Abstract: Systems, methods, and computer-readable media are disclosed for systems and methods for automated deployment of decoy production networks. Example methods may include detecting, by one or more computer processors coupled to memory, an unauthorized user in a production network environment, determining a computer-executable payload associated with the unauthorized user, and initiating a first virtual decoy production network environment. Methods may include causing the computer-executable payload to be executed in the first virtual decoy production network environment, and recording telemetry data associated with execution of the computer-executable payload in the first virtual decoy production network environment.