Cyber Deception deserves a seat in the SOC
Published: Sept 7, 2026 | Théo Turletti & Stéphane Rabette | Reading Time: ~5 minutes
The Attack Surface Cannot Be Fully Closed
In mid-July 2026, several vulnerabilities affecting SharePoint servers were disclosed. Before the federal administration had finished patching its systems, as yet unknown attackers exploited the flaw on the servers of the Federal Office for Information Technology and Telecommunications (OFIT). Specialists detected abnormal activity on 28 July; three days of analysis confirmed, on 31 July, that the credentials for around 200 accounts – both user and technical – had been compromised. The incident was not made public until 4 August, and the preventative reinstallation of the servers continued until the end of August.
Between the release of a patch and its full deployment, there is always a window of exposure during which vulnerable systems can be exploited: this patching process is increasingly outpaced by the speed of attackers. By comparing the vulnerable version of a product with its patched version, it is now possible to identify the change made very quickly and trace it back to the mechanism behind the vulnerability. A proof of concept can then be developed and used to search for and exploit systems that have not yet been patched. AI tools play a key role in accelerating attackers’ efforts at every stage of these processes.
Software patches remain the primary protective measure, but the volume and speed at which vulnerabilities emerge make applying these patches challenging, particularly where this cannot be automated (servers, applications, etc.). If the vulnerability can be exploited via the network, countermeasures can be deployed on online devices such as NDR or IPS systems. However, applying a patch does not reveal whether a system has already been compromised, nor whether an attacker has managed to maintain access after remediation, which highlights the value of threat hunting campaigns that retrospectively search for traces of the attack, before detection mechanisms were active.
Dwell time – the period between initial access and the impact or detection of the attacker – has fallen sharply in recent years. Sophos’s latest Active Adversary Report (2026) puts the median at 3 days across all cases, 5 days for cases handled through reactive investigation, and 2 days under continuous monitoring (SOC/MDR). A median time of less than 4 hours was recorded for reaching a critical resource such as Active Directory following the initial compromise. Secureworks, for its part, noted as early as 2023 that ransomware was deployed in less than 24 hours in more than half of cases, indicating a certain acceleration. In the case of OFIT, the anomaly was only identified around two weeks after the initial exploitation of the vulnerability – a timeframe longer than these recent averages – illustrating that even standard detection leaves the attacker with a comfortable window of opportunity once they have gained entry.
This is where the ‘Assume Breach’ strategy comes into its own: by acknowledging that a breach may occur despite preventative measures, it involves investing as much in the ability to detect the attacker quickly, once they are present in the environment, as in prevention itself.
The concept of cyber deception fits naturally into this approach. Rather than waiting for an attacker to interact with the IT system’s genuine resources (a reactive approach), decoys can be deployed within the network to create additional detection points (a proactive approach). Any interaction with these resources then constitutes a particularly reliable signal for the SOC.
From Network Honeypots to Cyber Deception
A network honeypot is a decoy system or service (server, file share, database, credentials) deployed within the information system to resemble a real asset, without ever being used by a legitimate user or application.
Once a system has been compromised, the attacker generally seeks to understand its environment: network mapping, lateral movement, and account compromise are all techniques used following the initial infection. A decoy positioned within the network makes it possible to monitor these interactions and add detection points at locations likely to be explored.
Unlike production resources, decoys are never usd in day-to-day operations: a port scan, an authentication attempt, or any interaction with a decoy can therefore trigger an alert without the need to first distinguish between legitimate activity and malicious behaviour, resulting in a false positive rate close to zero.
- Deployment: decoys are distributed across network segments (office network, DMZ, cloud) and can be configured in a matter of tens of minutes.
- Alert: Interaction immediately triggers a highly reliable alert, enriched with technical context and often mapped to the MITRE ATT&CK® framework.
In the OFIT SharePoint scenario, a decoy placed near the exposed server or within a segment likely to be explored following its compromise could have triggered an alert during the earliest stages of reconnaissance or lateral movement, whereas the compromise was only confirmed several days after the first signs appeared.
Cyber Deception within the SOC
An isolated decoy is only of value if it is utilised. When integrated with the existing SOC and SIEM/SOAR systems, it becomes a sensor with very low false positives and a very high confidence level:
- Immediate prioritization: a deception alert does not require complex correlation; it goes straight to the top of the queue (critical alerts)
- Automated response: host isolation, revocation of compromised credentials, and network blocking can be triggered without human intervention.
- Technology-agnostic detection: particularly useful against ‘Living off the Land’ attacks, where the attacker relies on tools and features already present in the environment, which are difficult for traditional tools to distinguish from legitimate activity.
- Reduction in MTTD: the benefit most often highlighted, from several weeks to a matter of minutes.
Remediation Capabilities
Applying patches, resetting compromised accounts, and rebuilding servers address the issues identified during the incident. However, these measures do not always allow us to determine with certainty whether the attacker still has access to the environment.
Decoys and honey tokens can be maintained or deployed during this phase to monitor for any residual activity. Any interaction with these resources then serves as an additional indicator to confirm or cast doubt on whether the compromise has ended.
Considerations in OT Environments
Industrial environments (SCADA, ICS) present their own constraints: legacy systems that cannot be patched, specific protocols (Modbus, DNP3, IEC 60870-5-104, S7comm), virtually zero tolerance for any disruption to production, and the inability to deploy agents on PLCs. Deception takes a tailored form in these environments:
- Passive decoys emulate programmable logic controllers (PLCs), HMIs or engineering workstations, without ever interacting with the actual process.
- Deployment is non-intrusive: no modifications to production systems, and no risk of latency or disruption.
- The value is all the greater given that OT networks are often poorly segmented: a well-placed decoy detects the reconnaissance that almost invariably precedes a targeted attack, well before any operational impact.
The same logic extends beyond the network: canary files (decoy documents that trigger an alert when opened), canary tokens (keys or dummy records whose use signals a compromise), and decoy identities (dormant accounts under continuous surveillance) complement network deception by monitoring activity within workstations and applications.
How Abilene Solutions Can Help
In line with this approach, we integrate Cyber Deception technology into our SOC platform and service capabilities to complement existing detection mechanisms with Anantis decoys deployed directly within the client’s environment.
Anantis is the Swiss developer of the TrapEye cyber deception platform we partner with. All data on the platform is hosted exclusively in Switzerland.
In an ‘Assume Breach’ approach, cyber deception enables the SOC to change its strategy: instead of simply waiting for signs of a breach, it makes its environment hostile to attackers to detect intruders as early as possible.
Resources and Further Reading
Detect better. Stop adversary.
Detect better. Stop adversary.
