Abstract: According to examples, an apparatus includes a processor that may receive data from a decoy device, in which the data may include first information pertaining to an identity used by and a method by which an entity interfaced with the decoy device while the decoy device was using a first attack surface. The data may also include second information pertaining to an identity used by and a method by which the entity interfaced with the decoy device while the decoy device was using a second attack surface. The processor may train a machine learning model using the received data, in which the machine learning model is to identify anomalous access to devices. The processor may also determine, using the machine learning model, whether an access to a certain device is anomalous and based on a determination that the access to the certain device is anomalous, execute a mitigation operation.