Silent tripwires for the intruder who is already inside.
A canary is a decoy that does nothing. It sits on a file share, in a directory, behind a URL, and it stays completely silent for as long as nobody who shouldn’t be there touches it. That is the whole design. It produces no dashboard, no daily digest and no score — you hear from a canary exactly once, and when you do, something is wrong.
Why a detection nobody can tune is worth more than one they can.
Every other detection you own is a judgement call about normal behavior, and every judgement call generates false positives, and every false positive costs an analyst attention they do not have. Deception inverts the problem. There is no legitimate reason for anyone in your organization to open a decoy file, use a decoy credential or resolve a decoy hostname — so the signal does not need to be tuned, weighted or believed. It only needs to have happened.
Four steps, and no clock printed on any of them.
This page used to promise a one-hour response. We removed it.
It read well. It was also the single most breakable sentence on this website: a response-time commitment, published to the open internet, for a service that is not self-serve, by a company with zero• customers on the platform today. An SLA is an operational promise that has to survive a holiday weekend, a staffing gap and three simultaneous incidents — and one you have never had to keep is not a commitment, it is a hope with a number on it.
So the number is gone, and it stays gone until we have earned the right to print it. When we can support a response-time commitment we will publish it as a claim in the ledger, with the scope it was measured in, like every other number here. Until then: canaries are escalated as high-confidence detections and a human works them. That is what we can say, so that is what we say.
Don’t trust us. Check us.
A managed engagement, not a product you switch on.
Deception only works if the decoys are placed where that specific attacker would actually look, in that specific environment — which is a judgement about your file shares, your naming conventions, your cloud identities and your internal sites. There is no self-serve version of that judgement, and we are not going to pretend there is by putting a signup button on it.
- We design the placement. Which decoys, where, and named to fit your environment rather than a template — a canary that looks generated is a canary an experienced intruder walks past.
- We deploy and tune them. Including the boring, essential part: making sure your own staff and your own automation never touch one, so the signal stays clean.
- We monitor them. Trips land in Argos Red, not in an inbox rule, and a person works them.
- Availability and scope are confirmed during onboarding. Coverage depends on your environment — what we can place, where, and how many. We will tell you that in writing before you buy anything.
Prevention keeps most attackers out. Deception catches the one who got in.
Firewalls, EDR and phish-resistant MFA are the front door and they are not optional. Deception is the layer that assumes a determined attacker eventually gets past something, and makes sure they cannot take a single step inside without standing on a tripwire. It is one of the highest-signal, lowest-noise detections in security, and it is the difference between “we would probably notice” and “we would know.”
Talk to us about canaries.
Tell us what your environment looks like and we will tell you where decoys belong in it — and where they would be theater. Deployed, tuned and monitored by our team, with scope confirmed before anything is placed.