Tracebit raises $20m to take security decoys beyond elite teams

On 17 March, Tracebit, a London-based company that deploys decoys known as canaries across its customers’ cloud environments to catch intruders, announced a Series A led by FirstMark, with Accel, MMC Ventures, Tapestry VC and CCL joining. Tech.eu and SecurityWeek both put the round at $20m (£14.8m). In his announcement, Tracebit’s chief executive, Andy Smith, said it brings total investment in the company to $25m (£18.5m).

Smith founded the business with Sam Cox, its CTO; Tech.eu reports that both previously worked at Tessian. Companies House records Tracebit Limited as incorporated on 3 October 2022, with Smith a director from that date and Cox from May 2023. Smith wrote that the pair started the company believing that “‘assume breach’ is only going to become more critical”, and that canaries which force attackers to reveal themselves “the moment they’re inside” belong in the security stack.

When Tracebit announced its $5m (£3.7m) seed round in July 2024, led by Accel according to Tech.eu, the company said security experts had used deception such as honeypots and canaries for more than 30 years. It said high cost and complexity had confined them to the top security teams and made them impractical for modern cloud infrastructure. Tracebit’s pitch is that automation in the cloud removes that cost.

The Series A tests whether a control once reserved for the best-staffed security functions can become standard kit for the teams Smith describes as “over-stretched”. The product has moved in that direction since 2024, but the public evidence of uptake still comes mostly from software companies with senior security leaders of their own.

Named customers and the numbers

Smith’s post says Tracebit has deployed millions of canaries at companies including Riot Games, Snyk, Docker and Synthesia, and has detected “numerous intruders” across a growing number of enterprise companies. Tech.eu adds Admiral Insurance to the customer list and reports that the platform supports thousands of accounts, monitors around five billion events a week and generates millions of canaries daily.

The 2024 seed announcement carried comments from customers. Chris Hymes, CISO at Riot Games, said his company had used Tracebit “to rapidly scale deceptive coverage across our cloud and enterprise estate”, and that its detections produced “low volume, high value alerts”. Martin Tschammer, head of security at Synthesia, said the platform was “quick to deploy, easy to maintain and secure by design”.

Since then Tracebit has widened its coverage beyond AWS to Azure, Kubernetes, continuous integration and delivery (CI/CD) pipelines, developer workstations and identity providers. In December 2025 it launched Community Edition, which Smith described as a “free-forever platform”, covering canary credentials such as AWS session tokens, SSH keys and browser session cookies. He wrote then that canaries should be among the top three priorities for every new security program.

Where the new money goes

Smith said the round would speed up product development and strengthen customer support, including from a new office near Union Square in New York. Tracebit is also hiring for its engineering and commercial teams in London and New York. On the day of the round it announced three products: Perimeter Canaries, Deceptive Artifacts and support for Google Cloud. Tech.eu reports that Perimeter Canaries place decoys at the edge of SaaS and cloud environments rather than deeper inside systems, to add a layer of detection and speed it up.

Accel and Tapestry VC backed the seed round alongside angels including Guy Podjarny, the founder of Snyk; Tim Sadler and Ed Bishop, founders of Tessian; and Mandy Andress, CISO of Elastic. Both firms returned for the Series A. Companies House still lists Smith as holding between 25% and 50% of the voting rights. David Waltcher, a partner at FirstMark, said “Tracebit is building the cloud-native deception and detection layer for the AI era”, in comments carried by SecurityWeek.

The case built on AI attackers

Smith’s argument for the timing rests on AI: he wrote that defenders have been given strong tooling, but that AI-assisted threat actors mean the next few years are going to be some of the most volatile cybersecurity has seen. For intrusion detection, he argued, the gap between months and seconds “isn’t incremental”.

Tracebit’s Community Edition post explains the mechanism in plain terms: when a canary credential is touched, the customer is alerted. Its example is a supply chain attack that stole AWS credentials and SSH keys from developer machines: with canary versions of those keys in place, the post says, the customer would be alerted as soon as they were used. Tech.eu notes that AI-driven attacks can scan systems for weaknesses quickly, and SecurityWeek reports that Perimeter Canaries are aimed at detecting AI-powered and agentic attacks at the edge of SaaS and cloud.

Smith wrote that the free tier was meant for everyone from security teams just starting their program to home users. The paid product is the enterprise platform Smith said the founders set out to build, one that “simplifies the deployment and management of security canaries” and now covers cloud accounts, Kubernetes clusters and developer workstations.

What the round changes

Tracebit now has a new lead investor, a New York office, a free entry point and a product line that runs from developer laptops to the edge of SaaS. Its named customers remain mostly software and games companies with security leaders of their own, plus one insurer. The Series A gives it the means to reach more of the over-stretched security teams its argument is built around, and the New York office shows where it expects the next customer names to come from.