Cyber deception exposes the limits of assume-breach security

At a glance

What this is: This is Acalvio’s analysis of how cyber deception performed in the Navy Cyber Challenge and what that implies for assume-breach defence.

Why it matters: It matters because IAM, PAM, and security architecture teams need to understand where detection-only assumptions stop working and where deception changes attacker economics.

By the numbers:

• Acalvio reports 100% true positives from every alert generated in the challenge.
• Acalvio reports 80% denial of attacker objectives during the challenge.

Context

Cyber deception in this article means planting realistic decoys, signals, and response paths that make attacker actions visible and costly before they reach real assets. The central governance issue is that assume-breach models can become too passive if they rely mainly on detection and response after attacker movement has already begun.

For identity practitioners, the important question is not whether a breach is possible. It is how quickly identity-adjacent attacker behaviour such as credential access, privilege escalation, and lateral movement can be detected, delayed, and denied before high-value systems are reached.

The article frames this through a Navy competition, which makes the point operational rather than theoretical. That setting is atypical in scale and rigour, but the underlying lesson about control assumptions applies broadly.

Key questions

Q: What breaks when assume-breach defence relies only on detection?

A: Detection-only assume-breach programmes often confirm activity after the attacker has already moved into credential access or lateral movement. The break point is not awareness, but delay. If defenders cannot slow progression, then the environment may be observable without being meaningfully defensible, which is why denial and disruption matter alongside alerts.

Q: Why does deception reduce attacker success in identity-heavy environments?

A: Deception works because many attackers depend on fast reconnaissance, reusable credentials, and predictable movement paths. When fake assets and monitored lures sit inside those paths, the attacker is forced to interact, reveal intent, and waste time. That friction lowers the chance that a single foothold turns into privilege escalation or exfiltration.

Q: How can teams evaluate whether deception is actually working?

A: Look for evidence that deception improves attribution, reduces investigation time, and exposes real attacker behaviour in identity-heavy paths. If alerts do not correlate to IAM, PAM, or cloud events, the control may be producing noise instead of usable intelligence. A good programme shows measurable impact on triage and containment decisions.

Q: What does deception add to zero trust and segmentation strategies?

A: Deception adds verification of attacker behaviour after the first touch point. Zero trust and segmentation define who should move and where, but deception shows whether an intruder can still probe, pivot, or escalate inside those boundaries. That makes it a practical validation layer for the assumptions behind trust restrictions.

Technical breakdown

How deception changes attacker economics

Cyber deception works by giving the attacker something plausible to interact with while keeping the real environment separate. Instead of waiting for alarms after compromise, the defender instruments fake assets, fake pathways, and high-fidelity alerts that surface hostile interaction early. In practice, this shifts the security problem from incident confirmation to attacker conditioning: every false path consumes time, reveals intent, and can expose tradecraft. The value is highest when decoys blend into normal identity and infrastructure patterns closely enough that adversaries cannot easily distinguish them from production targets.

Practical implication: place deception where attacker reconnaissance and identity abuse are most likely to begin, not only around crown-jewel systems.

Why true positives matter in security operations

A 100% true-positive rate is operationally important because it changes SOC triage economics. If every alert is tied to a real malicious interaction, analysts do not waste time validating noise, and the signal can be escalated faster with more confidence. Deception systems are judged less by raw alert volume than by alert quality, fidelity, and the ability to map hostile activity to attacker objectives. This is especially relevant in environments where identity and credential activity already generate noisy telemetry, making precision a prerequisite for response speed.

Practical implication: evaluate deception controls on alert fidelity and analyst workload reduction, not on the number of alerts they produce.

Credential access, lateral movement, and privilege escalation under deception

The article’s attack-chain language matters because deception is most useful when it breaks progression, not just visibility. Enumeration can be trapped by fake assets, credential access can be surfaced by lures, and lateral movement can be redirected into monitored paths that reveal the operator. That makes deception a control for attacker momentum. It does not replace identity governance, but it can expose where standing access, weak segmentation, or poor privilege boundaries would otherwise let an attacker move from discovery to impact with little resistance.

Practical implication: use deception to validate whether your identity and segmentation controls actually slow attacker movement once credentials are touched.

Threat narrative

Attacker objective: The attacker wants to gain access, expand privilege, and reach valuable data or operational targets without early detection.

1. Entry begins with attacker enumeration against exposed or discoverable assets, which deception can turn into a monitored interaction rather than a blind search.
2. Credential access follows when the attacker probes for usable identities, tokens, or pathways, and decoys can surface that activity without handing over real access.
3. Escalation then takes the form of lateral movement and privilege escalation, where deceptive paths can misdirect the attacker and expose intent before exfiltration.
4. Impact is delayed or denied when the attacker cannot reach real data or operational assets and instead wastes time inside the deception layer.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Assume-breach is no longer a complete control model: Once defenders accept that attacker presence is plausible, the deciding question becomes whether the environment can still deny progress. Acalvio’s Navy Cyber Challenge result shows that active disruption is not a theoretical enhancement but a distinct control objective. For identity programmes, the implication is that visibility alone is insufficient when attacker movement can already traverse credential and privilege boundaries.

Identity controls must be measured by attacker friction, not policy intent: A control stack can look strong on paper and still let an intruder enumerate, credential-hop, and move laterally with minimal delay. The article’s attack-chain framing shows why governance must ask what an attacker can do after the first successful interaction. That pushes programme owners to treat identity boundaries as tested assumptions, not static declarations.

Cyber deception creates an identity signal layer, not just a detection layer: Deception is most valuable when it reveals the sequence of hostile decisions around access use, privilege escalation, and path selection. That makes it relevant to both NHI governance and human IAM because the same attacker logic often traverses service accounts, elevated accounts, and operational paths. Practitioners should read this as evidence that identity defence now needs adversary conditioning, not only authentication and review.

Deception exposes the identity blast radius of standing trust: When the attacker can keep advancing after reconnaissance, the real problem is not the initial alert but the size of the reachable trust domain. The article sharpens a useful concept here: identity blast radius. That is the amount of real access an attacker can convert from one foothold before controls meaningfully interfere, and it is now a governance metric worth naming explicitly.

Assume-breach programmes need a denial layer as well as a detection layer: The Navy challenge context validates a broader market direction. Security teams are moving toward architectures that do not merely confirm compromise but actively reduce attacker progress inside the environment. That should change how practitioners evaluate deception, segmentation, and identity containment together, because the control question is no longer just whether compromise is visible, but whether it is contained before objectives are achieved.

What this signals

Identity blast radius is the right lens here: deception matters because it limits how much value an attacker can extract from one foothold before the environment starts pushing back. For teams running identity programmes, that means assessing where standing access, lateral movement, and privilege boundaries still give intruders room to operate.

Security teams should expect more interest in controls that do not just detect compromise but actively distort attacker decision-making. That will matter most where service accounts, elevated access, and hybrid environments create long trust chains that are hard to observe with traditional review cycles.

For practitioners

• Instrument deception at identity choke points Place decoys and lures where attackers are likely to touch credentials, directory objects, or adjacent service paths first, so hostile interaction is captured early.
• Measure control value by attacker delay Track how long deception forces adversaries to spend before they can enumerate, pivot, or escalate, and compare that delay with your current detection-only controls.
• Correlate deception alerts with identity telemetry Tie high-fidelity deception hits to authentication, directory, and privilege-change events so analysts can see whether the same actor is trying to expand access.
• Test whether segmentation still holds after compromise Use controlled adversary simulation to see whether a first foothold can still move laterally or reach privileged paths when deception is present.

Key takeaways

• The article argues that assume-breach defence cannot stop at visibility when attackers can still enumerate, move laterally, and escalate privileges inside the environment.
• Acalvio cites 100% true positives and 80% denial of attacker objectives in the Navy challenge, which supports the case for deception as an active control.
• For practitioners, the practical question is whether identity and segmentation controls can still slow attacker progression after the first suspicious interaction.

Key terms

• Cyber Deception: Cyber deception is the use of decoys, honeytokens, cloaked assets, and misleading identity signals to make attacker actions harder to validate. In identity security, it changes the environment an intruder sees so that reconnaissance and credential abuse expose intent earlier and reduce the attacker’s ability to trust what they find.
• Assume Breach: An operational posture that treats compromise as a realistic starting assumption rather than an exceptional event. The goal is to detect and contain adversary activity after entry, using telemetry, hunting, and response discipline to limit how far attackers can move.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Deception Telemetry: Deception telemetry is the high-confidence signal generated when an attacker interacts with a decoy, lure, or fake pathway. It is valuable because it usually indicates malicious intent rather than normal user behaviour, making it a strong trigger for triage and containment.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.