In the evolving threat landscape, security leaders are concerned about maintaining business resiliency in the face of cyber threats including ransomware, zero-day attacks that target legacy systems, and lateral attacks. These threats don't only affect IT networks, they can have an impact on interconnected OT networks as well. Existing cyber security solution are based data packets and logs inspection, but with the large amount of data, most encrypted this amount to a daunting task and is expensive. In addition, given the complexity and nefariousness of the modern cyber attacks and their tactics, techniques and procedures, location bad actors and or contents amounts to a needle in a hay attack.

Deception can be a complementary approach, by luring an attacker to "fake targets", with poised data, servers, networks etc.  This is to observe the attacker tactics, tools, and techniques among other things. Every alert from the deception farm is a "needle" or an actionable alert., which can be an indicator of compromise, attack, or threat. This offensive strategy is necessary for large homogeneous environment, where collecting large amount of data maybe cost prohibitive or perhaps just useless.