Detection and response
Canary token
A planted file, credential or URL that is never used legitimately, so any use of it signals an intruder.
The honeypot idea, shrunk to a single artifact: a tempting fake — a passwords.xlsx, an API key, a database
row — that no real workflow touches. Its only job is to be used by someone who should not, which fires an alert naming
the moment and often the source. Canary tokens are cheap to scatter widely and, like a honeypot, raise almost no false
positives because legitimate use is zero.