A decade in, bootstrapped Thinkst Canary reaches $20M in ARR without VC funding
This month, cybersecurity company Thinkst will mark its 10th anniversary since the launch of its now-flagship product, Canary. The company debuted Canary after seeing companies spend millions of dollars on cybersecurity products, yet were still taking months or longer to realize that they had been breached.
Thinkst believed it could make a digital tripwire product that would catch hackers in the act, and by all accounts, it did just that.
Over the past decade, the company has grown to around 40 employees, mostly developers and engineers; hasn't taken on any outside funding; and is on track this year to make a healthy profit on $20 million in annual recurring revenue, almost double from 2021, Thinkst founder Haroon Meer told TechCrunch.
It's an impressive, if not refreshing feat, at a time when many cybersecurity companies are driven by breakneck growth and speed and fueled by venture capital.
Meer, who founded Thinkst and serves as its chief executive from Cape Town in South Africa, told TechCrunch in a call earlier this month that Thinkst made it this far by focusing on its customers and what they need — specifically a product that does what it says it does — and not growing the company at an uncontrolled rate. Meer said this approach is working, pointing to 60% of its first-year customers who are still with the company today.
'We're not artificially holding back growth, but we're also not doing any of the really silly, 'pour gasoline on the fire' growth-at-all-costs stuff,' said Meer. 'What you have to do is keep the promises that you make, and you'll grow into the people that are right for you.'
In 2015, Thinkst launched its Canary hardware product — named after a canary in a coal mine, essentially a very early warning system — that can detect and alert when hackers are present on a company's network.
A canary is set up like a honeypot, so that when a malicious hacker (or an authorized pen-tester stress-testing a company's defenses) accesses the canary thinking they struck it lucky by accessing a Windows PC with an open file share, or a server packed with customer data, secret API keys, or a vital service for a company's operations, the canary will send an alert about the breach and allow the company to take immediate action.
The canary's purpose is to reduce the amount of time that hackers have to sneak around on a victim's network to search for sensitive data, plant malware, or otherwise cause damage before getting caught. The average hacker has around 24 days on a victim's network before detection, according to Verizon's most recent annual data breach report.
The company also offers Canary Tokens, its free and public offering that lets anyone drop an item of ostensible value, like a password, document, or a credit card number, for example, in a safe place so that when someone accesses or opens the item, you are alerted at the same moment your safe place was compromised.
'One of the things we got accidentally lucky with is it's really hard to deploy a canary wrong,' said Meer. 'If you make it fit in, then you catch attackers, and if you make it stick out, you catch attackers.' After all, if a malicious hacker sees an advantage to get what they need faster, they're going to take the opportunity.
'It's rare for us to have a week without getting an email from a customer saying this saved our lives, or we had a pen test and this is the only thing that caught our attackers,' said Meer.
It is these success stories that 'fuels' the company, said Meer, and helps drive the company's organic sales growth. Thinkst does not have an outbound sales team; instead, the company relies largely on word of mouth, or existing customers who want to buy more of the company's honeypots.
Meer said that while Thinkst hasn't taken any outside funding to date, he does not begrudge the VC industry and values its insights. While conceding that some companies cannot get to where they are without heavy cash injections, he argues that money is 'not the gate that stops you from doing stuff.' Meer said that companies focusing on making their products work and their customers happy is core to good business.
'My main thing is that you should run the business in a way that you are still attractive for investment or acquisition,' said Meer. 'If you build a good enough business so that you don't need it, you can always ask for it when you do.'
Meer was not shy about his company's ambitions. 'We think every company should be running at least five canaries now,' he said. Some companies have a handful of canaries and some into the hundreds or more. 'There's a bunch of stuff that we could do to make more money; we just don't think that's necessary right now, because what we're doing is offering a good product at a fair price, and that's growing.'
'We are $20 million now, but we don't think $20 million is our ceiling,' said Meer.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Bloomberg
2 hours ago
- Bloomberg
Investing Africa: 'Verdict Is Out' on African VC Funding
Enygma Ventures Founder Sarah Dusek says that Venture Capital funding in Africa could get a boost in 2025 with investors potentially diverting their capital away from more traditional destinations. She speaks to Bloomberg's Jennifer Zabasajja. (Source: Bloomberg)
Yahoo
3 hours ago
- Yahoo
After its data was wiped, KiranaPro's co-founder cannot rule out an external hack
Indian grocery delivery startup KiranaPro's recent data loss story has more holes than Swiss cheese, as the startup remains unclear whether the incident was an internal breach or an external hack. Last week, the Bengaluru-based startup discovered that it could not access its back-end servers and that all its data, including its app code, had been deleted from GitHub. The startup on Friday blamed a former employee for the breach. However, in an interview, KiranaPro co-founder and CEO Deepak Ravindran conceded that the company had not deactivated the employee's account after they departed the company and cannot rule out the possibility of subsequent malicious misuse of their account. "If we go deeper, we have to do a real forensic investigation. We are going to talk [about] this with our board, the investors, and we are going to get a formal opinion on that also with our legal advisers," Ravindran told TechCrunch. Earlier on Friday, Ravindran claimed in a post on X that the incident that affected its data was an internal breach. "After careful investigation, we conclude that this was not a hack. No external party penetrated our ordering or payment systems, exploited vulnerabilities, or bypassed security protocols," he wrote. The co-founder also explicitly shared a screenshot of a LinkedIn profile of one of KiranaPro's former employees on X on Thursday, alleging that they had deleted the startup's code. (TechCrunch is not sharing the post's link, as the startup has yet to offer concrete proof supporting its position.) "[T]his was an internal data breach. Specifically, it was the result of actions taken by a trusted internal employee who had legitimate access to our systems," the co-founder wrote in his post on Friday. "This individual intentionally deleted critical server logs while they were being tested and/or edited, an action that goes directly against our policies, our principles, and the trust we place in our team." When TechCrunch asked if KiranaPro could rule out whether any third party had maliciously gained access to the former employee's account, Ravindran could not. "We have to do a complete forensic check on the company. We have to do the entire IP scan. We have to look at where the tracks happened. We have to check the computers, MacBooks, and whatever is used. Everything has to be done. Then we have to spend money … so, that's why we decided not to," he told TechCrunch. Then what was the basis of Ravindran's allegation? It was a GitHub response, a copy of which he shared with TechCrunch. The response included a username, which Ravindran said was associated with the former employee. "All we have is the emails that we got from GitHub, stating that [the former employee's username] as an individual is the one who deleted the account. We haven't done the investigation further," Ravindran told TechCrunch. Launched in late 2024, KiranaPro operates as a buyer app on the Indian government's Open Network for Digital Commerce. The startup allows more than 55,000 customers in 50 cities to purchase groceries from their local shops and nearby supermarkets using its voice-based interface. The company also supports local language inputs, including English, Hindi, Malayalam, and Tamil. Ravindran stated that they decided to call out the former employee based on the company's "belief system," as they claim the former employee deleted the data after their sudden termination. However, the startup said it is not aware if there were enough protections on the former employee's devices, such as multi-factor authentication, to restrict malicious third-party access, like malware. The company confirmed it did not remove the employee's access to its data and GitHub account following his departure. "Employee offboarding was not being handled properly because there was no full-time HR," KiranaPro's chief technology officer, Saurav Kumar, confirmed to TechCrunch. Alongside its code saved in GitHub, KiranaPro also lost access to its Amazon Web Services (AWS) account, which included its customer data and their transaction details. Ravindran told TechCrunch that the GitHub data was restored after getting its backup from one of their employees. The startup also regained access to its AWS account along with its customer data. Both the co-founder and CTO said the AWS account was protected by multi-factor authentication, but neither could say how the account was accessed, as nobody else had physical access to Ravindran's phone, which generates the multi-factor code. Nonetheless, Ravindran claimed that the customer data stored in the AWS cloud remained intact and was not accessed by any third parties, nor was it downloaded by the former employee in question. "Because if that is the case, I will get its notification on email or anything [sic]," he said. That said, Ravindran stated that the startup has enough evidence to file a formal complaint with the police, but said that its investigation is ongoing. The startup has also not fully paid its current employees, the company's co-founder confirmed, soon after the company raised a seed round of ₹100 million Indian rupees (about $1.2 million), which Ravindran said has yet to be fully wired. The startup counts Blume Ventures, Unpopular Ventures, and Turbostart among its institutional venture backers, as well as Olympic medalist PV Sindhu and Boston Consulting Group managing director Vikas Taneja among its angel investors. It has 15 employees located in Bengaluru and Kerala. Sign in to access your portfolio
TechCrunch
3 hours ago
- TechCrunch
After its data was wiped, KiranaPro's co-founder cannot rule out an external hack
Indian grocery delivery startup KiranaPro's recent data loss story has more holes than Swiss cheese, as the startup remains unclear whether the incident was an internal breach or an external hack. Last week, the Bengaluru-based startup discovered that it could not access its back-end servers and that all its data, including its app code, had been deleted from GitHub. The startup on Friday blamed a former employee for the breach. However, in an interview, KiranaPro co-founder and CEO Deepak Ravindran conceded that the company had not deactivated the employee's account after they departed the company and cannot rule out the possibility of subsequent malicious misuse of their account. 'If we go deeper, we have to do a real forensic investigation. We are going to talk [about] this with our board, the investors, and we are going to get a formal opinion on that also with our legal advisers,' Ravindran told TechCrunch. Earlier on Friday, Ravindran claimed in a post on X that the incident that affected its data was an internal breach. 'After careful investigation, we conclude that this was not a hack. No external party penetrated our ordering or payment systems, exploited vulnerabilities, or bypassed security protocols,' he wrote. The co-founder also explicitly shared a screenshot of a LinkedIn profile of one of KiranaPro's former employees on X on Thursday, alleging that they had deleted the startup's code. (TechCrunch is not sharing the post's link, as the startup has yet to offer concrete proof supporting its position.) '[T]his was an internal data breach. Specifically, it was the result of actions taken by a trusted internal employee who had legitimate access to our systems,' the co-founder wrote in his post on Friday. 'This individual intentionally deleted critical server logs while they were being tested and/or edited, an action that goes directly against our policies, our principles, and the trust we place in our team.' When TechCrunch asked if KiranaPro could rule out whether any third party had maliciously gained access to the former employee's account, Ravindran could not. 'We have to do a complete forensic check on the company. We have to do the entire IP scan. We have to look at where the tracks happened. We have to check the computers, MacBooks, and whatever is used. Everything has to be done. Then we have to spend money … so, that's why we decided not to,' he told TechCrunch. Then what was the basis of Ravindran's allegation? It was a GitHub response, a copy of which he shared with TechCrunch. The response included a username, which Ravindran said was associated with the former employee. 'All we have is the emails that we got from GitHub, stating that [the former employee's username] as an individual is the one who deleted the account. We haven't done the investigation further,' Ravindran told TechCrunch. Former employee's account was never offboarded Launched in late 2024, KiranaPro operates as a buyer app on the Indian government's Open Network for Digital Commerce. The startup allows more than 55,000 customers in 50 cities to purchase groceries from their local shops and nearby supermarkets using its voice-based interface. The company also supports local language inputs, including English, Hindi, Malayalam, and Tamil. Ravindran stated that they decided to call out the former employee based on the company's 'belief system,' as they claim the former employee deleted the data after their sudden termination. However, the startup said it is not aware if there were enough protections on the former employee's devices, such as multi-factor authentication, to restrict malicious third-party access, like malware. The company confirmed it did not remove the employee's access to its data and GitHub account following his departure. 'Employee offboarding was not being handled properly because there was no full-time HR,' KiranaPro's chief technology officer, Saurav Kumar, confirmed to TechCrunch. Company restores AWS account and GitHub data Alongside its code saved in GitHub, KiranaPro also lost access to its Amazon Web Services (AWS) account, which included its customer data and their transaction details. Ravindran told TechCrunch that the GitHub data was restored after getting its backup from one of their employees. The startup also regained access to its AWS account along with its customer data. Both the co-founder and CTO said the AWS account was protected by multi-factor authentication, but neither could say how the account was accessed, as nobody else had physical access to Ravindran's phone, which generates the multi-factor code. Nonetheless, Ravindran claimed that the customer data stored in the AWS cloud remained intact and was not accessed by any third parties, nor was it downloaded by the former employee in question. 'Because if that is the case, I will get its notification on email or anything [sic],' he said. That said, Ravindran stated that the startup has enough evidence to file a formal complaint with the police, but said that its investigation is ongoing. The startup has also not fully paid its current employees, the company's co-founder confirmed, soon after the company raised a seed round of ₹100 million Indian rupees (about $1.2 million), which Ravindran said has yet to be fully wired. The startup counts Blume Ventures, Unpopular Ventures, and Turbostart among its institutional venture backers, as well as Olympic medalist PV Sindhu and Boston Consulting Group managing director Vikas Taneja among its angel investors. It has 15 employees located in Bengaluru and Kerala.
