Thinkst Applied Research (Pty) Ltd is a cybersecurity company focused on early breach detection through deception. Its Thinkst Canary platform places realistic decoys and digital tripwires across internal networks so defenders can spot intruders when they probe, authenticate to, or access planted assets. The company emphasizes rapid deployment, low ongoing administration, and very low false-positive noise rather than a tool that demands constant monitoring.
The commercial offering combines Hardware Canaries, Virtual Canaries, Cloud Canaries, Container Canaries, the hosted Canary Console, and unlimited Canarytokens generated through a private Canarytoken Server. Together, these components give customers a managed way to detect suspicious activity across on-premises, cloud, and containerized environments.
Offerings, Capabilities, and Integrations
Thinkst Applied Research (Pty) Ltd centers its offering on realistic system and service emulation so decoys blend into production environments instead of standing out as obvious traps. It supports physical, virtual, cloud, and container deployment patterns, and it provides options for launch-time customization, Microsoft Active Directory domain joining, and 802.1X support on supported hardware.
Operationally, it provides a hosted single-tenant console with REST API access, webhook delivery, syslog forwarding, and email/SMS alerting. Those options let teams route incidents and audit trail data into SIEM, chat, and response workflows, including platforms such as Slack, Microsoft Teams, Splunk, and Elastic.
Products and Services
- Thinkst Canary: Flagship breach-detection platform that combines decoy systems, hosted management, and token-based tripwires to surface malicious activity with minimal operational overhead.
- Hardware Canaries: Physical appliances that can be shipped preconfigured, placed on internal networks, and managed from the hosted Canary Console.
- Virtual Canaries: VM-based decoys for environments such as VMware vSphere or ESXi, Hyper-V, OpenStack, Nutanix, KVM, and related virtual infrastructure.
- Cloud Canaries: Decoy instances for AWS, Microsoft Azure, Google Cloud, and Oracle Cloud Infrastructure that are launched into customer cloud accounts and managed in the same console.
- Container Canaries: Containerized decoys for Docker and Kubernetes-oriented environments, suited to modern application and cluster deployments.
- Canary Console: Hosted management console used to configure Canaries, view incidents, manage notifications, and automate workflows through API keys, webhooks, and syslog.
- Canarytokens: Unlimited digital tripwires such as document, web, API key, VPN, QR code, and certificate tokens that alert when touched.
- Canarytoken Server: Private token service included with each console, supporting token generation as well as custom domains and landing-page configuration.
- OpenCanary: Open-source multi-protocol honeypot maintained by Thinkst Applied Research (Pty) Ltd as the open-source counterpart to its commercial Canary product.
Target Customers
Thinkst Applied Research (Pty) Ltd fits organizations that want high-confidence breach detection without building a large deception program. Its deployment patterns map well to hybrid estates spanning offices, data centers, virtual infrastructure, cloud workloads, and containers, and its decoys can be made to resemble common servers, desktops, network devices, and specialized systems.
The company is also well aligned to MSSPs and SOC-led service models. It documents both console-per-customer and shared MSSP-console approaches, with alerts flowing into customer or provider workflows through API, webhooks, syslog, email, and SMS. That makes it suitable for teams that need fast onboarding, low-touch operation, and actionable alerts they can triage quickly.
Cloud Integrations and Marketplace
- Amazon Web Services (AWS): Cloud Canaries can be enabled for specific AWS accounts and regions, then launched as shared EC2 images and managed through the Canary Console.
- Microsoft Azure: Azure Cloud Canaries use organization-specific shared VM images and launch scripts so decoys run inside customer tenants while reporting back to the Canary Console.
- Google Cloud: Google Cloud Canaries are deployed from privately shared images and launched with gcloud commands into customer projects, using the same console as the rest of the fleet.
- Oracle Cloud Infrastructure (OCI): OCI Canaries extend the same Cloud Canary model to Oracle Cloud Infrastructure and are managed alongside other Canaries from the hosted console.
Key People
- Haroon Meer: Founder
- Ross MacArthur: Senior Software Engineer
- Dev Dua: Security Engineer
- Paul Gichuki: Full-Stack Software Engineer
- Vittoria Toso: Front-End Developer
Key Facts
- Headquarters: Cape Town, Western Cape, South Africa
- Employees: Approximately 34-40 employees
- Annual Revenue: $19M-$20M ARR
- Parent Company: None
- Subsidiaries: DeceptIQ
- Publicly Listed: Privately held
