Canva Scales Threat Detection on the Data It Already Trusts

Canva empowers a community of more than 265 million people every month. For each of them, an account is where their work, their brand and their personal information live. Keeping that community safe means continuously separating routine activity from risky activity across up to hundreds of terabyte-scale daily audit logs, with enough confidence that every alert is worth the time of the person who picks it up.

For a platform growing as quickly as Canva, this was never just a question of which tool detects threats today. It was a strategic choice about which foundation could carry continuous detection as data volumes, the product surface and the community all compound. Historically, that choice had forced a trade-off. Canva's security engineers could have fidelity, speed or economics, but not all three, because running a large rule library continuously against live context is a high-volume analytics problem that most detection platforms were never built to carry.

Canva had one asset that reframed the choice. The live business context that high-fidelity detection depends on already existed: trusted reference datasets describing its products, brands and community, built and maintained in Snowflake for product analytics. Rather than standing up a new platform and replicating that context into it, the strategic question became whether detection could come to the data.

Canva put Snowflake Interactive Analytics through a strict, production-grade evaluation: Could it run the company's threat detection end to end, continuously, against live data?

The team tested two new building blocks: an interactive table for fast, selective reads, and an interactive warehouse that kept the working set warm and served thousands of detection queries a minute. The detection rules stayed ordinary SQL, so the team wrote them in the language it already used. That meant no new query model to learn and no new platform to staff. Snowflake Openflow tapped Canva's existing audit-log stream, filtering and standardizing events as they arrived.

Alongside the event stream, every check drew on the reference datasets Canva already maintained in Snowflake, so each rule ran against live business context. That context is what lifted alert fidelity and cut false positives: With live reference data in the query, a rule can tell expected activity from genuinely anomalous activity instead of flagging both. Alerts can then land in the triage workflow the security team already used.

None of this required duplicating data. The interactive warehouse reads reference datasets from the same standard Snowflake tables the rest of Canva relies on, and because storage and compute scale independently, adding detection capacity meant adding compute: no second copy, no extra storage, no sync pipeline to maintain. Interactive Analytics complements Canva's standard warehouses, which continue to carry the offline analytics, including scheduled jobs, broad queries over long time windows and ad hoc investigation.

The evaluation cleared every gate Canva set on fidelity, latency and economics. It sustained a daily log volume of up to hundreds of terabytes, ran a large library of detection rules continuously, held consistently interactive latency across the full rule portfolio, and raised signals within moments of the triggering event, in near real time. For Canva's detection workload, the interactive warehouse carried over 10x the concurrent load of an equivalent standard warehouse.

The economics cleared the bar as well: At equivalent retention and alerting scope, the modeled cost came in significantly lower than the alternatives evaluated.

Most importantly, the person picking up an alert now gets it backed by the same trusted business context that powers Canva's product analytics — detections at Canva scale that are high fidelity, fast and economical, all at once.