Where should teams place OT deception controls to catch the most likely attack paths?

Why OT deception placement should follow attacker entry paths

Deception only works well in OT when it sits where an intruder is most likely to look first. Remote access termination points and the IT/OT boundary are high-value because they reflect how real attackers usually enter, validate access, and start mapping the environment. Decoys there are more likely to be touched early, which shortens detection time and gives defenders a cleaner signal than scattered deception deeper in the plant.

That placement also fits the way OT environments are usually segmented. The goal is not to hide every asset, but to position believable tripwires at points where trust changes, especially where enterprise credentials, remote support, or integration traffic crosses into operational space. A well-placed decoy can reveal both the initial foothold and the attacker’s first pivot attempt.

USB-exposed assets deserve the same treatment because removable media remains a common bridge into OT. Shadowing those endpoints with decoys gives defenders coverage where portable media, local maintenance, and technician workflows can bypass normal network monitoring. In practice, the best placements are the ones that mirror how the environment is actually used, not just how it is documented.

Which OT zones deserve decoys first?

The first priority is the remote access path, including jump servers, remote support gateways, and any externally reachable maintenance channel. Those paths often concentrate privileged activity and are attractive because they promise rapid reach into engineering and control networks. A decoy in that zone can tell you whether someone is enumerating sessions, testing credentials, or probing for higher-value systems.

The second priority is the IT and OT interface, where segmentation is supposed to constrain movement but often still allows some operational visibility or management traffic. That makes it a natural reconnaissance point. Decoys here can surface discovery behavior, lateral movement attempts, and the earliest signs that an attacker is trying to map which side of the boundary contains what.

Third, place decoys near USB-dependent devices and adjacent maintenance workflows. That includes stations or assets that are likely to interact with portable media, vendor laptops, or local engineering tools. The value is not just detection, but context: a hit on a USB-adjacent decoy often suggests hands-on access or an on-site stage of the intrusion rather than a purely remote one.

How should teams judge whether a decoy is in the right place?

Good OT deception placement is judged by realism and by how early it catches attacker curiosity. If a decoy is too isolated from actual workflow, it may never be touched. If it is too generic, it may be ignored by anyone who has already enumerated the network. The best decoys resemble systems an intruder would expect to find while still being instrumented enough to alert clearly when touched.

Placement should also follow the attacker’s decision points. A decoy is most useful where an adversary is trying to decide whether the environment is worth deeper effort, such as after initial access, after crossing a trust boundary, or after discovering removable-media handling. Those moments matter because they often precede credential harvesting, privilege discovery, or pivoting into control segments.

For OT teams, that means the question is not “where can we hide a decoy?” but “where would a realistic attacker expect to find the next useful system?” The answer usually points to boundary zones, shared services, and maintenance paths rather than isolated production controllers.

Risk and Threat Considerations

OT deception placed in the wrong part of the environment can create noise without improving detection. If decoys are hidden too deep or too far from common entry paths, they may only attract benign scanning long after an attacker has already moved on, which weakens their value as an early warning control.

Failure mechanism: Attackers tend to test the easiest trust boundaries first, so deception that is not aligned to remote access, segmentation boundaries, or USB-adjacent workflows can miss the initial reconnaissance and expose defenders to delayed detection.

Impact: Missed early contact reduces context on attacker intent and movement, making it harder to distinguish a fleeting probe from an active intrusion path and giving the attacker more time to pivot toward operational assets.

Practitioner Guidance

What to prioritise: Place the first decoys where access changes hands, not where assets are merely valuable. Remote access gateways, IT/OT boundary systems, and USB-supported maintenance zones should be the default starting points because they are the most likely points of first contact.

What to verify: Confirm that each decoy matches the look and role of the zone it is meant to protect, including naming, protocol exposure, and surrounding network context. A decoy that does not fit the local workflow is easy to dismiss, both by attackers and by internal testers.

Common mistake: Teams often spread deception evenly across the plant instead of concentrating it at likely approach paths. That produces weaker signal quality and less useful attacker context than a smaller number of well-placed decoys.

Practitioner takeaway: OT deception should be deployed where an intruder is most likely to touch the environment first, because early boundary contact is what gives defenders the best chance to detect movement before it reaches control assets.

Related resources from NHI Mgmt Group

• How should security teams place deception controls in Active Directory?
• How should security teams validate ransomware controls against Clop-style attack paths?
• How should security teams reduce attack paths into legacy and OT systems without disrupting operations?
• How should security teams use exposure validation to prioritise the controls and attack paths that matter most?