Cybersecurity Manager: 2026-09-19

1. Using Cyber Decoys to Strengthen Detection and Response

   Cybersecurity and Infrastructure Security Agency (CISA), 2026-09-16. Read, 2 min.

   CISA published guidance on 16 September 2026 on using cyber decoys, which it defines as assets that appear to be legitimate systems, accounts, or data but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence. The page names honeytokens among the decoy concepts it covers, alongside tripwires and breadcrumbs. The landing page is a short overview and the guidance itself is a downloadable PDF. Listed audiences include executives, federal government, industry, small and medium businesses, and state, local, tribal and territorial government.

   Why it matters for this role: You now have federal guidance to cite when you ask for the time to place decoys, so decide whether the team runs a small pilot this quarter and who owns the alerts it produces. The definition also gives you plain words for explaining to executives what a decoy is for.

2. Cisco Identity Services Engine Authentication Bypass Vulnerability

   Cisco (PSIRT), 2026-09-16. Read, 7 min.

   Cisco published advisory cisco-sa-ISE-ABP-VNSW7Tn5 on 2026-09-16 for CVE-2026-76460, a CVSS 10.0 authentication bypass caused by insufficient authentication control on an ISE API endpoint, affecting Identity Services Engine and the ISE Passive Identity Connector regardless of device configuration. Cisco says an unauthenticated attacker sending a crafted request may obtain command execution with root privileges, that PSIRT is aware of active exploitation, and that there are no workarounds that address the vulnerability, with infrastructure access control lists restricting management traffic offered as mitigation only. First fixed releases are 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4.

   Why it matters for this role: A maximum-severity bypass under active exploitation with no workaround is an emergency change decision: approve the out-of-band window, state what access disruption you will accept while ISE upgrades, and name who checks whether the nodes were already reached.

Cybersecurity Manager