NIST 800-53 r5 · Controls catalogue · Family SC
SC-26Decoys
Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.
Last updated: 09 May 2026 03:25 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (3)
Weaknesses this control addresses (9)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,204 | Decoys supply misleading data and log access attempts, directly detecting and deflecting unauthorized information exposure. |
CWE-862 | Missing Authorization | 8,680 | Decoys expose and log missing authorization flaws by serving as monitored targets for unauthorized function access attempts. |
CWE-284 | Improper Access Control | 4,832 | Decoy resources detect and deflect attempts to bypass access controls by attracting and monitoring attackers on fake assets. |
CWE-287 | Improper Authentication | 4,730 | Decoy authentication surfaces detect bypass attempts and deflect real credential attacks through observable malicious interactions. |
CWE-863 | Incorrect Authorization | 3,234 | Decoys detect incorrect authorization decisions through attacker interactions with deliberately misprotected decoy objects. |
CWE-306 | Missing Authentication for Critical Function | 2,567 | Decoy implementations of critical functions without authentication lure and record attackers probing for missing auth checks. |
CWE-285 | Improper Authorization | 1,230 | Decoys identify and block exploitation of improper authorization by providing monitored targets that mimic protected functions. |
CWE-552 | Files or Directories Accessible to External Parties | 540 | Decoy files and directories detect external access attempts and deflect attackers away from actual accessible resources. |
CWE-425 | Direct Request ('Forced Browsing') | 255 | Decoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||