Canarytokens generates honeytokens (URLs, files, credentials, docs) that alert you when an attacker touches them, helping detect breaches early.
3k stars410 forksBSD-3-Clauselast commit Actively maintained
2 self-hosted Thinkst Canary alternatives
Deception-based cybersecurity SaaS that deploys Canary tokens and virtual/physical decoys (honeypots) to detect intrusions and lateral movement, generating high-fidelity alerts for incident detection and response.
Alternatives to Thinkst Canary
Secure low-code honeypot framework that uses LLMs to simulate high-interaction systems across SSH/HTTP/TCP and MCP, with metrics and cloud-native deployment options.
2.2k stars206 forksGPL-3.0last commit Actively maintained
What replacing Thinkst Canary actually involves
Every option on this page is open source and free to run on your own hardware, so you own the data and there is no subscription to cancel. 2 of 2 shipped a commit in the last six months. Licences in this list: BSD-3-Clause, GPL-3.0. In exchange you take on hosting, backups and updates yourself.
Browse everything in Threat Detection, SIEM & Incident Response.
