Pointless Sunday InfoSec hot-take: One of the biggest, unsolved problems in infosec, is our incarnation of the Dunning–Kruger effect. This grows worse over time, because: - years in the industry ≠ skill; - this take is easily mistaken for gatekeeping.

"founder culture" is rife with perverse incentives which make "flipping the company" the goal rather than building something of lasting value. Looks like @haroonmeer.canary.love and I agree blog.thinkst.com/2026/03/rsac...

You can grab the latest copy of our quarterly security research roundup at thinkst.com/ts ¹ For this issue, we selected work from over 1,370 talks & 1,200 blog posts. Available as PDF, ePUB (or audio highlights) __ ¹ As always, completely free

The best thing about Canaries & Canarytokens, is when they surprise you: "printed some and put them round the office" "but then they were put into the bin, and at 21:43 someone scanned them… looks like this place has dumpster divers" "never thought that was still a thing"

these guys. always full of adorable surprises. love @thinkstcanary.canary.tools 💚 cc @haroonmeer.canary.love

You can grab our Q3-2025 issue of ThinkstScapes at thinkst.com/ts For this issue, we tracked over 1,500 talks/papers, and almost 1,300 security blog posts. As always, available in PDF, ePub or a brief audio summary. (As always: completely free).

You can catch our @haroonmeer.canary.love on this weeks episode of Risky Business complaining about security vendors approach to security. It's worth a listen. risky.biz/RB814/

Risky Business #814 -- It's a bad time to be a scam compound operator - Risky Business Media

In this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:* The KK Park scam compound in Myanmar [Read More]

risky.biz

This quarter we announced two new platforms for Canary: Oracle Cloud Infra. (OCI) & Nutanix. Our v1 was a hardware device, but today, Canary also runs on - GCP, - AWS, - VMware, - Azure, - Docker, - Tailscale, - OCI, - Nutanix. Still dead simple. Still "just works!"

Startup Idea: A safe way for CEO's to request staff members to acquire gift-cards...

I honestly don’t mind if Trump gets a Nobel for stopping the slaughter in Gaza. We’ve destroyed so many other post-war global institutions over this insanity, one more won’t hurt 🤷‍♂️

Canary tokens are incredible, bravo @thinkstcanary.canary.tools

Leighton & Sharukh just snuck a quick update into canarytokens.org to allow you to easily manage all the tokens you've previously created. Still just $0.00 Still one of the best things you can do to detect attackers before they dig in...

It’s so disingenuous to keep pushing Palestinian liberation further down the the road.. The “doing X now only hampers long term success” argument can’t be used after decades of failure.. We’ve tried the alternative - let’s try ending the occupation?

Rome takes their FLOSS licenses seriously..

Today we released our new (free) AWS Infrastructure Canarytoken on canarytokens.org. It catches attackers in your AWS account by putting tempting assets in their way and alerting you if they get probed. (1 of 3)

This talk by Ollie Whitehouse is worth watching for Cybersecurity vendors, startups and purchasers. 0 hype, with a bunch of plain-talk current and future challenges (and opportunities). Vendors: do better.. Buyers: demand better.. youtu.be/UVNMozEgYtY?...

The Wicked Problems and Opportunities of Cyber - Ollie Whitehouse

YouTube video by BSides Bournemouth

youtu.be

Most of the company is in CapeTown this week for our annual ThinkstCon. This means lots of green stuff, and lots of padel. 💪💚

It's our birthday, so we created a tiny skunk(worksy) game for you to play.. Complete all 7 continents, and we will send you a limited-edition, 10-year t-shirt. Have fun!! (but watch out for the Canaries) canary.tools/10-year

In April this year, @grafana.bsky.social had a security incident due to an insecure GitHub Action. The attackers even tried covering their tracks. How were they discovered? Canarytokens.. Check out their post¹ on how they use our tokens at scale.. __ ¹ grafana.com/blog/2025/08...

Canary tokens: Learn all about the unsung heroes of security at Grafana Labs | Grafana Labs

Learn why the use of canary tokens let us spot a recent intrusion and swarm quickly in response, and find out why you should be using canary tokens to prevent serious security incidents in the future.

grafana.com

How do you know you're compromised? Read my newest article to see how we used canary tokens to detect an attack on our infrastructure. grafana.com/blog/2025/08...

Canary tokens: Learn all about the unsung heroes of security at Grafana Labs | Grafana Labs

Learn why the use of canary tokens let us spot a recent intrusion and swarm quickly in response, and find out why you should be using canary tokens to prevent serious security incidents in the future.

grafana.com

I know academic papers usually prefer to do vendor neutral studies, but it would be fun to see an empirical study of security-vendor-X through the ages. “Rarely is the question asked: Is our c̵h̵i̵l̵d̵r̵e̵n̵ vendors learning?”

At BlackHat this year we paid a student to walk the business hall (for both days) to collect as much swag as possible. We wondered if we would learn anything useful from it. Prelim. findings are not particularly interesting 🤷‍♂️

-=[ PHRACK PROPHILE ON Gera ]=- phrack.org/issues/72/2#... That’s the whole post…

"We had good success with your canaries at ..." "I would like to intro my (new) team at ...." 10 years in && we still do 0 outbound sales. We've had the best customers since day-1! 💪💚

I thought Ezra Klein came across badly when he & Ta-Nehisi talked Israel/Palestine¹ - but he did the same discussing “Genocide” with Phillipe Sands². Sands: it’s not complex, splitting hairs is a distraction Klein: let’s split some hairs __ ¹ youtu.be/Tg77CiqQSYk?... ² youtu.be/RrhBypHFYPY?...

Ta-Nehisi Coates on Israel: ‘I Felt Lied To.’

YouTube video by The Ezra Klein Show

youtu.be

A friendly reminder from your Canary Console that if you are in the Northern Hemisphere, you can probably check out the Perseid meteor shower this week.. 💪💚💫

BlackHat boothing was great. We got to hang-out with customers & chat Canary with a bunch of new folks.. Our booth has changed, our tech has levelled up (by orders of magnitude) but it's the same price¹ as always, & still "just works!" __ ¹ Still never increased prices since year-1

1) I totally think that LLMs are amazing; 2) The BlackHat showroom floor was embarrassingly covered in AI/Agentic/*

So long Vegas. Was leet meeting customers and old friends, but I’m out early.