The Red Teamer’s Guide to Deception

Why Red Teams Still Win

Balazár and colleagues from SBS red teaming show real engagement shells and walk through cases—telecom Linux lateral movement, financial password spraying to core banking, and manufacturing AD attacks—where detections fired but failed to evict attackers.

SOC Reality

They argue SOC teams struggle with incomplete log coverage, noisy legacy tools mimicking attacker behavior, alert fatigue, and analysts who lack domain context. Determined attackers retry until they slip through sparse medium-severity alerts.

Internal Honeypots as Smoke Detectors

The speakers advocate cheap internal deception: fake credentials, canary hosts, and tripwires that almost never false-positive because legitimate users never touch them. Alerts warrant senior analyst response and slow attackers who must question every vulnerability.

Vendor Case Study Caution

A deployed commercial deception product on all laptops failed when the team entered via a non-laptop vector and never triggered embedded tokens. Their lesson: simple, environment-tailored honeypots with admin buy-in beat over-engineered rollouts.