Thinkst

• A detection, endpoint or cloud platform could ship a decoy-and-token feature, one of the two routes Forrester's 2019 post described for buyers, which would remove the reason to buy a standalone product.
• No cross-customer dataset behind the product appears in the reviewed record, so no accumulated data advantage appears on record with which to answer a rival that bundles deception into a larger platform.
• Forrester's 2019 post names the false-negative problem in deception, that an adversary can accomplish its objectives without being detected, so the high-confidence alert Thinkst sells depends on an intruder choosing to touch a decoy.
• Revenue, profitability and retention all trace to founder statements in a single May 2025 TechCrunch interview rather than to audited disclosure, so the traction picture comes from one source.
• The DeceptIQ acquisition closed in January 2026 and the reviewed record does not document how its cloud tripwires will be integrated or priced, so the deal's contribution to the product is unproven.
• Buyers whose procurement requires a named attestation find none on the probed surfaces, which narrows the deals Thinkst can enter without one.

Thinkst sells against one failure its own pages state. Organizations spend heavily on security and still learn about a breach months or years later, and Thinkst Canary answers that with decoys the vendor says deploy in under three minutes and stay silent until an intruder touches one.

An independent source puts a number on the pain. TechCrunch, writing about Thinkst in May 2025, cited Verizon's annual data breach report for an average of around 24 days on a victim's network before detection. Forrester, writing in April 2019 and stating that Thinkst was not a client, separately called honeypots valuable for detecting an intrusion and understanding an adversary.

The market is established rather than newly opening. Thinkst's own FAQ says honeypots are a great idea that almost nobody runs on internal networks, because nobody needs one more machine to administer, and it positions Canary as the version that removes that cost. The vendor's pitch is aimed at teams that cannot absorb another noisy tool, promising a handful of events per year even for customers running hundreds of Canaries. [s1, s5, s7, s2]

Thinkst Canary ships in four form factors with documented architecture behind them. Canaries ship as hardware appliances, virtual machines, and cloud or container instances, present realistic decoy services, and report to a hosted console over DNS, so a deployment needs only a DNS server that can make external queries rather than firewall changes for each device.

The engineering shows in the security architecture rather than in detection models. Thinkst reimplements network services in memory-safe languages to remove memory-corruption bugs as a class, sandboxes services that touch the operating system, gives each customer a single-tenant console, and refuses features that would make the honeypots hold sensitive information. The product runs no anomaly detection and no machine learning, which the vendor frames as the reason its alerts stay rare.

The free and open tiers extend the work into the practitioner community and invite outside scrutiny. Canarytokens gives away tripwires from fake AWS keys to decoy Word documents, and OpenCanary is a BSD-licensed daemon Thinkst maintains publicly, carrying roughly 3,000 stars and more than 400 forks and a last push in August 2026. That openness draws public bug reports, including a privilege-escalation issue in OpenCanary fixed in version 0.9.4. Thinkst added an MCP-server Canarytoken in June 2026 that generates decoy mcp.json files to catch agentic attackers. [s2, s3, s10, s11, s8, s16, s1]

An analyst, the press and a buyer place the product in the same category without vendor coaching. Forrester's 2019 deception post names Thinkst, TechCrunch describes Canary as a honeypot, and Kettering General Hospital NHS Foundation Trust titled its own contract notice Cyber Security - Canary Honeypot. Public pricing and an online quote flow make the budget slot easy to identify.

Standalone durability is the softer spot. Forrester argued in April 2019 that buyers should acquire deception integrated as a feature into another product, and that the deception space will never take off as a standalone capability, adding that a buyer can approve Canary under their own signing authority. The mechanic is simple by design, and a 2019 NVD record notes that Canarytokens through 1 March 2019 relied on limited variation in size, metadata and timestamp, making it easier for an attacker to estimate whether a Word document carried a token. Thinkst's FAQ says identification requires active interrogation of a Canary, and that it detects common fingerprinting methods and alerts on them.

Rivals position against Thinkst directly. Trapster, a French deception vendor, publishes a page of alternatives to Thinkst Canary that argues price and data location, and a self-published comparison blog dated May 2026 places Canary alongside Acalvio ShadowPlex and CounterCraft, calling Canary a focused product rather than a broader deception platform. [s7, s5, s18, s9, s2, s22, s21]

Thinkst runs a self-selecting motion with no outbound sales team. TechCrunch reports that the company relies largely on word of mouth, or on existing customers buying more, and the vendor's site lets a buyer generate a quote online without a sales conversation.

The figures behind that motion come from one interview. TechCrunch reported in May 2025 that Thinkst was on track for roughly $20 million in annual recurring revenue, almost double its 2021 level, at a healthy profit with about 40 staff, and that 60 percent of first-year customers were still with the company. Those numbers are the founder's, relayed by the reporter, rather than audited disclosure.

Public procurement records document a buyer. The UK Find a Tender service carries a contract notice recording Kettering General Hospital NHS Foundation Trust, classified as a public authority, buying a Canary honeypot from Thinkst Applied Research for £19,293, signed on 31 March 2025 and running to 31 March 2026. Reseller ITogether separately lists Thinkst Canary on the UK G-Cloud 14 framework at £6,500 a unit, so public-sector buyers can also purchase it through a framework agreement. [s5, s2, s18, s17]

Founder and chief executive Haroon Meer anchors the team's public record. A 2019 USENIX speaker biography states that he has contributed to several books on information security, published papers and tools, and delivered research, talks and keynotes at conferences around the world over almost two decades. Thinkst itself claims over two decades of published research, and it publishes the vendor-neutral ThinkstScapes reporting service.

The company keeps a small, engineering-heavy team. TechCrunch reported about 40 employees in May 2025, mostly developers and engineers, and quoted Meer saying Thinkst is not artificially holding back growth while avoiding growth-at-all-costs spending. Forrester separately described Thinkst as having a unique offering in the market while stating it was not a client.

January 2026 added a team by acquisition. Thinkst announced that it had concluded a deal to acquire 100 percent of UK-based DeceptIQ, describing it as built by red-teamers, and SecurityWeek listed the deal in its January 2026 cybersecurity acquisitions roundup. DeceptIQ's site now points visitors to canary.tools. The cited record does not connect the founder's research standing to purchases or retention, so the two stand as separate facts. [s6, s1, s5, s7, s12, s13, s20]

Thinkst documents a deliberate security posture for its own product. It runs single-tenant consoles so one customer's data is not stored with another's, reimplements network services in memory-safe languages, sandboxes anything touching the operating system, and blocks Canaries from multihoming so a compromised sensor cannot bridge network zones. It also states that Canaries store no valuable data and send only the alert content a customer sees.

The assurance package substitutes shared assessments for a named certification. Thinkst hires a rotating set of outside security assessors, shares those reports with customers on request, and says it will be open about any security issue and its impact. A probe on 23 August 2026 found no trust or security subdomain on either thinkst.com or canary.tools, with a random control subdomain also failing to resolve, and canary.tools/trust rendering a not-found page. The strings SOC 2, ISO 27001 and FedRAMP appear nowhere in the rendered vendor pages, so a buyer looking for a named attestation on Thinkst's own pages finds none. [s3, s19, s2]

Add analyzed competitors to compare them side by side with Thinkst.

Thinkst aims the paid product at security teams that run their own networks and cannot absorb another noisy tool. The pitch promises a handful of events per year even for customers running hundreds of Canaries, and the published price of $7,500 a year for five Canaries points it at organizations with a security budget rather than at individual practitioners.

A public contract record documents one of those buyers. Kettering General Hospital NHS Foundation Trust, classified in the notice as a public authority, bought a Canary honeypot from Thinkst Applied Research for £19,293 on a contract running from April 2025 to March 2026. Reseller ITogether separately lists Thinkst Canary on the UK G-Cloud 14 framework at £6,500 a unit, which puts the product in front of public-sector buyers through a framework agreement.

The free and open tiers address a second, community audience. Canarytokens costs nothing and OpenCanary is publicly distributed under a BSD licence, so a practitioner can run the technique before any purchase conversation. What converts that familiarity into paid deployments is not documented in the cited record.

Thinkst answers slow breach discovery with decoys that are quick to deploy and quiet to run. Canaries ship as hardware, virtual, cloud and container instances, present realistic services, and communicate with a hosted console over DNS, so a deployment needs only a DNS server able to make external queries rather than firewall changes for every device.

The product keeps the detection deliberately simple. Thinkst states that Canary does no anomaly detection, with machine learning or otherwise, and that its triggers are simple because nobody legitimate touches a decoy. That choice keeps alert volume low, which the vendor presents as the product's core promise.

Thinkst puts its engineering into the security architecture. It reimplements network services in memory-safe languages, sandboxes services that touch the operating system, isolates each customer in a single-tenant console, and blocks multihoming so a compromised Canary cannot bridge network zones. Public CVE records document a privilege-escalation flaw in OpenCanary, fixed in version 0.9.4, and a 2019 weakness in Word-document Canarytokens.

AI shows up as a detection target rather than a detection method. In June 2026 Thinkst released an MCP-server Canarytoken that generates decoy mcp.json files to catch agentic attackers working through toolchains such as VSCode, Cursor, Claude Code and Copilot CLI.

Thinkst runs a self-selecting motion with no outbound sales team. TechCrunch reports that the company relies largely on word of mouth, or on existing customers buying more of its honeypots, and the vendor's site lets a buyer generate a quote online without a sales conversation.

The traction behind that motion comes from one interview. TechCrunch reported in May 2025 that Thinkst was on track for roughly $20 million in annual recurring revenue, almost double its 2021 level, at a healthy profit with about 40 staff, and that 60 percent of first-year customers were still with the company. Those figures are the founder's, relayed by the reporter.

One purchasing channel now sits beside the direct motion. ITogether lists Thinkst Canary on the UK G-Cloud 14 framework, which is how a UK public-sector buyer would purchase through an existing agreement. Thinkst also published a Google Security Operations integration in April 2026 that existing customers install from Google's Content Hub, which changes where analysts work the alerts rather than how the product is bought. Neither the channel's nor the integration's contribution to revenue appears in the cited record.

Thinkst publishes its price, which is itself a positioning choice. The commercial product lists at $7,500 a year for five Canaries, unlimited Canarytokens and a hosted AWS console, with an online quote tool for larger deployments.

The charging unit is the Canary count, which matches how a buyer sizes the problem. A customer who deploys more decoys pays more and covers more of the network, and the unlimited free tokens remove any penalty on the lighter tripwire technique.

The published configuration sets a reference point without exposing the top. Five Canaries and unlimited tokens is what the site prices, the online quote path handles larger estates, and the UK G-Cloud listing prices the same product at £6,500 a unit through a reseller. Forrester observed in 2019 that a buyer can approve Canary under their own signing authority. That is the buying motion this price supports.

Thinkst delivers a hosted console with lightweight sensors and little operational footprint. Canaries deploy in minutes, run silently, and report incidents through email, text message, Slack, webhook or Syslog, so a customer routes alerts into workflows it already runs rather than watching a new dashboard.

Canaries sit outside production traffic. Thinkst describes them as passive sensors that play no part in it, hardens them by storing nothing of value on the device, and refuses to let them multihome across network zones, so an attacker who compromises a Canary cannot pivot from it.

Thinkst handles updates and recovery for the customer. It performs three or four planned over-the-air releases a year plus out-of-schedule security updates, backs up consoles hourly, and says it can return a failed console to full functionality within 24 hours.

Thinkst documents a deliberate security posture for its own product. It runs single-tenant consoles so one customer's data is not stored with another's, reimplements services in memory-safe languages, sandboxes anything touching the operating system, and signs updates with a key it says is never exposed to the internet.

The company substitutes shared assessments for a named certification. It hires a rotating set of outside security assessors, shares those reports with customers on request, and says it will be open about any security issue and its impact. A probe on 23 August 2026 found no trust or security subdomain on thinkst.com or canary.tools, with a random control subdomain also failing to resolve, and canary.tools/trust rendering a not-found page. The strings SOC 2, ISO 27001 and FedRAMP appear nowhere in the rendered vendor pages, so a buyer looking for a named attestation on Thinkst's own pages finds none.

The architecture concentrates a specific risk that Thinkst addresses directly. Canaries hold no valuable data and send only alert content to the customer's own console, which the company presents as a selling point against appliances that export telemetry. A rival vendor's comparison page argues that European buyers subject to NIS2 or DORA should clarify data location contractually, since each customer's console runs on AWS.

Thinkst Canary is a point product that feeds the customer's existing stack rather than a platform others build on. It pushes alerts outward into email, Slack, webhooks and Syslog, and it supports hardware, the major hypervisors and the large cloud providers, so it fits whatever infrastructure a customer already runs. In April 2026 Thinkst added an integration that brings Canary incidents into Google Security Operations as cases.

The open tier is the closest thing to an ecosystem. Canarytokens and OpenCanary seed the technique through the practitioner community, and OpenCanary carries roughly 3,000 stars and more than 400 forks with its last push in August 2026. Thinkst also released Package Proxy in June 2026, a Cloudflare-based supply-chain checking tool it runs internally in a stricter fork and published on GitHub. The cited record documents no marketplace or third-party business built on Thinkst.

Expansion adds coverage rather than dependency. Each additional form factor reuses the same console and detection mechanic, and the January 2026 acquisition of DeceptIQ brings in a team whose tripwires deploy through Terraform and infrastructure-as-code pipelines. Forrester framed the same point from the buyer side in 2019, arguing deception is best acquired folded into another product, which is the consolidation pressure a standalone point tool faces.

Founder and chief executive Haroon Meer carries the team's public research record. A 2019 USENIX speaker biography states that he has contributed to several books on information security, published papers and tools, and delivered research, talks and keynotes at conferences around the world over almost two decades. Thinkst itself claims over two decades of published research and runs the vendor-neutral ThinkstScapes reporting service.

The team stays small and engineering-heavy. TechCrunch reported about 40 employees in May 2025, mostly developers and engineers, and quoted Meer saying the company is not artificially holding back growth while avoiding growth-at-all-costs spending. Forrester separately described Thinkst as having a unique offering in the market while noting it was not a client.

January 2026 brought a second team in by acquisition. Thinkst announced that it had concluded a deal to acquire 100 percent of UK-based DeceptIQ, describing it as built by red-teamers, and SecurityWeek listed the deal in its January 2026 cybersecurity acquisitions roundup, and DeceptIQ's own site states that its team and work continue at Thinkst. The cited record does not connect the founder's research standing to purchases or to retention, so the research record and the commercial record stand as separate facts.