Deploy

Deployment is the phase where deception assets move from staging into the live environment. This is a precision operation, not a bulk rollout. Each asset needs to be placed where it will generate the most value, whether that means catching an adversary during initial reconnaissance, trapping them during lateral movement, or alerting on attempted data exfiltration.

The art of deployment lies in positioning. A honeypot sitting on an isolated subnet that nobody would naturally traverse is unlikely to see any adversary interaction. A canary token buried in a file that no attacker would bother opening is a wasted resource. Effective deployment requires thinking like the adversary: where would they go after initial access? What would they search for? What would they try to steal?

This adversary-centric thinking drives deployment decisions. Credential traps go in the places attackers actually harvest credentials: configuration files, environment variables, browser password stores, and shared drives. Honeypots get placed on network segments that represent natural lateral movement targets. Canary tokens get embedded in documents that an attacker would find valuable: financial reports, network diagrams, customer databases.

Deployment also requires coordination with the broader security operations team. Every deception asset is a potential source of alerts, and the SOC needs to understand what is real and what is deception. Miscommunication here leads to either ignored alerts (defeating the purpose) or wasted incident response cycles investigating benign interactions.

The deployment phase concludes when all planned deception assets are operational, monitored, and documented. The environment should be ready to receive and respond to adversary interactions without any further manual intervention needed to capture the initial engagement.