Abstract: An adaptive deception system is provided for defending a production network against cyber-attacks utilizing deception devices on the production network. The adaptive deception system includes a deception management system. The deception management system includes monitors for making observations regarding the deception devices including observations of an attacker's interaction with the deception device. The adaptive deception system further incudes a control system having sensors that receive the observations of the deception management system. The control system is configured to provide an adaption specification in response to the observations made. Actuators of the control system are activated in order to provide the adaption specification to the deception management system where monitors of the deception management system implement the specified adaption. Implementation of the adaption adapts the properties of the deception devices to interfere with the cyber-attacker.