Patent ID: 8549643

Claim:
A computer-implemented method comprising: tracking, by a hardware processing device executing a data loss prevention (DLP) system, initial bait data on at least one of a host computing device or a network to which the host computing device is connected, wherein the initial bait data is generated from training data, and wherein the initial bait data comprises at least a modified portion of the training data that is related to the initial bait data; identifying one or more properties of the initial bait data within one or more incident reports for a potential security threat; generating, from the training data, additional bait data that has the one or more properties of the initial bait data in response to detecting unscripted activity associated with the initial bait data committed by the potential security threat, wherein the additional bait data comprises at least a modified portion of the training data that is related to the additional bait data, and wherein the initial bait data and the additional bait data comprise at least one of decoy stored data or decoy input data; and making the additional bait data available to the potential security threat.