Tracebit

What do you like best about the product?

I thoroughly enjoyed working with Tracebit, their customer support is amazing! They move fast, thus they are able to fix issues and implement new features quickly. Tracebit is feature rich and works great, it is contantly ensuring that resources are safe and catches every time any unussual activity happens in configured accounts. It was very easy to install with Terraform. It works with AzureAD SSO integration and MS Teams as reporting channel! We didn't continue with Tracebit because of orgisational contraints at our end and not of any short comings of the service or team behind it. Tracebit isn't anything, but a great service.

What do you dislike about the product?

Being a start up the feature set is growing.

What problems is the product solving and how is that benefiting you?

Tracebit solves the issues of detecting any access by an unauthorized individual. It will page us or alert us, depending on how severe the access was.

More importantly, the alerts are easy to understand and uncommon, which ensures we only get alerts when we need them.

What do you like best about the product?

We were a launch partner with Tracebit and found the offering to be immediately useful to our expanding organisation whilst fitting in with our budgets. We were not mature enough to have a sophisticated Cyber Security Strategy and they helped advise us on many aspects of that throughout our relationship. The initial installation and integration with our AWS account was trivially easy and returned immediate visible value to us. More features were added and Tracebit was superb throughout in consulting with us and assimilating our feedback into their roadmap.

What do you dislike about the product?

I think the offering is idea for an expanding business moving from a startup phase to a more mature growth phase. If I were an enterprise customer with a large budget I might be tempted to go to a more mature offering purely because Tracebit may not yet have the breadth of features that other offerings have.

What problems is the product solving and how is that benefiting you?

Tracebit solves the problem of intrusion detection. This is giving us more confidence in our perimeters.

What do you like best about the product?

The product team has great ideas and very innovative approach. I resonate a lot with the mission to detect adversaries in the cloud and I like that this has become their mission as well. Their solution is growing very rapidly and they expand it with more and more capabilities. The team is super flexible and innovative and they accept and listen to new suggestions and ideas which makes them extremely nice to work with!

What do you dislike about the product?

Looking forward for the product to mature

What problems is the product solving and how is that benefiting you?

Tracebit makes it really easy to deploy decoys in our cloud accounts!

What do you like best about the product?

Tracebit excels in its ease of setup and extensive threat coverage. Deploying Tracebit across our Cloud environment took mere minutes, and the platform instantly started monitoring for threats with minimal configuration. The coverage is comprehensive, and the speed and accuracy of alerts give us confidence in quickly identifying potential threats. The Tracebit research and engineering team is at the forefront of AWS Cloud security, making their blog posts both insightful and enjoyable to read. Customer support is exceptional, I have direct assistance provided by the founding members.

What do you dislike about the product?

The solution performs well in addressing the technical challenges, but it truly shines when there's a true positive event, which, unfortunately, isn't frequent in my environment. This makes it a bit challenging for me to justify the business value consistently.

What problems is the product solving and how is that benefiting you?

Tracebit addresses the challenge of detecting suspicious activities within cloud environments. The platform’s canaries are a unique solution that proactively alerts us to potential breaches, particularly around sensitive credentials, significantly improving our mean time to detection and response, and security posture.

What do you like best about the product?

Tracebit canaries cover a wide range of resources, both in and outside of AWS. You can create decoy S3 buckets in your environment, publish fake credentials to endpoints and pipelines, or even create dummy applications in your Okta instance.

Deploying Tracebit took a matter of minutes, even across multiple accounts!

After deploying, you can be confident the canary resources are set up and working correctly because you get notified whenever they aren't.

Alerts arrive in your Tracebit instance within minutes of the activity occurring, giving you confidence that any potential threats are swiftly identified and can be addressed promptly, ensuring your environment stays secure and resilient against compromised identities. I am yet to receive a false positive alert from Tracebit, further reinforcing my trust in the accuracy and reliability of their detection system.

What do you dislike about the product?

Tracebit handles canary resources and credentials effectively.

I believe their offering could be improved by incorporating automated remediation steps for critical alerts. For example, automatically applying an IAM deny policy to compromised users or roles would be valuable. While this is currently possible through integrations with third-party services like PagerDuty, it requires additional configuration and third party products. Integrating such capabilities directly into Tracebit's platform would enhance security response and reduce dependency on external tools.

What problems is the product solving and how is that benefiting you?

Provides insight into suspicious activity within our cloud environments and endpoints without needing to write custom rulesets, onboarding expensive SIEM tooling or ingest large volumes of logs ourselves.

There's plenty solutions for more legacy credentials, such as SSH or web servers, however there isn't really anybody else doing what Tracebit are doing with cloud canaries.