Built around a real-world midnight detection thriller, this technical deep dive investigates a live case study where a decoy credential was read and used exactly ten minutes and six seconds later, triggering an automated alert and edge block in under a second. We examine how defenders can expand beyond traditional canary tokens into advanced deception layers—deploying honey database records to catch broken access control (IDOR), prompt canaries to detect system prompt extraction, and decoy Model Context Protocol (MCP) servers to intercept an AI agent’s tool arguments. Finally, we break down deception economics: turning the speed of autonomous AI adversaries against them by deploying tarpits that burn millions of attacker input tokens and forcing automated test harnesses into costly, fruitless loops.
Articles in this episode
- Honeytokens in Practice: Using Canary Credentials to Catch Attackers (and AI Agents) the Moment They Act: https://cisomarketplace.com/blog/honeytokens-canary-credentials-catch-attackers
- Ten Minutes From Harvest to Use: A Canary Credential Case Study, and How to Tell a Researcher From an Attacker: https://cisomarketplace.com/blog/canary-credential-case-study-researcher-or-attacker
- Advanced Deception: Honey Records, Prompt Canaries, Decoy MCP Servers and Tarpits for an Age of AI Attackers: https://cisomarketplace.com/blog/advanced-deception-honey-records-decoy-mcp-tarpits
Disclosure program / bug bounty
No comments yet. Be the first to say something!