Cybersecurity experts define 3 types of deception technology applications - attack detection, active defence and disruption. Attack detection deceptions are set up in the manner that makes them an early alarm system. They are most likely to be the first targets of hackers, and any activity inside of these decoys is an indicator of compromise.
Active defence decoys are supposed to give the crooks as much freedom as possible, in order to bait them for uncovering the details about the used tactics, software, and maybe even personal information. That sort of trap is quite hard to create, since it should have minimum signs of being a pitfall.
Disruption is a technique that confuses the hackers during the attack. While they are trying to move through a network, deception will likely distract them and gouge about the next steps they will need to take. Disruption decoys are more about a proactive approach, as they should be managed during the ongoing attack.