A decoy credential is a synthetic username and password, key, or other login secret placed where an intruder might discover it. It is not intended for legitimate access; its use should trigger an alert, making it a deception-based detection signal.
Because authorized users and routine processes should not need the credential, attempted use can indicate credential discovery or an effort to access a system. Defenders should keep decoys out of normal workflows, document their placement, and check alerts against identity, endpoint, and network telemetry. A decoy alert can be high-signal, but it does not by itself prove the scope of an intrusion, and poorly managed decoys may generate benign alerts.