DeceptIQ is now part of @ThinkstCanary. One mission, one team: make defenders win and attackers bleed.

At BlackHat, and want to talk about detection that “just works” ? Pop by our booth (2767) and find out why some of the best security teams in the world run @ThinkstCanary

Attackers have inserted policy-violating text into malware to trip up agent-based analysis. Defenders can use this too. Enable "Guardrail Triggers" when creating Word & Excel tokens on (free) canarytokens.org - your tokens will cause agents to bail. Take it for a spin.

The World Cup kicks off this Thursday. Now, you can support your team _while_ detecting badness on your network! 💪💚⚽️

💪💚

At #RSAC this year? Swing by our booth (N-6445) to talk about detection that works (and why small details matter).

It’s no secret that adversaries love (ab)using security tooling . So.. @rad9800 just shipped our latest Canarytoken to exploit this: a CrowdStrike API Key Canarytoken! Attackers who find it, have to use it - and when they do, they expose themselves. blog.thinkst.com/2026/02/int…

You can grab the latest copy of our quarterly security research roundup at thinkst.com/ts¹ For this issue, we selected work from over 1,370 talks & 1,200 blog posts. Available as PDF, ePUB (or audio highlights) __ ¹ As always, completely free

Last week we acquired UK-based DeceptIQ. DeceptIQ (@deceptiq_) is built by red-teamers with a deep desire to turn the tables on attackers. In our ten years of doing Canary, we’ve never seen such a strong natural alignment. We are super excited to help defenders win, together.

Driven by our "smell test" as former Red Teamers, we built out a suite of honeytokens. In the process we developed a framework/methodology to evaluate "what makes a token good". deceptiq.com/blog/whats-in-a…

Deploying honey tokens is an asymmetric bet. And it's easier than you to think to get started with eWHTs (early-warning honey tokens). deceptiq.com/blog/getting-st… And once you've read that - check out our free tier and start deploying tokens in minutes! starter.deceptiq.com/

Both physical & container/cloud network sensors shipping on @deceptiq_ this quarter! Two physical sensors on my home network, connected and configured within minutes. - 40 interactive/attractive services (SMB/RDP/etc) - everything layer 2+ emulated - number of builtin configs

When behaviour shifts - and in adversarial systems, it always shifts - the prediction breaks. Signatures match nothing. Intelligence describes last quarter's campaign and TTPs. Here's our thought leadership on pre-emptive detection without prediction deceptiq.com/blog/pre-emptiv…

Registry persistence is well-documented - and unsurprisingly well-detected. We explore a lesser-known technique for arbitrary registry writes against HKCU at medium integrity - without triggering registry callbacks. And in turn those detections. deceptiq.com/blog/ntuser-man…

Been watching @rad9800 work on this for a while and it is very impressive what has been achieved. If early adversary detection matters to you, keep this on your radar. I know first-hand that this would catch many people out on ops👀

We are Red Teamers. We know the problem. And that starts with understanding initial access is rarely the end goal. Here's how we fix it. deceptiq.com/

EDR catches malware. NDR catches network anomalies. But modern adversaries are caught by neither. They log in with valid credentials and enumerate your cloud and identity infrastructure for weeks. The post-compromise gap is where mature adversaries operate - and where your tools see nothing. On red team engagements, we called it "Read Teaming" - because that's what we did. Run AzureHound. Search Confluence for "password". Find credentials in runbooks. Pivot to crown jewels. Every step looks like normal user behavior. We succeeded against enterprises because there was nothing malicious to detect. Scattered Spider, ShinyHunters, APT29 - they all run the same playbook. It works because it exploits a gap in detection coverage. Full breakdown: deceptiq.com/blog/post-compr…

New: Referral program for DeceptIQ Starter - Share your unique link - Friend signs up & creates a token - You get +50% bonus on all token limits Stack referrals for unlimited growth. Starter tier just got more generous. starter.deceptiq.com

It recently came to our attention that even with well-informed individuals we struggled to communicate effectively due to a lack of basic vocabulary for deception. Not the reader's fault, more so the industry's as a whole. deceptiq.com/blog/deception-…