Businesses need help determining which controls address their actual risk and which require capabilities they do not yet possess.

Operational Technology Creates Both Opportunity and Constraint

The inclusion of operational technology within the NCSC trials is particularly relevant to the West Midlands.

Industrial environments can benefit from high-confidence detection because operational networks often contain systems where conventional endpoint security cannot be deployed easily and where unexplained activity deserves rapid investigation. A carefully designed decoy can provide an additional way of identifying reconnaissance or unauthorised lateral movement without interfering directly with production equipment.

The consequences of poor deployment are also higher.

Operational environments are shaped by safety, availability, legacy technology and long equipment lifecycles. Introducing additional systems or network interactions requires greater caution than deploying a lure inside a conventional office environment. Deception technology must not create new pathways into production, interfere with control systems or produce operational behaviour that has not been properly understood.

The NCSC’s inclusion of OT in its research is therefore significant because it tests the technique in precisely the type of environment where its high-confidence signal could be useful but its safety requirements become more demanding.

For West Midlands manufacturers, the relevant proposition is not that deception should become a standard industrial cyber control. It is that mature organisations with established segmentation, monitoring and incident-response capability may have a particularly strong case for evaluating whether deception can improve visibility around high-value operational environments.

That evaluation should begin with the threat and architecture, not the technology.

Deception Could Contribute to National Resilience by Increasing Attacker Cost

The most strategically ambitious argument for cyber deception concerns adversary economics.

Traditional defence seeks primarily to stop or detect attacks. Deception can also attempt to make attack activity less efficient. False credentials consume time; decoy infrastructure forces additional validation; uncertainty about which resources are genuine can make lateral movement more difficult. At sufficient scale, the theory is that such friction can increase the cost of attacking UK organisations.

The NCSC explicitly connects this possibility with wider national resilience, arguing that deception can waste adversary resources, disrupt operations and undermine confidence.

The logic is credible, but the scale claim requires discipline.

Demonstrating that an individual attacker spent time inside a decoy environment is different from demonstrating that deception materially changes the economics of attacking the UK. National effect depends on adoption, attacker adaptation, deployment quality and whether deceptive environments remain sufficiently difficult to fingerprint.

Attackers respond to defensive innovation. If deception becomes common, adversaries will invest in identifying it. The resulting interaction is dynamic rather than a permanent defensive advantage.

The national opportunity is therefore best understood as adding uncertainty to the attack environment rather than constructing an impenetrable layer of false infrastructure. Even limited uncertainty can have value if it increases the probability that hostile activity exposes itself.

Regional Capability Should Concentrate on Appropriate Adoption

For the West Midlands, cyber deception should not become another technology around which ecosystem activity is created simply because it is strategically interesting.

The stronger regional role is to improve the quality of adoption decisions.

Organisations need access to practitioners capable of assessing whether their security maturity and threat profile justify deception. Industrial operators may need specialist advice on safe implementation around OT. Security teams need ways to compare products using outcome-based criteria rather than marketing terminology. Universities and research organisations can contribute to evaluation and measurement, particularly where the evidence base remains immature.

The region’s cyber providers also have an opportunity, but credibility will depend on resisting the temptation to present deception as a universal answer. Providers able to explain where the technique should not be deployed may ultimately contribute more to market maturity than those attempting to expand the addressable market indiscriminately.

There is also scope for shared learning. Individual organisations may have too little experience to establish meaningful benchmarks for detection value, maintenance overhead or attacker interaction. Aggregated and appropriately anonymised evidence across regional deployments could contribute to the broader national evidence base.

That would align regional capability with the NCSC’s research agenda without creating a competing framework.

Cyber Deception Should Sit Above the Fundamentals

The NCSC’s trials provide good reason to take cyber deception seriously. A programme involving 121 organisations, 14 providers and ten product trials across environments including cloud and OT moves the discussion beyond laboratory demonstrations and vendor assertions. It provides evidence that deception can improve observability, support threat hunting and potentially impose friction on attackers, while simultaneously confirming that these benefits depend on strategy, context and operational maturity.

That qualification should determine how the capability is positioned.

For organisations still struggling with authentication, patching, asset management, backups and incident preparation, deception is unlikely to represent the next rational control. For mature organisations with established monitoring and response capability, particularly where valuable identities, cloud environments or operational systems justify additional visibility, it may offer a distinctive source of high-confidence detection.

The unresolved questions concern whether those benefits can be measured consistently, whether deployment can be governed safely at greater scale and whether the market can develop a common language that allows buyers to distinguish substantially different forms of deception.

These are precisely the questions that need to be answered before an advanced security technique becomes dependable infrastructure.

For the West Midlands, the opportunity is therefore not simply to encourage adoption. It is to develop the expertise required to identify where deception is proportionate, test whether it produces measurable value and integrate it safely into the layered defences of organisations whose maturity and operational consequences justify the investment.

Cyber deception is unlikely to replace conventional defensive controls, and its value does not depend on doing so. Its more credible role is narrower and potentially more useful: creating carefully designed points within complex environments where an attacker can make a mistake that defenders are unusually well placed to see.