Conversations with security leaders and practitioners about their real-world experience of canaries and honeypots. Our guests share tactics, detection stories, and lessons learned from production deployments - ranging from technical details to the role deception plays in their defensive strategy, we explore the reality of 'canaries in the wild'. From the team at Tracebit.
Language
🇺🇲
Publishing Since
9/7/2025
Verified contact details for this show aren't on file yet — sign up to get notified when they land.
June 26, 2026
<p>Can deception slow down autonomous AI attackers? We ran the experiment to find out.</p><p>Tracebit's Sam Cox (CTO & Co-Founder) and security researcher Alessandro Brucato sit down with Nick Reva, who leads security engineering at DoorDash, to walk through new research on using canaries against autonomous AI attackers.</p><p>We set 10 frontier AI models loose across 10 attack paths in an AWS environment to find out. Across 951 attack runs, AI reached admin privilege escalation in an average of 14 minutes - but canaries warned the defender before the attack landed in 95.9% of those runs, a median 8 minutes ahead of the attacker's first critical action. This session goes deeper in the findings, what they mean for defenders, and where the research goes next.</p><p>What you'll learn:</p><ul><li>How fast frontier AI models really move, escalating from low-privilege access to admin<p></p></li><li>Why canaries give defenders a head start<p></p></li><li>Why simply warning a model that deception may be present can cut full compromise<p></p></li><li>What an assume-breach detection strategy looks like when attackers operate at AI speed<p></p></li></ul><p><br>Read the research here: <a href="https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa0hHdXYtYmh1Nm9UM2VUekItUDA4RWZSRXZyZ3xBQ3Jtc0tuYXozWDJiOVllcWg5TkpfVVVmSUYzRXhaT0FUS1BsR2t4eXdZQ3pvNkRXZW5YbEFReExWbVVJWnhCS1dfdm5ybW5YaGtiT1VKbmFuUTJEVEQ5OXZ3bmlKVzllRDRlX3ROb0RvakY0VTlSTEQ5d3VBQQ&q=https%3A%2F%2Fagentic.tracebit.com%2F&v=ThS5O3jlgPw">https://agentic.tracebit.com</a></p>
February 10, 2026
<p>Our latest episode features Kevin Conley, Team Lead and Principal Security Engineer of the Deception Technology team at Riot Games, who has built their canary program from the ground up over the past few years.</p><p>Kevin has spent years deploying and running deception at massive scale - protecting one of the world's largest gaming platforms with hundreds of millions of players. He brings practical experience from building the program and operating it day-to-day.</p><p>In this episode, Kevin breaks down why thinking like an attacker is fundamental to effective canary placement, how to measure deception program success, and the psychological impact of deception on attackers.</p><p>Timestamps:</p><p>00:00 Intro<br>01:32 Defining terms: canaries, decoys, honeypots, and deception<br>03:40 Kevin's journey to leading deception at Riot Games<br>05:40 Adopting an attacker's perspective: the fundamental mindset shift<br>07:46 Why benign positives validate your canary placement<br>08:50 Catching malicious activity and discovering unexpected environment usage<br>15:06 Measuring success: coverage and validation<br>17:59 Blind red team exercises and attacker awareness<br>20:02 The psychological power of deception on attackers<br>24:29 Catching attackers early in the attack chain<br>25:51 The ROI case: deploying where traditional tools can't reach<br>29:57 What to communicate internally about your deception program<br>38:35 Why the honeypots misconception hurts deception teams<br>39:46 Making the case: why every security team should use canaries<br>41:48 When to adopt deception in your security journey<br>43:58 The future of deception: redefining it as active defense<br>46:47 Closing </p>
November 18, 2025
<p>Andy sits down with Mandy Andress (CISO, Elastic) who has been working with deception technology since the early days of honeypots and honeynets.<br>Mandy brings a CISO's perspective on why canaries deserve a much larger role in modern security programs, and shares her views on how the fundamentals of detection are shifting as environments become more complex and threats evolve.</p><p><strong>Timestamps:</strong><br>00:00 Intro<br>02:05 Honeypots vs canaries—different objectives, different priorities<br>05:22 Why assume breach is foundational in modern security<br>10:45 High fidelity alerts: reducing time to investigation<br>15:50 Practical canary deployments—S3 buckets, file shares, and cloud accounts<br>18:30 No-code vulnerabilities and the coming security challenges<br>19:55 AI agents going rogue—using canaries as guardrails<br>22:11 What to communicate internally about your canary program<br>26:16 Best advice: just get started—it's simpler than you think (edited) </p>
Have a different question and can't find the answer you're looking for? Reach out to our support team by sending us an email and we'll get back to you as soon as we can.
Conversations with security leaders and practitioners about their real-world experience of canaries and honeypots.
Our guests share tactics, detection stories, and lessons learned from production deployments - ranging from technical details to the role deception plays in their defensive strategy, we explore the reality of 'canaries in the wild'.
From the team at Tracebit.
This podcast updates daily.
This podcast is available on 4 platforms including Apple Podcasts, Spotify, and more. You can also use the RSS feed directly.
Yes, this podcast regularly features guests.
Pod Engine is not affiliated with, endorsed by, or officially connected with any of the podcasts displayed on this platform. We operate independently as a podcast discovery and analytics service.
All podcast artwork, thumbnails, and content displayed on this page are the property of their respective owners and are protected by applicable copyright laws. This includes, but is not limited to, podcast cover art, episode artwork, show descriptions, episode titles, transcripts, audio snippets, and any other content originating from the podcast creators or their licensors.
We display this content under fair use principles and/or implied license for the purpose of podcast discovery, information, and commentary. We make no claim of ownership over any podcast content, artwork, or related materials shown on this platform. All trademarks, service marks, and trade names are the property of their respective owners.
While we strive to ensure all content usage is properly authorized, if you are a rights holder and believe your content is being used inappropriately or without proper authorization, please contact us immediately at hey@podengine.ai for prompt review and appropriate action, which may include content removal or proper attribution.
By accessing and using this platform, you acknowledge and agree to respect all applicable copyright laws and intellectual property rights of content owners. Any unauthorized reproduction, distribution, or commercial use of the content displayed on this platform is strictly prohibited.