Deception in cybersecurity used to mean a honeypot on the network, waiting for someone to poke at it. That’s still one form it takes, but the picture has broadened. Decoys now show up in identity systems and cloud environments, and analysts are starting to fold deception into how they talk about security spending as a whole. Here’s what’s actually documented, separated from what’s still speculative.
Deception Is Moving Beyond Traditional Honeypots
A honeypot works on a simple principle: no legitimate user has a reason to touch it, so any interaction is a signal worth investigating. That principle hasn’t changed. What has changed is where these traps get placed. Instead of sitting mainly on the network perimeter, decoys are now built into identity systems, cloud accounts, and secrets management, following attackers to wherever they actually operate.
Decoys Are Moving into the Identity Layer
Microsoft’s own documentation for Defender for Identity describes honeytoken accounts as dormant Active Directory entities that exist purely as traps. They should never authenticate them. If one does, Defender for Identity fires an alert.
That’s not a future capability. It’s a configuration option inside Microsoft’s identity security tooling, and having it documented as a standard feature shows that identity-based deception has moved out of specialist deception platforms and into mainstream security products. In practice, this extends deception into identity systems, where stolen credentials and compromised accounts can give attackers access that looks legitimate on the surface.
Deception Is Becoming Part of the Preemptive Security Conversation
Gartner’s cybersecurity research has been specific about this. In a September 2025 press release, Gartner said preemptive cybersecurity solutions, technologies that use AI and machine learning to anticipate and neutralize threats before they materialize, will account for 50% of IT security spending by 2030, up from less than 5% in 2024. Gartner’s own wording lists what falls into that category: predictive threat intelligence, advanced deception, and automated moving target defense.
In a separate release a month later covering its 2026 technology trends, Gartner analyst Tori Paulman framed it this way: preemptive cybersecurity is about acting before attackers strike using AI-powered SecOps, programmatic denial, and deception. That’s a specific, sourced claim about where Gartner sees budgets heading, not a general industry mood.
Deception Is Becoming More Adaptive
Gartner’s inclusion of AI and machine learning in its definition of preemptive cybersecurity suggests a broader move toward more adaptive security controls. Whether that translates into widespread use of AI-generated or continuously changing decoys in production environments is less clear. Public evidence on how far this has reached is still limited, so it’s better described as a direction the category is heading rather than a settled trend.
Deception Is Extending into Cloud Environments
Google Cloud’s Threat Horizons report for H1 2026 found that identity compromise underpinned 83% of cloud and SaaS compromises observed in the second half of 2025. Those findings reinforce the case for placing deception inside cloud environments, rather than limiting it to on-premises networks.
This looks like fake IAM roles, decoy storage buckets, and planted secrets in cloud secrets managers, with detection routed through each provider’s own audit logging. What isn’t yet clear from public sources is how broadly organizations have deployed this in cloud accounts versus how many still run cloud environments with no deception coverage at all.
Deception Telemetry Is Becoming Useful Beyond the Decoy
Decoy telemetry, commands run, files searched, credentials tried, can also be fed back into detection rules for production systems, rather than being used only to investigate the original alert. That turns a decoy from a one-time trap into an ongoing input for the SOC. Though how consistently organizations do this in practice is harder to establish from public sources than the capability itself.
MITRE Engage as a Common Framework
MITRE Engage, launched in 2022, provides a framework for planning and documenting adversary engagement and deception operations. According to MITRE’s own materials, it maps to the MITRE ATT&CK framework, letting a team connect a specific decoy to the specific attacker technique it’s designed to catch. At launch, MITRE framed the value in blunt terms: traditional defense requires getting everything right, while deception only requires the attacker to make one wrong move.
Agentic AI Is an Emerging Area to Watch
This one deserves a clear label: emerging, not established. Gartner’s 2026 research names agentic AI as a growing source of attack surface, pointing to unmanaged AI agents and unsecured no-code or low-code applications as risks outpacing governance. That’s a documented concern. Whether deception vendors have built decoy AI agents or fake agent workflows in meaningful numbers is a separate question, and the public evidence for that is thin right now. It’s worth watching over the next year rather than treating as arrived.
The Takeaway
The clearest developments in cyber deception right now are its expansion into identity systems and its place in how Gartner now defines preemptive security spending. Its move into adaptive, AI-assisted decoys and into cloud environments is real but less precisely measured. Deception aimed at agentic AI is worth tracking, not yet something to count as settled. Treating those three different levels of certainty, rather than one uniform trend, is the more honest way to read where this technology stands.
