CADO: Constraint-Aware Alert-to-Deception Orchestration for Heterogeneous Security Controls

Automating the transition from heterogeneous security alerts to deception actions requires both decision constraints and verifiable execution. We present Constraint-Aware Deception Orchestration (CADO), a control-plane specification connecting normalized security events to typed deception action transactions with explicit scope, lifetime, verification, and compensation. The policy anchors each decision to a fixed consensus action and admits a one-level residual only after evidence, novelty, escalation-confidence, and model-based value checks. In a discrete-event simulation with three zones, four development attacker profiles, and 30 paired seeds, mean defensive utility was 0.7020 (95% bootstrap confidence interval: 0.7003–0.7038), versus 0.6953 for consensus; redirection precision increased from 0.6978 to 0.7282. The observed unsafe-action rate was 0.000046 for both policies. A held-out profile produced 98.68% consensus fallback, with small utility and precision gains accompanied by higher resource cost. An exploratory study of 26 parameter configurations identified sensitivity to admission thresholds and uncertainty penalties; safety-rate equality did not hold throughout the grid. A separate three-process HTTP prototype exercised 300 transaction tests, including explicit detection of 30 persistent rollback failures. These simulation and local integration results do not establish production effectiveness, calibrated safety guarantees, or interoperability with commercial H4 devices.