57 Canary tokens via commercial console

The same canary detection bought rather than built: a commercial console (Thinkst Canary) mints Drive documents, AWS keys, Office files and DNS tokens, and maintains the alert routing for them. Tokens go one per location, so the alert identifies the breach point, and alerting lands out-of-band, outside the tenant being defended.

Caveats

It is the same detection as the self-hosted canary corpus (№56), bought instead of built¹
Third-party cost, and a third party seeing your alerts²
Tokens do not survive content migrations³

Setup steps

Provision the Thinkst Canary console (third-party, paid) and define the token types to deploy: Drive doc, AWS key, Office file, DNS token.

Alerting destination
out-of-band mailbox/Slack, outside the defended tenant
Deploy tokens into the Workspace surfaces you want to watch: shared drives, admin workstations, code repos.

One token per location so the alert identifies the breach point
Maintain the token register and re-deploy after any content migration that would strip or relocate tokens.

Ongoing maintenance

automatable: AI agent Quarterly: inventory deployed tokens against the register and replace fired ones.

How to verify

Trip one token of each deployed type and confirm the console records it and the notification arrives.

v0.0.1Detectedition All (3rd-party $) policy #30 · #33 (gap G1) ↗