Canaries In The Wild

About Canaries In The Wild

Conversations with security leaders and practitioners about their real-world experience of canaries and honeypots. Our guests share tactics, detection stories, and lessons learned from production deployments - ranging from technical details to the role deception plays in their defensive strategy, we explore the reality of 'canaries in the wild'. From the team at Tracebit.

Publisher

Tracebit

Category

technology

Language

en

Explicit

No

First episode

7 Sept 2025

Latest episode

28 Oct 2026

Latest episodes

8 episodes in the feed.

1. 

   28 Oct 2026

   Tracebit Artifacts: Canary Files That Show Attackers' Intent

   Tracebit CEO Andy Smith and Founding Engineer Ed Jones, tech lead on the project, walk through the launch of Tracebit Artifacts. Deception vendors have offered decoy documents for years, usually as fixed templates that fire when someone opens them. Artifacts work differently. Each one is a realistic file built for your organisation, with unique canary credentials inside: AWS keys, SSH keys, GitLab logins, session cookies or data room links. An alert only fires when someone uses those credentials, so you see real intent and get far fewer false positives. In this video: An S3 bucket canary with a decoy Terraform state file. The alert shows someone downloading it and trying the AWS keys inside. Encrypted zips on endpoints. Use the encryption strength to tune how sensitive the bait is, and trace any alert back to the device it came from. A board paper in Google Drive with a resolved comment hiding a “data room” link. A Salesforce support ticket with a HAR file holding canary session cookies, inspired by recent Salesforce breaches. Perimeter sensors and canary cookies, the building blocks underneath Artifacts. Building your own templates with an AI agent through the Tracebit MCP server. Learn more: https://tracebit.com/blog/introducing... (https://www.youtube.com/redirect?event=video_description&redir_token=QUlxb01IWmNLb1p2cDdxdDI5Z0dVLTdUSFlzYnxBSTVJdTV0Q2dsWTB4MFhyZDJZbE9YUklVbjY3eHpBOTFHRlEtTVVzT2JyUXllRDdJUERycWg3VVA1Vm9zWFh0cDF4N3ZyeTFqeTRVbTVoZEZFX3VfM09vRnc5TzVzVm8tTVBV&q=https%3A%2F%2Ftracebit.com%2Fblog%2Fintroducing-artifacts&v=SPfH5oa2tBY) Chapters 00:00 (https://www.youtube.com/watch?v=SPfH5oa2tBY) Intro 00:28 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=28s) What is a Tracebit Artifact? 02:10 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=130s) Use case: S3 canaries and a decoy Terraform state file 05:23 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=323s) Going beyond pre-built templates 06:11 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=371s) Encrypted files and tuning sensitivity 08:01 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=481s) Building block: perimeter sensors and canary cookies 11:27 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=687s) Use case: endpoints, with SSH and GitLab creds in an encrypted zip 15:20 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=920s) Building templates with AI and the Tracebit MCP server 17:32 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=1052s) Matching your organisation’s own documents 18:05 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=1085s) Use case: a Google Drive board paper with a hidden data room link 21:13 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=1273s) Use case: Salesforce support tickets and HAR files 26:12 (https://www.youtube.com/watch?v=SPfH5oa2tBY&t=1572s) Deployment and wrap-up

2. 

   25 Jul 2026

   Webinar: Context Bombs - stopping AI Attackers in their Tracks

   What if you could turn prompt injection into a defence? Tracebit's latest research shows how a single "context bomb" - a short string planted in a canary secret - can hijack an attacking AI agent's own safety guardrails and stop it in its tracks. Across 152 attack runs in an AWS cyber range, one context bomb cut full compromise from 36% of runs to 1%, and dropped admin privilege escalation from 57% to 5%. Hear Tracebit's Alessandro Brucato (Security Researcher) and Sam Cox (Co-founder & CTO), alongside Gadi Evron (CEO & Founder, Knostic), walk through the research and take audience questions on what defensive prompt injection means for the future of AI-driven attacks. 📄 Read the full research: https://agentic.tracebit.com/context-bombs/

3. 

   9 Jul 2026

   Ollie Whitehouse: Building a National Cyber Defence Programme

   Our latest episode features Ollie Whitehouse, CTO of the UK's National Cyber Security Centre (NCSC), the security mission of GCHQ. Ollie has spent over 23 years working with deception – from running personal honeypots in 2002, through catching state adversaries and a criminal zero-day at a previous employer, to leading NCSC's national-scale cyber deception programme today. He brings a perspective that spans hobbyist, vendor, practitioner, and national policymaker. In this episode, Ollie shares stories from the front line of deception, makes the case for why it's one of the very few asymmetric tools available to defenders, walks through NCSC's national programme, and explores how AI is reshaping both attacker tradecraft and defender tooling.

4. 

   26 Jun 2026

   Webinar: AI Agents vs. Canaries - Detecting Attacks That Move at AI Speed

   Can deception slow down autonomous AI attackers? We ran the experiment to find out. Tracebit's Sam Cox (CTO & Co-Founder) and security researcher Alessandro Brucato sit down with Nick Reva, who leads security engineering at DoorDash, to walk through new research on using canaries against autonomous AI attackers. We set 10 frontier AI models loose across 10 attack paths in an AWS environment to find out. Across 951 attack runs, AI reached admin privilege escalation in an average of 14 minutes - but canaries warned the defender before the attack landed in 95.9% of those runs, a median 8 minutes ahead of the attacker's first critical action. This session goes deeper in the findings, what they mean for defenders, and where the research goes next. What you'll learn: How fast frontier AI models really move, escalating from low-privilege access to admin Why canaries give defenders a head start Why simply warning a model that deception may be present can cut full compromise What an assume-breach detection strategy looks like when attackers operate at AI speed Read the research here: https://agentic.tracebit.com (https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa0hHdXYtYmh1Nm9UM2VUekItUDA4RWZSRXZyZ3xBQ3Jtc0tuYXozWDJiOVllcWg5TkpfVVVmSUYzRXhaT0FUS1BsR2t4eXdZQ3pvNkRXZW5YbEFReExWbVVJWnhCS1dfdm5ybW5YaGtiT1VKbmFuUTJEVEQ5OXZ3bmlKVzllRDRlX3ROb0RvakY0VTlSTEQ5d3VBQQ&q=https%3A%2F%2Fagentic.tracebit.com%2F&v=ThS5O3jlgPw)

5. 

   10 Feb 2026

   Kevin Conley - Thinking Like an Attacker and the Psychological Power of Deception

   Our latest episode features Kevin Conley, Team Lead and Principal Security Engineer of the Deception Technology team at Riot Games, who has built their canary program from the ground up over the past few years. Kevin has spent years deploying and running deception at massive scale - protecting one of the world's largest gaming platforms with hundreds of millions of players. He brings practical experience from building the program and operating it day-to-day. In this episode, Kevin breaks down why thinking like an attacker is fundamental to effective canary placement, how to measure deception program success, and the psychological impact of deception on attackers. Timestamps: 00:00 Intro 01:32 Defining terms: canaries, decoys, honeypots, and deception 03:40 Kevin's journey to leading deception at Riot Games 05:40 Adopting an attacker's perspective: the fundamental mindset shift 07:46 Why benign positives validate your canary placement 08:50 Catching malicious activity and discovering unexpected environment usage 15:06 Measuring success: coverage and validation 17:59 Blind red team exercises and attacker awareness 20:02 The psychological power of deception on attackers 24:29 Catching attackers early in the attack chain 25:51 The ROI case: deploying where traditional tools can't reach 29:57 What to communicate internally about your deception program 38:35 Why the honeypots misconception hurts deception teams 39:46 Making the case: why every security team should use canaries 41:48 When to adopt deception in your security journey 43:58 The future of deception: redefining it as active defense 46:47 Closing

6. 

   18 Nov 2025

   Mandy Andress: Assume Breach, High Fidelity Alerts and Guardrails for AI Agents

   Andy sits down with Mandy Andress (CISO, Elastic) who has been working with deception technology since the early days of honeypots and honeynets. Mandy brings a CISO's perspective on why canaries deserve a much larger role in modern security programs, and shares her views on how the fundamentals of detection are shifting as environments become more complex and threats evolve. Timestamps: 00:00 Intro 02:05 Honeypots vs canaries—different objectives, different priorities 05:22 Why assume breach is foundational in modern security 10:45 High fidelity alerts: reducing time to investigation 15:50 Practical canary deployments—S3 buckets, file shares, and cloud accounts 18:30 No-code vulnerabilities and the coming security challenges 19:55 AI agents going rogue—using canaries as guardrails 22:11 What to communicate internally about your canary program 26:16 Best advice: just get started—it's simpler than you think (edited)

7. 

   13 Oct 2025

   Josh Yavor: High Signal, Low Noise - The Case for Early Canary Deception

   Andy sits down with Josh Yavor (CEO, Credible Security) to discuss his experience of a decade of deploying deception technology. From building complex malware analysis environments to protecting sensitive IP during third-party data sharing, Josh explains why canaries deliver high-value signals early in your security journey and shares creative use cases including using canaries during active incident response. ================= 🔍 IN THIS EPISODE ================= 🪶 Why deception isn’t just for “mature” security programs 📡 Real signals vs. industry reports — what matters more 🔇 Why absence of alerts doesn’t mean absence of value 💡 Creative deployments — from protecting IP to incident response 🧭 Lessons from a decade of making deception work in the real world ============================================================ 00:00 Intro 02:05 Why deception isn’t just for mature programs 06:40 Real signals vs. industry reports 10:20 “If it doesn’t fire, is it working?” — why absence of signal doesn’t mean absence of value 15:50 Creative deployments — canaries for IP protection & incident response 22:10 Lessons from a decade of deception

8. 

   7 Sept 2025

   Didier Vandenbroeck: Catching Red Teams, Insider Threat and the ROI of Canaries

   Andy sits down with Didier Vanderbroeck (VP Security & IT, Oleria) to discuss the value he's seen from canaries as a detection mechanism over a 25 year career in security. Ranging from getting caught by Salesforce's honeypots while running red-teaming post-Slack acquisition, to what AI means for the future of deception technology; Didier shares his insights on what it means to Assume Breach with canaries.

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Spotify

5.0 / 5

1 ratings

Contact Canaries In The Wild

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.