https://tracebit.comThe latest cloud security and intrusion detection research and product updates from TracebitTue, 25 Aug 2026 07:34:27 GMTTracebithttps://tracebit.com/blog/compliance-to-assurance-mapping-tracebit-iso-27001https://tracebit.com/blog/compliance-to-assurance-mapping-tracebit-iso-27001Most ISO 27001 audits come down to two questions: does the control exist, and is it actually working? Here's a detailed, bounded mapping of Tracebit's deception-based detection to the 2022 Annex A control set - 12 controls with direct evidence, plus support for 14 more.Mon, 17 Aug 2026 00:00:00 GMThttps://tracebit.com/blog/deception-openai-huggingface-agentic-breachhttps://tracebit.com/blog/deception-openai-huggingface-agentic-breachAt Black Hat, OpenAI named honey tokens and deception as a key defensive investment against offensive AI agents. We map the publicly disclosed TTPs from the OpenAI / Hugging Face incident against Tracebit deception, stage by stage.Mon, 10 Aug 2026 00:00:00 GMThttps://tracebit.com/blog/andy-smith-ai-security-podcast-deceptionhttps://tracebit.com/blog/andy-smith-ai-security-podcast-deceptionI recently joined the AI Security Podcast with Ashish Rajan and Caleb Sima to discuss what deception means in a world of AI agents. Listen now.Sat, 25 Jul 2026 00:00:00 GMThttps://tracebit.com/blog/webinar-context-bombshttps://tracebit.com/blog/webinar-context-bombsAI agents can now run complex cloud attacks on their own, escalating from a single low-privilege key to full admin within minutes. We sat down to walk through Tracebit's latest research on stopping them - watch the full recording on YouTube.Sat, 25 Jul 2026 00:00:00 GMThttps://tracebit.com/blog/context-bombs-stopping-ai-attackers-in-their-trackshttps://tracebit.com/blog/context-bombs-stopping-ai-attackers-in-their-tracksWe planted context bombs, short strings that trip an AI model's own safety guardrails, inside canary secrets in a live AWS environment. Across 5 frontier models and 152 runs, they cut successful attack paths from 91% to 15% - stopping attackers outright as well as detecting them.Mon, 13 Jul 2026 00:00:00 GMThttps://tracebit.com/blog/canaries-in-the-wild---episode-5-ollie-whitehousehttps://tracebit.com/blog/canaries-in-the-wild---episode-5-ollie-whitehouseEpisode 5 features Ollie Whitehouse, CTO of the UK's National Cyber Security Centre, on 23 years of running deception and building NCSC's national-scale cyber deception programme.Thu, 09 Jul 2026 00:00:00 GMThttps://tracebit.com/blog/webinar-ai-agents-vs-canarieshttps://tracebit.com/blog/webinar-ai-agents-vs-canariesAI agents can compromise a cloud environment in minutes. We sent ten frontier AI models to attack a live AWS cyber range - across 951 runs, AI reached admin in an average of 14 minutes, but canaries warned the defender first in 95.9% of compromising runs. Watch our team discuss the research. Now on YouTube, Spotify and Apple Podcasts.Mon, 29 Jun 2026 00:00:00 GMThttps://tracebit.com/blog/deception-vs-autonomous-ai-attackershttps://tracebit.com/blog/deception-vs-autonomous-ai-attackersWe pointed ten frontier models at a live AWS environment to see what canaries do against an autonomous attacker: how early they warn, how fast the models trip them, and what changes when the agent is told deception might be present.Mon, 01 Jun 2026 00:00:00 GMThttps://tracebit.com/blog/where-security-canaries-fit-in-nist-csf-2-0-832c2https://tracebit.com/blog/where-security-canaries-fit-in-nist-csf-2-0-832c2How Tracebit turns detection from an assumption into something you can actually prove. A practical mapping of security canaries across the six core functions of NIST CSF 2.0 - Detect, Respond, Govern, Identify, Protect, and Recover.Wed, 06 May 2026 00:00:00 GMThttps://tracebit.com/blog/deception-should-not-be-a-luxury-controlhttps://tracebit.com/blog/deception-should-not-be-a-luxury-controlHow supporting Duo Security's astronomical growth set me up to see Deception as the next 'must have' security control.Wed, 22 Apr 2026 00:00:00 GMThttps://tracebit.com/blog/detecting-cicd-supply-chain-attacks-with-canary-credentialshttps://tracebit.com/blog/detecting-cicd-supply-chain-attacks-with-canary-credentialsA single threat actor - TeamPCP - compromised a chain of widely-used open source tools: Trivy, KICS, LiteLLM, and Telnyx. This post looks at the campaign and explores the question: once you've pinned your actions and hardened your runners, what actually detects credential exfiltration from a compromised CI/CD pipeline?Thu, 02 Apr 2026 00:00:00 GMThttps://tracebit.com/blog/series-ahttps://tracebit.com/blog/series-aWe’re excited to announce our Series A investment round, led by FirstMark and joined by Accel, MMC Ventures, Tapestry VC and CCL; with continued support from our fantastic angel investors. This brings the total investment in Tracebit to $25M.Tue, 17 Mar 2026 00:00:00 GMThttps://tracebit.com/blog/do-canaries-firsthttps://tracebit.com/blog/do-canaries-firstEngineering would never accept not detecting product going down - so why does security? This post makes the case for security canaries as a day-one control for catching critical security events early.Fri, 13 Feb 2026 00:00:00 GMThttps://tracebit.com/blog/canaries-in-the-wild---episode-4-kevin-conleyhttps://tracebit.com/blog/canaries-in-the-wild---episode-4-kevin-conleyEpisode 4 features Kevin Conley, Team Lead and Principal Security Engineer of the Deception Technology team at Riot Games, who explains why thinking like an attacker is critical, how Riot measures deception program effectiveness, and the ROI case for deception.Tue, 10 Feb 2026 00:00:00 GMThttps://tracebit.com/blog/building-community-editionhttps://tracebit.com/blog/building-community-editionLast week, we launched Tracebit Community Edition. In this post, we go into the details of the method and motivation behind the release.Wed, 17 Dec 2025 00:00:00 GMThttps://tracebit.com/blog/announcing-tracebit-community-editionhttps://tracebit.com/blog/announcing-tracebit-community-editionWe're excited to announce Tracebit Community Edition, a completely free-forever platform to deploy security canaries.Thu, 04 Dec 2025 00:00:00 GMThttps://tracebit.com/blog/canaries-in-the-wild---episode-3-mandy-andresshttps://tracebit.com/blog/canaries-in-the-wild---episode-3-mandy-andressEpisode 3 features Mandy Andress, CISO at Elastic, discussing why canaries deserve a larger role in security programs and how they'll address emerging threats from no-code applications and AI agents.Tue, 18 Nov 2025 00:00:00 GMThttps://tracebit.com/blog/short-term-vs-long-term-canary-credentialshttps://tracebit.com/blog/short-term-vs-long-term-canary-credentialsI'll explore the trade-offs between long and short term canary credentials for threat detection and explain why I think short term credentials are increasingly the right choice for most deployments.Tue, 11 Nov 2025 00:00:00 GMThttps://tracebit.com/blog/canaries-in-the-wild---episode-2-josh-yavorhttps://tracebit.com/blog/canaries-in-the-wild---episode-2-josh-yavorEpisode 2 features Josh Yavor, CEO and Co-Founder of Credible Security, discussing his experiences deploying deception technology across organizations of all sizes over more than a decade.Mon, 13 Oct 2025 00:00:00 GMThttps://tracebit.com/blog/introducing-canaries-in-the-wildhttps://tracebit.com/blog/introducing-canaries-in-the-wildWe're launching Canaries in the Wild, a podcast featuring security practitioners sharing real stories about deploying deception technology. Episode 1 features Didier Vandenbroeck, VP of Security at Oleria.Tue, 09 Sep 2025 00:00:00 GMThttps://tracebit.com/blog/code-exec-deception-gemini-ai-cli-hijackhttps://tracebit.com/blog/code-exec-deception-gemini-ai-cli-hijackTracebit discovered a silent attack on Gemini CLI where, through a toxic combination of prompt injection, misleading UX and missing validation, inspecting untrusted code consistently leads to execution of malicious commands - enabling silent credential theft and much more.Mon, 28 Jul 2025 00:00:00 GMThttps://tracebit.com/blog/canaries-in-the-era-of-generative-aihttps://tracebit.com/blog/canaries-in-the-era-of-generative-aiWe explore what generative AI means for canaries, deception and honeypots. Both from an offense and defense perspective and what we're doing at Tracebit.Thu, 03 Jul 2025 00:00:00 GMThttps://tracebit.com/blog/announcing-security-canaries-in-kuberneteshttps://tracebit.com/blog/announcing-security-canaries-in-kubernetesWe're excited to share our latest canary module: Kubernetes - this is now available for all Tracebit customersMon, 14 Apr 2025 00:00:00 GMThttps://tracebit.com/blog/the-full-costs-of-building-your-own-canary-programhttps://tracebit.com/blog/the-full-costs-of-building-your-own-canary-programWe explore why there can be a bias to build canaries and what's actually involved for a successful security canary program.Thu, 27 Feb 2025 00:00:00 GMThttps://tracebit.com/blog/security-outcomes-with-canarieshttps://tracebit.com/blog/security-outcomes-with-canariesA selection of use cases to consider when deploying security canaries, considering the Security Canary Maturity Model.Tue, 25 Feb 2025 00:00:00 GMThttps://tracebit.com/blog/automated-moving-target-pre-emptive-cyber-defense-and-security-canarieshttps://tracebit.com/blog/automated-moving-target-pre-emptive-cyber-defense-and-security-canariesThe role of automated moving target defence in protection against attacks.Mon, 24 Feb 2025 00:00:00 GMThttps://tracebit.com/blog/announcing-tracebits-partnership-with-pantherhttps://tracebit.com/blog/announcing-tracebits-partnership-with-pantherWe announce Tracebit’s partnership with Panther, a leading cloud-native SIEMWed, 08 Jan 2025 00:00:00 GMThttps://tracebit.com/blog/breaching-the-data-perimeter-cloudtrail-as-a-mechanism-for-data-exfiltrationhttps://tracebit.com/blog/breaching-the-data-perimeter-cloudtrail-as-a-mechanism-for-data-exfiltrationWe share a - now fixed - AWS vulnerability that would have enabled potentially undetectable data exfiltration from even the most locked down of AWS accounts by leveraging the audit trail itself to stealthily leak data.Tue, 15 Oct 2024 00:00:00 GMThttps://tracebit.com/blog/the-security-canary-maturity-modelhttps://tracebit.com/blog/the-security-canary-maturity-modelWe lay out the different levels of maturity your organization may be at in their Security Canary Maturity, as well as discussing the value in maturity models themselves.Tue, 10 Sep 2024 00:00:00 GMThttps://tracebit.com/blog/canary-infrastructure-vs-real-world-ttpshttps://tracebit.com/blog/canary-infrastructure-vs-real-world-ttpsWe investigate three recent AWS security incidents and discuss how canaries could help you detect these early, and throughout the attack lifecycle.Tue, 13 Aug 2024 00:00:00 GMThttps://tracebit.com/blog/no-wildcard-how-i-discovered-the-organization-id-of-any-aws-accounthttps://tracebit.com/blog/no-wildcard-how-i-discovered-the-organization-id-of-any-aws-accountOur latest research into VPC Endpoint Policy causes AWS to introduce significant changes!Mon, 22 Jul 2024 00:00:00 GMThttps://tracebit.com/blog/a-hard-look-at-guardduty-shortcomingshttps://tracebit.com/blog/a-hard-look-at-guardduty-shortcomingsIs GuardDuty all you need for AWS threat detection? We’ve asked our friend Rami McCarthy to dive into GuardDuty’s performance and consider the potential place for Canary Infrastructure.Tue, 16 Jul 2024 00:00:00 GMThttps://tracebit.com/blog/announcing-our-seed-fundraisehttps://tracebit.com/blog/announcing-our-seed-fundraiseWe're delighted to announce our seed funding round, we're partnering with Accel, Tapestry VC and an incredible set of angel investors to bring Tracebit to the world.Tue, 09 Jul 2024 00:00:00 GMThttps://tracebit.com/blog/fwd-cloudsec-talk-on-s3-bucket-researchhttps://tracebit.com/blog/fwd-cloudsec-talk-on-s3-bucket-researchOur Co-Founder and CTO Sam Cox presented his research into discovering the AWS Account ID of any S3 Bucket and how you might make similar discoveries yourself.Mon, 24 Jun 2024 00:00:00 GMThttps://tracebit.com/blog/canary-program-communication-secrecy-vs-discretionhttps://tracebit.com/blog/canary-program-communication-secrecy-vs-discretionWe share the lessons learned from deploying canaries at scale - how to be thoughtful but pragmatic about some of the tradeoffs necessary.Fri, 31 May 2024 00:00:00 GMThttps://tracebit.com/blog/deploying-effective-canary-aws-credentialshttps://tracebit.com/blog/deploying-effective-canary-aws-credentialsWhat to think about when implementing canary AWS credentials in 2024 and beyondFri, 03 May 2024 00:00:00 GMThttps://tracebit.com/blog/canary-infra-bringing-honeypots-towards-general-adoptionhttps://tracebit.com/blog/canary-infra-bringing-honeypots-towards-general-adoptionLaying out why we think 'Canary Infra' is a game changer for honeypots and intrusion detection.Thu, 14 Mar 2024 00:00:00 GMThttps://tracebit.com/blog/how-to-find-the-aws-account-id-of-any-s3-buckethttps://tracebit.com/blog/how-to-find-the-aws-account-id-of-any-s3-bucketA technique to find the Account ID of a private S3 bucket.Thu, 22 Feb 2024 00:00:00 GMThttps://tracebit.com/blog/how-fast-is-cloudtrail-today-investigating-cloudtrail-delays-using-athenahttps://tracebit.com/blog/how-fast-is-cloudtrail-today-investigating-cloudtrail-delays-using-athenaInvestigating how long CloudTrail takes to deliver events in 2023.Mon, 27 Nov 2023 00:00:00 GMThttps://tracebit.com/blog/honeypots-for-intrusion-detectionhttps://tracebit.com/blog/honeypots-for-intrusion-detectionA deep dive into what Honeypots are, why they're useful and how they're used for intrusion detection.Mon, 13 Nov 2023 00:00:00 GMThttps://tracebit.com/blog/context-bomb-canaries-and-ai-posturehttps://tracebit.com/blog/context-bomb-canaries-and-ai-postureWe're shipping our AI-attacker research as product. Context Bomb Canaries for AWS stop an a malicious agent mid-attack by tripping its own guardrails, and the new AI Posture view lets you tell your sanctioned coding agents apart from an attacker's automation.Fri, 17 Jul 2026 11:31:18 GMThttps://tracebit.com/blog/introducing-perimeter-sensorshttps://tracebit.com/blog/introducing-perimeter-sensorsToday we're extending detection of an intrusion to the earliest point: the perimeter, the moment stolen access is first used. Introducing Perimeter Sensors - believable canary services on your own domain, bound to canary credentials seeded across your organisation.Thu, 02 Jul 2026 15:54:35 GMThttps://tracebit.com/blog/why-tracebit-is-written-in-c-sharphttps://tracebit.com/blog/why-tracebit-is-written-in-c-sharpA retro on some of the reasons we chose to build Tracebit in C#.Wed, 08 Apr 2026 10:26:19 GMThttps://tracebit.com/blog/announcing-azure-canaries-general-availabilityhttps://tracebit.com/blog/announcing-azure-canaries-general-availabilityTracebit announces the general availability of Tracebit Canaries for Microsoft AzureWed, 08 Apr 2026 10:26:19 GMThttps://tracebit.com/blog/azure-detection-engineering-log-idiosyncrasies-you-should-know-abouthttps://tracebit.com/blog/azure-detection-engineering-log-idiosyncrasies-you-should-know-aboutWe share a few inconsistencies found in Azure logs which make detection engineering more challenging.Tue, 10 Mar 2026 15:07:22 GMT