Place canaries in any system that can store files, including SaaS
We're excited to launch Tracebit Artifacts, a new product for creating realistic decoy files containing canary credentials or URLs.
Artifacts supports classic canary file use cases, such as Word documents and Excel spreadsheets, and more nuanced deployments using complex file types, encryption and multiple layers of deception. You can create browser session recordings (HAR files), configuration files, encrypted files and more.
Artifacts integrate natively with Tracebit's existing deployment targets in the cloud, on workstations and in CI/CD pipelines. They also bring canaries to SaaS platforms such as Confluence and Salesforce, where you can place decoy files in shared workspaces and support tickets.
Where detection falls short
Most detection works by collecting events and applying rules, signatures or classifiers. Whether you build that yourself or buy it, someone still has to decide which combination of events means compromise. And that assumes you can get the events in the first place.
In cloud environments, on endpoints and across networks, the event data is usually there. Elsewhere, security telemetry is thin. Customer data sits in a CRM, finances in an ERP and infrastructure changes in Jira tickets, but few of these tools log activity in enough detail to spot an intruder. You can try to plug those gaps. DLP can classify sensitive data or block access, and SSPM can find misconfigurations. Neither will reliably show you an attacker exploring Salesforce with a compromised service account token, or a misaligned agent mining internal runbooks for weaknesses to exploit.
Think about what an attacker could find in your support tickets. In Okta's 2023 breach, customer support files in Salesforce contained session tokens. Attackers used them to get into customers' Okta environments.
Templates for the files attackers expect
Now, anywhere you can place a file, you can place an artifact for an intruder or malicious insider to find. We've launched templates for the files you'd find in a real environment.
- Word documents and PowerPoint decks posing as vendor memos and internal briefings.
- Excel spreadsheets posing as payroll files.
- Security assessment reports and encrypted pen test scopes.
- Plus environment files, SSH keys, encrypted files and browser session recordings (HAR files).
Tracebit alerts when someone uses a file's embedded canary credential or requests its canary URL. This can reveal an intruder exploring your systems or using information from a stolen file.
Create your own artifacts
Use your own AI agents to build realistic, customized artifacts that match what your organization already uses. Give your agent your network diagrams and a list of the self-hosted and SaaS applications you run. You can also ask it to read a threat intelligence report.
Your agent uses that context to design a custom template, then works with the Tracebit backend to validate and save it for reuse. Tracebit generates artifacts from the saved template, each with its own canary credentials and content that fits your environment. Tracebit monitors every artifact and knows where it was placed, so you get plenty of context when an alert fires.
Deploy artifacts to create layered deception
Together, Artifacts and Tracebit Perimeter Sensors provide the building blocks for layered deception.
You can deploy customized artifacts across your workforce through your existing MDM. Engineers can receive infrastructure configuration files and SSH bundles, while Finance and executives receive budget and cost files.
You can also store artifacts in Tracebit's S3 canary buckets. Tracebit already alerts when someone accesses the bucket. The file they choose gives your team context about what interested them, and its embedded canary credentials provide another opportunity for detection if used later.
An artifact tells you what they were after
Every canary is an independent detection control. It fires on its own, without relying on the logs of the system it sits in. Artifacts add something more: the intruder's intent.
Someone following a link to a data room in a resolved comment in "Board Pack - Q4 2026" shows real intent.
Seed an artifact with canary credentials and a Perimeter Sensor catches the moment someone tries to use them, long after the file has left your estate.
Join us for a discussion and demo of these best practices
Our co-founders Andy Smith and Sam Cox are hosting an online session soon. They'll cover:
- Recent research on Context Bombs, proven to slow down AI attackers
- An overview of Tracebit Artifacts and how to deploy canaries almost anywhere
- How to build and run your own deception strategy with AI agents
- A demo of securing your environment with these methods
Date and registration details are coming soon.