Thinkst Applied Research

Thinkst has steadily expanded the Canarytokens catalog and Canary device types over more than a decade, but the pace is deliberately measured rather than aggressive — the company has no outbound sales or growth-hacking motion, so feature releases track practitioner requests rather than a competitive release cadence.

A roughly 40-person team supports a global customer base across seven continents with no outbound sales force, and reports 60 percent of first-year customers still active in later years, indicating a lean but durable support and delivery model.

Thinkst Canary reportedly reached about $20 million in annual recurring revenue in 2025, roughly doubling since 2021, entirely through renewals and referrals without any venture funding — a hard growth signal for a company that has never run a traditional sales-and-marketing engine.

Deception technology is a narrow category, but Thinkst's free Canarytokens project pushed low-cost, high-fidelity breach detection into mainstream use well beyond paying customers, changing expectations for what a tripwire should cost and how easy it should be to deploy.

A triggered Canary or Canarytoken is inherently high-signal since no legitimate process should touch a decoy, and customer retention over a decade backs that up; however, there is no independent third-party evaluation (e.g., a MITRE-style test) of detection efficacy specific to deception products, so this rests on vendor-reported retention rather than external benchmarking.

Assume-breach detection remains a standard recommendation in modern security programs, and low-false-positive tripwires like Canary and Canarytokens fill a specific, still-relevant gap alongside EDR and SIEM rather than competing with them directly.