A Quiet Milestone for Digital Tripwires
Haroon Meer rejoined the Changelog to talk about the company he has run for more than ten years without a single outbound salesperson. Thinkst, the maker of Canary and Canarytokens, has now crossed $22.5 million in annual recurring revenue. The firm still employs roughly fifty people, has never raised venture capital, and has not raised prices in a decade.
Tokens Attackers Cannot Resist
The conversation centers on the tripwires themselves. An AWS API key token is almost irresistible to an intruder who finds it. A real credit-card token, backed by an actual bank partnership, triggers the moment someone tries to charge it. The newest feature, Breadcrumbs, deliberately leaves a trail that leads an attacker straight to a canary so the defenders get the alert earlier.
Meer demonstrated a hardware Canary that can morph into a Synology NAS with a single click. The device sits on the network looking like ordinary infrastructure until someone touches it. Then the alert fires.
Product Over Pipeline
Thinkst’s growth model remains unusual. There is no sales team chasing quotas. Customers find the product, deploy a handful of canaries, and stay because the false-positive rate stays near zero. The free Canarytokens service continues to feed the paid hardware and SaaS offering. Meer attributes the longevity to relentless focus on the product rather than growth hacks or marketing spend.
The episode is a rare look at a profitable, bootstrapped security company that treats detection as a quiet, reliable signal instead of another noisy dashboard.