Case study

Interview

About Coveo

Coveo brings superior AI-Relevance to every point-of-experience, transforming how enterprises connect with their customers and employees to maximize business outcomes.

Challenge

Coveo's Security Operations Center (SOC) had identified specific gaps in their detection coverage and was equally concerned about potential blind spots they hadn't yet discovered. While their team had mapped out known vulnerabilities in their security posture, they recognized that modern threats often exploit unknown or unexpected attack vectors.

The team had previously attempted to implement canary solutions to address these gaps, but existing providers only offered token generation capabilities, leaving Coveo responsible for deployment, maintenance, and visibility across their entire ecosystem. For a small, efficiency-focused team, this manual overhead was unsustainable.

"Canaries are something that we had identified as a solution to help us fill in gaps that we had," explains Cedric Brisson, Lead SOC Analyst at Coveo. "Because at Coveo we are a team that tries to be enabled by tooling rather than just growing our SOC."

Solution

Coveo partnered with Tracebit to implement a comprehensive canary infrastructure across their AWS, Azure, and Okta environments. The automated deployment eliminated the manual burden of traditional canary solutions while providing complete visibility into canary placement and interactions.

The implementation was remarkably swift - within minutes, Coveo had deployed hundreds of canaries throughout their environment using Tracebit's pre-existing deployment scripts. Unlike other providers whose canaries were easily identifiable through obvious naming conventions or API calls, Tracebit's canaries blended seamlessly into Coveo's infrastructure.

Outcome

Rapid Deployment and Low Maintenance

The deployment was rapid, with coverage across test, staging and production in a matter of minutes through leveraging the Terraform integration.

“What really stood out to me with Tracebit is how effortless it was to get value. Invoking their Terraform module is incredibly elegant—just 7 lines of HCL, and you suddenly have dozens of decoys spun up, all tailored to your environment”
‍
Jean-Philippe Lachance, Staff Security Specialist, R&D, Coveo

Uncovered Unknown Unknowns
While Coveo fortunately hasn't detected malicious activity, Tracebit has proven invaluable in identifying legitimate but unexpected behaviors within their systems. The platform highlighted unusual activities from both internal systems and external services that the security team wasn't previously aware of.

Operational Excellence
"The experience has been pretty stellar so far," notes Brisson. "We haven't had a ton of issues, which is something very rare in the cybersecurity space."

The low false positive rate means the SOC team isn't overwhelmed with irrelevant alerts, allowing them to focus on genuine anomalies. This efficiency gain directly supports Coveo's strategy of maintaining a lean but highly effective security team.

Strategic Value for Leadership
The canary deployment has provided measurable improvements in key performance indicators, including time to detect and time to remediate - metrics that resonate strongly with management. The ability to slow down potential attackers and create opportunities for response aligns with modern breach timelines where detection windows are measured in minutes, not days.

Looking Forward

"You guys are actually addressing a complex problem that needs solving.”
‍
Cedric Brisson, Lead SOC Analyst, Coveo

Coveo is particularly excited about Tracebit's Azure and Entra ID roadmap. As Cedric explains, "It is still, to many, something that is very shadowy, very complex and with an insane amount of intricacies." Having sophisticated canary coverage for these complex environments represents significant value.

The partnership continues to evolve, and the Coveo team are excited to continue to partner with Tracebit and expand their use of Tracebit across all available canary types and environments.

“All in all, it’s one of those rare tools that feels like it was built by people who deeply understand the platform and the real-world problems defenders face. A true work of art”
‍
Jean-Philippe Lachance, Staff Security Specialist, R&D, Coveo

‍