Haroon Meer

Meer spent roughly a decade at SensePost, the South African penetration testing firm, before founding Thinkst in 2010. That is where his signature idea took shape: attackers who get inside have to map the network, and that is when they can be caught — but only if the alerts are rare enough that someone actually reads them.

The result was Thinkst Canary (2015), small boxes that pose as a file server or a router and phone home the moment anyone pokes them, plus the free Canarytokens: fake API keys, documents and DNS names that fire when used. Classic honeypot thinking, with the unusual property of producing almost no false positives.