The archive · Product Ideas · Product decision · 2015–2021
Thinkst made honeypots deploy in minutes and bootstrapped Canary to $11M ARR
Thinkst made the painful honeypot dead-simple — decoys that alert the instant an attacker touches one — and bootstrapped Canary to $11M ARR by 2021.
Thinkst
What it had to solve
Thinkst's thesis was that companies deploying honeypots internally would discover breaches themselves, without waiting to be informed by third parties some 300 days later. Honeypots were decades old but painful to install and run, and removing that pain became Canary's north star.
How it works
Thinkst Canary launched in mid-2015 on a simple thesis: if security honeypots could be deployed inside a company's own network, the company would discover its breach itself — the moment an attacker touched a decoy — instead of being informed by third parties some 300 days later. Honeypots themselves were decades old; the problem was that they were painful to install and run. Making that pain disappear became the product's north star.
Canary was a deliberately unfashionable bet: a hardware/SaaS hybrid, bootstrapped from day one and built in South Africa by five people who never raised a dime. The first version deployed in four minutes, later versions in about half that, and the pitch made two promises — easy deployment and no alert floods. The team treated keeping those promises as the whole business, wrote gotcha-free legal documents, and let the product market itself with free Canarytokens, the open-source OpenCanary and canary.love, a page of unsolicited customer tweets the founders called their best salesperson.
By March 2021 the bet had compounded into $11M in annual recurring revenue, profitability from year one, a staff of 22 and an NPS of 80, with almost every year-one customer still on board and many spending more than ten times their original amount. The founders' retrospective on how they got there became one of that month's most-read startup posts, drawing 387 points and 217 comments on Hacker News — evidence that a low-key product company, not a press push or a funding round, was what had found its market.
Why it lands
- Deception flips the economics of detection: instead of scanning for threats you cannot name, plant decoys and let the attacker announce themselves by touching one.
- Honeypots were proven but unusable, so removing the pain — a four-minute install and a promise not to drown users in alerts — was the whole product.
- Bootstrapping plus a low burn rate let a hardware/SaaS hybrid grow patiently outside Silicon Valley, where funded competitors spent their way to press but not to customers.
- Genuine customer care created a virtuous cycle: happy customers tweeted unprompted, and a page of those tweets became the company's most effective sales tool.
What it did
By March 2021 Canary had crossed $11M in annual recurring revenue with no outside capital, was profitable from its first year and had grown to 22 people; nearly all year-one customers remained customers, and the company cited an NPS of 80. The retrospective post drew 387 points and 217 comments on Hacker News.
What you can take
The winning move in an old category is often subtraction: honeypots had decades of history, and making one that deploys in minutes and never floods users with alerts is what customers pay for.
Since then
Thinkst framed $11M ARR as fuel rather than a finish line: the founders said they would keep sweating product details, keep promises and grow Canary by making more customers happy, and would blog again at $100M ARR. The 22-person team kept normal hours while donating over a million dollars to local charities and sponsoring the open-source projects the product ran on, and later posts on the same blog — on RSA Conference and on getting AI agents to tell on themselves — show Thinkst still building tripwires that reveal intruders.
Sources
spotted an error? The archive wants to know.
Your turn
You just read one. Describe the brief you are staring at, and see who has been given the same problem.
Free account · 3 free questions · no card