Described are techniques for managing canary files in a filesystem. The techniques include identifying an attack surface of the filesystem based on monitored filesystem activity data. The techniques further include generating hot spot maps based on the identified attach surface and identifying filesystem locations associated with elevated rates of change. The techniques further include splitting a file associated with a hot spot into logical sections and monitoring activity data associated with the logical sections. The techniques further include generating one or more canary files by assembling file content from logical sections identified as least-important and placing the one or more canary files within a directory corresponding to the hot spot.