The startup, which deploys millions of decoy assets across cloud environments to catch intruders, has closed its Series A led by FirstMark as enterprise security teams increasingly adopt deception as a primary detection strategy.
The principle of cyber deception is straightforward. By leaving something valuable-looking in a location where it shouldn’t legitimately be accessed, it becomes evident when someone interacts with it. This results in no false positives, no alert fatigue, and a clear, high-confidence indication of a compromised environment.
Tracebit, founded in 2023, has constructed its business on this principle and recently closed a $20M Series A led by FirstMark Capital, according to co-founder and CEO Andy Smith. This comes about 18 months after their $5M seed funding to develop their cloud-native deception platform, marking a significant increase in ambition and scale.
The platform uses what it calls canaries in cloud environments: decoy files, credentials, configurations, and endpoints that entice attackers but have no operational use. When any of these canaries are interacted with, Tracebit immediately sends an alert. The company claims the signal-to-noise ratio is nearly perfect, as legitimate users never interact with assets not present in any workflow.
Current clients, including Snyk, Docker, and Riot Games, operate large, complex cloud environments where traditional signature-based tools struggle with sophisticated attacks. Tracebit claims millions of canaries have been deployed, protecting thousands of environments since its launch.
The Series A funding will expand the platform’s canary library, adding more asset types across cloud providers, and will grow the go-to-market team. Smith has not disclosed revenue figures at this time.
Deception technology itself is not a new concept. Honeypots have existed in various forms for decades, with several vendors offering dedicated deception platforms over the years.
Tracebit offers a cloud-native, turnkey solution with low operational overhead, automated canary deployment, and integrations with existing SIEM and incident response tools. The challenge for the Series A is to see if this simplicity can scale up for enterprises and if the high-signal promise holds in large, multi-cloud environments.
For a sector overwhelmed by alert noise, this proposition is compelling.