Introducing Tracebit Artifacts: Canary Files That Show Attackers' Intent

Tracebit CEO Andy Smith and Founding Engineer Ed Jones, tech lead on the project, walk through the launch of Tracebit Artifacts. Deception vendors have offered decoy documents for years, usually as fixed templates that fire when someone opens them. Artifacts work differently. Each one is a realistic file built for your organisation, with unique canary credentials inside: AWS keys, SSH keys, GitLab logins, session cookies or data room links. An alert only fires when someone uses those credentials, so you see real intent and get far fewer false positives. In this video: An S3 bucket canary with a decoy Terraform state file. The alert shows someone downloading it and trying the AWS keys inside. Encrypted zips on endpoints. Use the encryption strength to tune how sensitive the bait is, and trace any alert back to the device it came from. A board paper in Google Drive with a resolved comment hiding a “data room” link. A Salesforce support ticket with a HAR file holding canary session cookies, inspired by recent Salesforce breaches. Perimeter sensors and canary cookies, the building blocks underneath Artifacts. Building your own templates with an AI agent through the Tracebit MCP server. Learn more: https://tracebit.com/blog/introducing-arti... Chapters 00:00 Intro 00:28 What is a Tracebit Artifact? 02:10 Use case: S3 canaries and a decoy Terraform state file 05:23 Going beyond pre-built templates 06:11 Encrypted files and tuning sensitivity 08:01 Building block: perimeter sensors and canary cookies 11:27 Use case: endpoints, with SSH and GitLab creds in an encrypted zip 15:20 Building templates with AI and the Tracebit MCP server 17:32 Matching your organisation’s own documents 18:05 Use case: a Google Drive board paper with a hidden data room link 21:13 Use case: Salesforce support tickets and HAR files 26:12 Deployment and wrap-up