59 Canary tokens via commercial console

draft

The same canary detection bought rather than built: a commercial console (Thinkst Canary) mints Drive documents, AWS keys, Office files and DNS tokens, and maintains the alert routing for them. Tokens go one per location, so the alert identifies the breach point, and alerting lands out-of-band, outside the tenant being defended.

Caveats

Third-party cost, and a third party seeing your alerts — acceptable for canaries, not for anything carrying real content.

Setup steps

Provision the Thinkst Canary console (third-party, paid) and define the token types to deploy: Drive doc, AWS key, Office file, DNS token.

Alerting destination

out-of-band mailbox/Slack, outside the defended tenant
Deploy tokens into the Workspace surfaces you want to watch: shared drives, admin workstations, code repos.

One token per location so the alert identifies the breach point
Maintain the token register and re-deploy after any content migration that would strip or relocate tokens.

The failure mode is silent — a stripped token never fires again, and nothing tells you it is gone; the register is the only way to notice.

Ongoing maintenance

automatable: AI agent Quarterly: inventory deployed tokens against the register and replace fired ones.

How to verify

Trip one token of each deployed type and confirm the console records it and the notification arrives.

draft v0.0.1 Detect edition All (3rd-party $) policy #30 · #33 (gap G1) ↗