Thinkst Canary vs Acalvio ShadowPlex and a credential no person is supposed to use

Thinkst Canary puts setup at 2 minutes on its product page, then expects the birds to stay quiet. The alert that breaks the quiet is the point of the product. It fires because something touched a file, a fake service, or a credential that no person uses. The same page’s FAQ treats that touch as the detection: someone opened a lure file, or used the fake service, and you have a problem. Ordinary staff behavior is not the score.

Acalvio ShadowPlex is the platform shape of the same signal. Decoys, honeytokens, deceptive credentials, and HoneyPaths (Acalvio’s name for controlled false paths) sit across identity, cloud, and subnets. A touch is supposed to land in the SIEM, SOAR, or EDR you already run. Canary’s notice comes from the hosted console.

A decoy is a fake system, service, or account that looks real and that nobody is supposed to use. A token is a fake secret or file, such as a cloud key or a document, left where someone might copy it. Using that secret is the alert. Thinkst calls the decoy a bird and the secret a Canarytoken. Acalvio calls the same two objects decoys and honeytokens. ShadowPlex is the product. Acalvio is the company.

The order depends on three checks. Is a published yearly bundle of five birds the shape you want? Will you accept projection software in the network so decoys can be cast into a subnet? Which system is allowed to receive the one alert that matters? Price, the object that gets planted, and the system that receives the notice decide the order.

Overview

	Thinkst Canary	Acalvio ShadowPlex
Primary use case	Early notice when a planted bird or token is touched. The console is meant to stay quiet until then	Enterprise deception across identity, cloud, network, and OT, with the touch turned into a SOC alert
What you hand it	A place for a hardware, virtual, cloud, or container bird, plus tokens such as a fake cloud key or a document	Room for a Deception Center and projection sensors, or a cloud service, plus identity and cloud scope for honeytokens
Day-to-day workflow	Pick a believable profile, deploy, and leave it. Open the console when a notice arrives	Playbooks recommend decoys per subnet. Analysts work the alert in the tools already on the account
License/pricing	Published yearly bundle. See Editions	Quote-required Order Form. See Editions
Who operates it	Your team places the birds and tokens. Thinkst hosts the console and sends the notice	Your SOC, with Acalvio’s platform designing and projecting the deception
Main buying consideration	Will a handful of believable birds and tokens cover the paths you care about?	Which ShadowPlex offering is on the order, and does that order include projection sensors?

Thinkst Canary

Acalvio ShadowPlex

Thinkst Canary and Acalvio ShadowPlex are still sold under those names. On 12 Jan 2026 Thinkst posted that it had concluded the purchase of 100% of UK-based DeceptIQ. That purchase was DeceptIQ. Canary was not sold. Canary remains the product on the Canary site. The company on the Acalvio MSA effective 1 Nov 2024 is Acalvio Technologies, Inc. ShadowPlex is the product that agreement and the site still sell. No closed sale of Acalvio was on the company pages checked 3 Oct 2026.

Editions and pricing

One dollar figure is public. Everything else on the Acalvio side, and any Canary count other than the block below, is a quote.

	Thinkst Canary	Acalvio ShadowPlex
How you buy it now	Yearly subscription. The term starts on the first day of the month after payment or a PO, runs 12 calendar months, and renews. A trial term in the same document is three calendar months	Order Form for ShadowPlex Cloud Services, ShadowPlex Software Services, or both, plus implementation and support as the order specifies. Hardware, if supplied, is licensed and returned at the end of the order
Public price (3 Oct 2026)	$7,500 USD per year for five Canaries (hardware, virtual, and cloud), unlimited Canarytokens on a private token server, an AWS-hosted console, and a year of support and updates. The terms say fees exclude VAT or GST. Other bird counts use the quote form. No second dollar figure is printed on that block	Quote-required. The MSA effective 1 Nov 2024 and the platform page opened the same day name no dollar amount. Added capacity is “then-current fees,” with no figure
What the public site lists	That five-bird block, plus a quote button. Free tokens on canarytokens.org are a separate service from the private server in the bundle	Identity Protection, Advanced Threat Defense, Cloud Security, and Targeted Threat Intel, plus Deception Guardrails on the opening screen. None shows a price
Main buying consideration	Section 2.2 of the terms says 30 days’ written notice to skip renewal. Section 7.1 says 30 business days. Get the sentence that matches the order	The order has to name the offering. Deception Guardrails on the opening screen is not a substitute for Identity Protection or Advanced Threat Defense unless the quote says so

What gets placed

Neither side is a guide to building a lure. What differs is who chooses the object, and whether software has to be installed before a decoy can appear.

	Thinkst Canary	Acalvio ShadowPlex
Maintenance	The product page puts setup at 2 minutes, then expects the birds to stay quiet. You pick the profile and the token. Thinkst hosts the console. The published yearly bundle includes a year of support and updates. Birds still need a resolver that can query outside	The platform page says playbooks can recommend deception type and placement, and that design can be automatic per subnet. Confirm how much of that is on the order. Projection sensors are software installed in the network. The Acalvio Deception Center hosts and manages those deceptions. Implementation and support are what the order specifies
Coverage	Coverage is the birds and tokens you place. The published bundle is five birds, hardware, virtual, or cloud, plus unlimited Canarytokens on the private token server. Other bird counts are a quote. Free tokens on canarytokens.org, including the AWS Infrastructure Canarytoken announced 15 Sep 2025, are a separate service from that private server	The platform page describes identity, cloud, network, and OT. The cloud FAQ says honeytokens go out through native cloud APIs, without an agent on the workload. A decoy in a subnet depends on a projection sensor. Identity Protection, Advanced Threat Defense, Cloud Security, Targeted Threat Intel, and Deception Guardrails are named on the site. Which of those the order includes was not a single public package
The object	A bird that presents as a Windows host, a router, or a Linux server, and tokens. The console help lists AWS API keys, Azure login certificates, Slack API keys, Office files, and DNS among the token types	Decoys, honeytokens, and deceptive credentials. The identity page describes decoy accounts in Active Directory and cloud directories, and privileged credentials that look usable and do not work. Any use is the alert
Who designs it	You pick the profile and the token. The paid token server is bolted to the hosted console	The platform page says playbooks recommend deception type and placement, and that design can be automatic per subnet. Confirm how much of that is on your order
Software in the network	The bird itself, or nothing extra if you only use a token. Birds reach the console over DNS, so they need a resolver that can query outside	The platform page says there is no endpoint agent. It also describes projection sensors, lightweight software installed in the network so decoys can be projected. The Acalvio Deception Center hosts and manages those deceptions, on-premises or in the cloud
Cloud	Cloud birds run in your account. On 15 Sep 2025 Thinkst announced a free AWS Infrastructure Canarytoken on canarytokens.org that alerts when decoy AWS resources are probed. That free service is not the private token server in the yearly bundle	The cloud security FAQ says honeytokens go out through native cloud APIs, without an agent on the workload

An AWS credential with no recent use still produced an email once a tool touched it. That is the Canarytokens notice. A touched Canarytoken still emails you, and the paid console adds Slack, webhook, and syslog.

Where the alert goes

Alert handling is who receives the notice and what they are asked to do next. Canary sends it from the hosted console. ShadowPlex is built to hand the same class of event to tools you already run. Only Thinkst prints a volume claim, and that claim is Thinkst’s, not an independent count.

	Thinkst Canary	Acalvio ShadowPlex
What counts as a hit	Access to a lure or a fake service. The FAQ says the trigger is that touch, with no model of normal staff behavior	Interaction with a decoy, honeytoken, or deceptive credential. The identity FAQ says those objects have no business use, so the touch itself is the signal
Where you see it	Email, text message, Slack, webhook, or syslog from the hosted console	SIEM, SOAR, EDR, XDR, and ITSM integrations, plus email, Slack, or webhook. The identity FAQ names CrowdStrike Falcon, Microsoft Defender, Palo Alto Cortex XDR, and VMware Carbon Black
What they claim about noise	The product page says customers with hundreds of Canaries receive a handful of events a year. That is Thinkst’s figure, not an independent count	The platform page says alerts are high fidelity because the decoy is not a real asset. No numeric false-positive rate was on the pages opened 3 Oct 2026
Containment	The notice is the product. The pages opened do not say Canary isolates the host for you	The platform page says containment actions can run through those integrations. It does not publish a response-time number
Main buying consideration	Is a mailbox or a Slack channel enough, or does the alert have to open a ticket in a queue you already staff?	Which integration is in the order, and which actions are pre-approved?

Choose Thinkst Canary when you want the published yearly bundle of birds and tokens, a console that is supposed to stay quiet, and the notice in email, Slack, or syslog without a SIEM project. Choose Acalvio ShadowPlex when decoys and honeytokens have to be projected across subnets and identity, and the alert has to land in the SIEM, SOAR, or EDR already on the account. The Canary order has to state the bird count if it is not the five-bird block, and which renewal sentence applies. The ShadowPlex order has to name the offering.