There is a wonderfully perverse idea at the center of Andy Smith's company: build a cloud resource that no honest person should ever need. Give it a convincing name. Make it look useful. Then wait for the wrong visitor to find it. Software generally earns its keep by being used. A security canary earns its keep when it is touched once.
Smith, the co-founder and CEO of Tracebit, has spent the past three years turning that small inversion into infrastructure. His company places decoy credentials, identities, buckets, tokens and other resources across the sprawling territory of modern computing. If an intruder moves laterally, escalates privileges or starts rummaging for secrets, the canary tells the security team. It does not need to decide whether a normal action looks slightly peculiar. There should be no normal action at all.
The premise is older than cloud computing. Honeypots have existed in cybersecurity for decades, descendants in spirit of the birds once carried underground. Yet old ideas can remain strangely exclusive. Deception programs tended to require skilled people, careful upkeep and budgets that made them practical for unusually well-resourced teams. Smith and his co-founder, Sam Cox, saw a delivery problem disguised as a category problem. What if the cloud could make the decoys cheap, realistic and refreshable? What if Terraform could do the planting?
Learning to scale, then starting at two
Before Tracebit, Smith was Head of Engineering at Tessian, the email-security company later acquired by Proofpoint. He grew its engineering organization from seven people to more than 100 through the company's Series A, B and C stages. It is a particular sort of apprenticeship: the work changes from writing and reviewing systems to designing an organization that can keep writing and reviewing them without losing its mind.
Then came the reverse journey. Smith and Cox, a former lead architect at Tessian, began Tracebit in London in 2023. Two people again, this time carrying the memory of what 100 people feels like. Their founding belief was blunt. “Assume breach” would become more important, not less. Prevention still mattered, but any useful defense had to acknowledge that a determined attacker might eventually get inside. The job was to make that arrival visible before inconvenience matured into catastrophe.
Tracebit's first large financing arrived in 2024: a $5 million seed round led by Accel, with Tapestry VC and a group of security operators and founders participating. At that point, close to 2,000 canaries had been deployed across hundreds of production accounts, including environments at Riot Games, Docker and Synthesia. The number was impressive enough for a young company, but the language around it revealed the larger aim. Canaries, once treated as a tool for the “top 1%” of security teams, should become available to everyone else.
The cloud makes a better birdcage
The mechanics are less theatrical than the metaphor. Tracebit connects to an environment with read-only access and profiles the way that environment is arranged. It recommends plausible canaries, deploys them through infrastructure-as-code and keeps adapting them as the real environment changes. The decoys can sit across AWS, Azure, GCP, Kubernetes, identity providers, developer workstations and CI/CD pipelines. They look at home because looking out of place would rather spoil the trap.
Cloud platforms also remove much of the drudgery that made traditional honeypots costly. The provider handles the operating systems and patches for many managed resources. Usage-based pricing can make an idle decoy cost pennies or nothing. Rich audit trails provide context when one is disturbed. The result is a curious piece of negative-space engineering: value comes from defining an action that should never happen, then making that action easy to see.
The canary is not asked to recognize every attacker. It asks the attacker to identify themselves.
Smith's own technical writing carries the temperament of someone who enjoys examining defaults. When the founders chose Tracebit's application stack, he expected the usual startup candidates: Python, TypeScript, Go, Rust or something on the JVM. They picked C# and .NET. He had not used Windows in more than 15 years and had no intention of deploying production systems on it. Modern .NET, however, was open-source, cross-platform, mature and inexpensive. The surprise was the point. A preference was less valuable than the criteria behind it.
Smith's public writing repeatedly turns a fashionable question into an operational one: not “Which language wins?” but “Which platform lets a small team ship safely?” Not “Are canaries clever?” but “Who refreshes them after the environment changes?”
When noise becomes signal
That willingness to reconsider a default now extends to Tracebit's central promise. The company began with low-volume, high-fidelity detection. Security teams were already exhausted by tools that produced endless alerts, many too weak or ambiguous to deserve a human investigation. A canary offered the opposite: few alarms, each with a good reason to exist.
In July 2026, Smith publicly described a growing conviction that security teams might soon want more noise, not less. His argument was not that false positives had become charming. It was that the scarce resource was moving. AI-assisted attacks create pressure to detect sooner, while AI-assisted triage could let defenders investigate ten, 100 or 1,000 times as many alerts. If human attention stops being the hard limit, a weak signal need not be thrown away. Machines can combine weak detections into a strong one.
It is an attractive correction because it does not pretend the first thesis never existed. Tracebit's instincts were to automate and scale. Those same instincts may serve a noisier future. The principle remains high-confidence response; the input can broaden because the cost of examining it is changing. Conviction, in this version of company building, is not a tattoo. It is a working hypothesis with customers.
AI also changes the creature that finds the canary. An autonomous agent can move through a cloud account at machine speed, following credentials and permissions with no need for coffee or sleep. Tracebit's 2026 research explored how leading models behaved in a live AWS environment and how deception altered their progress. The company then shipped Context Bomb Canaries, short strings embedded in decoy secrets that can trip an AI model's safety guardrails, alongside an AI Posture view meant to help distinguish a sanctioned coding agent from hostile automation.
The game is familiar and newly odd. Deception has always worked partly by imposing doubt. An attacker who knows canaries might be present still does not know which resources are false. Now the doubtful intruder may be software, and the decoy may contain language written for the intruder's own model. The canary has learned prompt engineering. Coal mines were simpler.
A founder crosses the Atlantic
Tracebit's financing and geography expanded together. In March 2026, the company announced a $20 million Series A led by FirstMark, joined by existing and new investors including Accel, MMC Ventures, Tapestry VC and CCL. Total investment reached $25 million. Smith wrote that Tracebit had deployed millions of canaries at companies including Riot Games, Snyk, Docker and Synthesia. The platform had grown beyond its original AWS environment, and the new round arrived with Perimeter Canaries, Deceptive Artifacts and GCP support.
A few months later, Smith relocated to New York. He and Cox had built the London team from two people to about 20 in person, and Smith said watching that group ramp and gel had reinforced their belief in working together physically. As US business accelerated, putting a founder at the helm of an American office felt obvious. The office opened just off Union Square, with sales hiring under way.
There is a neat symmetry in a security founder insisting on presence. Tracebit's product is about noticing when someone enters a space they should not. Its operating model is about giving colleagues a shared space they should. One detects the wrong kind of proximity; the other cultivates the right kind.
The aspiration is larger than a product category. Smith wants “assume breach” to become a default posture and the global mean time to respond to fall from months to minutes. That requires making canaries less exotic, not more: quicker to deploy, safer to operate, easier to explain and available before a security program earns some imaginary badge of maturity. Tracebit's free Community Edition, launched in late 2025, pushed the same idea toward individual developers and smaller teams.
The ambition is sober because it does not promise purity. Systems will remain complicated. Humans will make mistakes. Attackers will use automation, and defenders will answer with their own. Somewhere among the genuine buckets, tokens and identities, a fake will sit quietly. The attacker only has to be wrong once. For Smith, that is not a gloomy concession. It is the beginning of the alert.