Glossary · OT cybersecurity
Canary token
Also known as: Honeytoken, Canary credential, Decoy token
German: Köder-Token
A canary token is a decoy — a fake credential, document, record, URL or device entry that no legitimate process ever uses — placed so that any access to it raises an alert, revealing an intruder or an AI agent that is reaching beyond its task.
- OT security
In one sentence
A canary token is a decoy credential, record or file no legitimate process touches. Any access raises an alert — also when an AI agent strays.
Example
A fake “admin-backup” API key sits in the agent’s configuration repository; the day a coding agent tries to use it, the security team is alerted.
Explained in context
This term is a station of a mini course
- When an AI agent crosses the line: detect, contain and restore operationsStation: Signals of a boundary breachStart the course
Context cards connect this term with others to answer one question. Also in British English and German.
- Detecting an AI agent that crosses its boundaryHow do you notice that an AI agent has done something it wasn’t allowed to do — before a customer, an operator or the month-end report does?UKDeutsch
- When an AI agent crosses the line: detect, contain and restore operationsWhat has to be in place when an AI agent does something it isn’t allowed to do — in IT systems, IoT fleets, OT and on machines — and how is it detected, stopped and released again?UKDeutsch
How it applies
- Few false alarms: Because nothing legitimate touches a canary, an alert is almost always meaningful — useful where normal agent behavior varies a lot.
- Placement for agents: Decoy records in the CRM, a fake supplier in the ERP, a decoy document in the knowledge base with a unique phrase, a fake tag in the historian, an unused device entry in the IoT device registry.
- Never in the control path: In OT a canary must never be a signal that a controller or safety function reads; it sits in engineering, historian or IT-side systems.
- What it doesn't do: It detects; it doesn't prevent. Combine it with security monitoring and a planned response.