Re: But first...
There is a whole subfield of cybersecurity that goes a lot wider and deeper than this - Deception Technologies.
You can deploy whole fake but utterly believable networks of totally fake "assets" using minimal resources. Then arrange a Red Team exercise and have fun reading their report (or watch them in real time if you can). If you tell them deception has been deployed in advance they'll start running from their own shadow.
Biting the hand that feeds IT
