The archive · Developer & Business Tools · Strategic decision · 2014–2025
Thinkst Canary bootstrapped a breach-detection honeypot to $20M ARR with no VC
A Cape Town cybersecurity shop bet a simple, deployable honeypot could outgrow funded rivals — no investors, no outbound sales, profitable since year one.
Thinkst
What the business is
Canary is a plug-in hardware honeypot (plus free Canarytokens) that alerts a company the moment an attacker touches it, cutting breach-detection time.
Starting capital：None raised; profitable since year one
How it started
Haroon Meer's Cape Town-based Thinkst built Canary privately for about a year and launched it in mid-2015. The thesis: internally deployed honeypots would let customers discover breaches themselves instead of being told by third parties some 300 days later.
What happened
By March 2021 Canary crossed $11M ARR with a 22-person team, profitable since year one, no capital raised, no price increases — with year-one customers still spending more. By 2023 it crossed $19M ARR; the company still had no outbound sales team and watched marketing spend carefully.
How it ended up
In May 2025, on Canary's 10th anniversary, Thinkst was on track to make a healthy profit on $20M ARR — almost double 2021 — with ~40 employees, no outside funding, and 60% of first-year customers still customers. It remains independent and growing.
Background
Thinkst launched Canary in mid-2015 on a contrarian read of the security market: companies were spending millions on defense yet taking months or longer to realize they had been breached. The bet was a cheap, physical honeypot that would alert the moment an attacker touched it, so simple to deploy that it couldn't be set up wrong.
Canary started at $7,500 per appliance and grew without the usual startup machinery. There was no outbound sales team, no venture capital, and almost no launch press — one Ars Technica article was the extent of it. Instead, customers who caught attackers or pen-testers recommended the product, and year-one customers kept expanding their spend.
The numbers validate the model: profitable since year one, $11M ARR by 2021, $19M by 2023, and $20M ARR on track in 2025 with about 40 employees. Thinkst stayed in Cape Town, remote-first, and never raised prices.
The company still exists, still takes no outside money, and in 2025 acquired UK red-team firm DeceptIQ while continuing to add free detection tools like Canarytokens and OpenCanary.
What has to be true
- Deployment simplicity was the wedge: honeypots had a decades-long history but were painful to install, and removing that pain became the product's North Star.
- Funding wasn't needed because the go-to-market was organic — low-touch sales, conference booths staffed by engineers, and customers who doubled as the sales force.
- Deliberate restraint (no outbound sales, no analyst-firm spending, no price hikes) kept the burn near zero, so the business was profitable from year one.
- The product's promise — catch attackers early, don't drown users in alerts — was kept consistently, and customer retention and expansion did the marketing.
What can be applied
A product that keeps its promises becomes the sales motion: word of mouth compounds, and money isn't the gate to building a business.
Aftermath
As of the TechCrunch anniversary report (May 2025), Thinkst was profitable on ~$20M ARR with roughly 40 employees, no outside funding, and no outbound sales team, with 60% of first-year customers still customers. Through late 2025 and 2026 it kept shipping: an MCP-server canary token, a package-proxy tool, Google SecOps SOAR integration, and the acquisition of UK-based DeceptIQ. Founders said $20M was not the ceiling, and the company remains independent and scaling on its own cash.
Sources
- A decade in, bootstrapped Thinkst Canary reaches $20M in ARR without VC funding
- We bootstrapped to $11 million in ARR
- RSAC/Blackhat booths don't have to suck
spotted an error? The archive wants to know.
Your turn
You just read one. Describe what you are building, and see who is betting on the same thing.
Free account · 3 free questions · no card