“By forcing attackers to spend time and resources navigating false environments, chasing fake credentials, or second-guessing ...