What we know
The prototype identified 14 of the 20 studied types in the described configuration. The authors note possible false positives and describe types the tool does not cover.
Evidence limits
14/20 is coverage of one provider’s token types, not success against diverse deployments or a measure of real attacker evasion. Code and templates may have changed since 2022.
Reviewed: full text.
Full-text review · 2026-10-02
Design and scope
White-box and black-box analysis of 20 Canarytokens honeytoken types, followed by an artifact-based fingerprinting proof of concept. The evaluation is limited to that implementation and version.
Main finding
The prototype identified 14 of the 20 studied types in the described configuration. The authors note possible false positives and describe types the tool does not cover.
Evidence limits
14/20 is coverage of one provider’s token types, not success against diverse deployments or a measure of real attacker evasion. Code and templates may have changed since 2022.
Locators: PDF pp. 7–13, Sections 4–6, Table 1, Figure 3
The full text was examined and locators were retained. Single-reviewer synthesis without independent extraction or formal quality appraisal.
Sources and provenance
- Honeysweeper: Towards Stealthy Honeytoken Fingerprinting Techniques
full-text · 2026-10-02 - Full text examined for Atlas review
full-text · 2026-10-02
Reviewed: 2026-10-02. This record may change when new evidence is found.