CISO Tribune

Vendor comparison · 2 companies

Thinkst vs Thinkst Canary

Thinkst sells Thinkst Canary, a marker of compromise that can be deployed on complex networks. Thinkst Canary says most companies discover a breach way too late. CISO Tribune files both under Deception technology. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Thinkst
  • Thinkst Canary
Thinkst vs Thinkst Canary: Products, Customers and Funding Compared
ThinkstThinkst sells Thinkst Canary, a marker of compromise that can be deployed on complex networks.thinkst.comThinkst CanaryThinkst Canary says most companies discover a breach way too late.canary.tools
What it sells
  • Thinkst Canary[1][2][3][4]A marker of compromise that can be deployed on complex networks.
  • Canarytokens[1][2][3][5]Free tokens that show defenders a breach by having attackers announce themselves.
  • OpenCanary[1][2]A daemon that runs canary services, which trigger alerts when used.
  • ThinkstScapes[1][2][3]Vendor neutral reports on key events and research findings.
  • Package Proxy[3][6]Thinkst's internal solution to the software supplychainpocalypse.
  • Thinkst Canary[2][3][4]Hardware, virtual or cloud-based Canaries deployed throughout a network. Each hosts realistic services and looks and acts like its namesake.
  • Canarytokens[2][3]Tripwires deployed across a network, from fake AWS-API keys to misleading Word docs.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • June 5, 2026Thinkst released Package Proxy, a Cloudflare-based tool running in-line supply-chain checks for npm, pip, uv and cargo packages.[6]
Not stated on its pages
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Thinkst writes about network breaches at organisations ranging from mega-corps to governments. Thinkst writes that most companies find out too late that they have been breached. Thinkst points to over-worked admins and ignored alerts at organisations that have invested in security. Thinkst offers Canarytokens free to defenders who need to discover they have been breached.Not written yet
Last verified
November 6, 2026November 5, 2026

Where they overlap

  • Deception technology is the primary category of both Thinkst and Thinkst Canary.

Where they differ, field by field

  • Thinkst lists Thinkst Canary, Canarytokens, OpenCanary, ThinkstScapes and Package Proxy. Thinkst Canary lists Thinkst Canary and Canarytokens.

How they differ

CISO Tribune files both Thinkst and Thinkst Canary under Deception technology as the primary category. Thinkst sells Thinkst Canary, a marker of compromise for complex networks, along with free Canarytokens, the OpenCanary daemon, ThinkstScapes reports and Package Proxy. Thinkst Canary lists Thinkst Canary and Canarytokens as its products, describing Canaries as hardware, virtual or cloud-based devices deployed throughout a network. Thinkst Canary says Canarytokens and OpenCanary are its open source projects.

On the Thinkst side, Canarytokens are described as free, and Thinkst says the service has supported AWS API keys since 2017. On the Thinkst Canary side, Canarytokens are tripwires that range from fake AWS-API keys to misleading Word docs, and they alert the customer once touched. Thinkst Canary says Canaries can be set up as a Windows file server, a router, or Linux web servers. Thinkst lists a Google Security Operations SOAR integration for Thinkst Canary, where incidents can be ingested as cases. Thinkst Canary says alerts go out by email, text message, Slack notification, webhook or Syslog.

Thinkst released Package Proxy on June 5, 2026, a Cloudflare-based tool running in-line supply-chain checks for npm, pip, uv and cargo packages. Thinkst also concluded a deal to acquire 100% of UK-based DeceptIQ. Thinkst says its products are deployed on all 7 continents. Thinkst Canary says it performs full Console backups hourly and typically makes three or four planned releases per year.

What it sells: Thinkst

What Thinkst Canary does[1][2][3][4]
Thinkst Canary is a marker of compromise that can be deployed on complex networks. Thinkst Canary integrates with Google Security Operations SOAR, where Canary incidents can be ingested as cases and analysts can review alert and event context.
What Canarytokens does[1][2][3][5]
Canarytokens are free, and they show defenders a breach by having attackers announce themselves. The free Canarytokens service has supported AWS API keys since 2017. Decoy API keys can be placed in code repos, Lambda configurations and virtual machine disks, and an alert goes to a mailbox when attackers use the credentials.
What OpenCanary does[1][2]
OpenCanary is a daemon that runs canary services, which trigger alerts when used. OpenCanary alerts can be sent to Syslog, emails and a companion daemon named OpenCanary-correlator. Open Canary is maintained by Thinkst Canary.

What it sells: Thinkst Canary

What Thinkst Canary does[2][3][4]
Canaries are hardware, virtual or cloud-based devices deployed throughout a network. Canaries can be set up as a Windows file server, as a router, or as Linux web servers. When an attacker encounters a Thinkst Canary, the Canary notifies the customer of the incident.
What Canarytokens does[2][3]
Canarytokens are tripwires that customers can deploy across a network, from fake AWS-API keys to misleading Word docs. Once a Canarytoken is interacted with, it alerts the customer through preferred channels.

Questions about Thinkst and Thinkst Canary

What do Thinkst and Thinkst Canary sell?
Thinkst sells Thinkst Canary, Canarytokens, OpenCanary, ThinkstScapes and Package Proxy. Thinkst Canary sells Thinkst Canary and Canarytokens.
Are Thinkst and Thinkst Canary in the same category?
Yes. Deception technology is the primary category of both on CISO Tribune.
Who are Thinkst and Thinkst Canary sold to?
From its own pages, Thinkst writes about network breaches at organisations ranging from mega-corps to governments.
What have Thinkst and Thinkst Canary announced recently?
June 5, 2026: Thinkst released Package Proxy, a Cloudflare-based tool running in-line supply-chain checks for npm, pip, uv and cargo packages.

About Thinkst

Thinkst sells Thinkst Canary, a marker of compromise that can be deployed on complex networks. Thinkst says most companies find out too late that they have been breached. Thinkst says that even with millions of dollars invested in security, over-worked admins and ignored alerts do little to help. Thinkst says network breaches happen, from mega-corps to governments. Thinkst says the inexcusable part is only finding out about a breach months or years later.[1][2]

Thinkst says its products are deployed on all 7 continents. Thinkst has over two decades of published research presented around the world. Thinkst states that it exists to work on difficult problems and to solve them. Thinkst describes ten years of doing Canary. Thinkst concluded a deal to acquire 100% of UK-based DeceptIQ. Thinkst says DeceptIQ is built by red-teamers who want to turn the tables on attackers.[2]

Thinkst Canary sends SMS alerts, which Thinkst cannot update with new information the way it can on other channels. Thinkst Canary alerts can be sent via Syslog or webhooks. Thinkst Canary integrates with Google Security Operations SOAR. Thinkst Canary incidents can be ingested into Google SecOps SOAR as cases, where analysts can review alert and event context. Analysts can acknowledge Canary incidents in Google SecOps SOAR when the work is done.[4]

Thinkst describes Canarytokens as a breach detection tool. Canarytokens are free, and they show defenders a breach by having attackers announce themselves. Thinkst says its free Canarytokens service has supported AWS API keys since 2017. Thinkst describes placing decoy API keys in code repos, Lambda configurations and virtual machine disks, with an alert sent to a mailbox when attackers use the credentials. Thinkst released a new MCP server token to detect agentic attackers riffling through systems.[2]

OpenCanary is a daemon that runs canary services, which trigger alerts when used. OpenCanary alerts can be sent to Syslog, emails and a companion daemon named OpenCanary-correlator. Open Canary is maintained by Thinkst Canary.[1][2]

ThinkstScapes readers receive vendor neutral reports on key events and research findings as they occur, with context, commentary and guidance. Thinkst describes information security as littered with noise and breaking news. Thinkst released Package Proxy, which it calls its internal solution to the software supplychainpocalypse. Thinkst writes that agents behind AI powered agentic attacks are particularly suggestible, which allows Thinkst to both detect and derail them.[1][2]

Thinkst staff attended the 28th USENIX Security Symposium in Santa Clara. Haroon gave an invited talk at the main USENIX event, and a colleague presented at the HotSec side workshop. Haroon's USENIX talk used Canarytokens to explore how defensive teams need to embrace quicker, hackier solutions.[1][2][4][5]

Thinkst on the record

Sources

Thinkst full record

  1. [1]thinkst.comthinkst.com · undated page, accessed November 6, 2026 · Tier A
  2. [2]ThinkstThinkst · undated page, accessed November 10, 2026 · Tier A
  3. [3]Thinkst Thoughts – Writing about our experiences and research findingsThinkst · undated page, accessed November 10, 2026 · Tier A
  4. [4]New features aren't Solved Problems – Thinkst ThoughtsThinkst · published November 23, 2020 · Tier A
  5. [5]USENIX Security Symposium 2019 – Thinkst ThoughtsThinkst · published August 20, 2019 · Tier A
  6. [6]Introducing Package Proxy: supply-chain safety checks without client-side softwareThinkst · published June 5, 2026 · Tier A

Thinkst Canary full record

  1. [1]canary.toolsThinkst Canary · canary.tools · undated page, accessed November 5, 2026 · Tier A
  2. [2]Thinkst CanaryThinkst Canary · undated page, accessed November 10, 2026 · Tier A
  3. [3]Thinkst CanaryThinkst Canary · undated page, accessed November 10, 2026 · Tier A
  4. [4]Introduction | Canary API DocsThinkst Canary · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.