Alarm
24/7Immediate intervention needed: an exposed account, a live threat, a critical vulnerability on a public asset.
Delivered by: voice call and email
Watcher · AI-assisted micro SOC
Watcher watches around the clock. It calls when it matters.
Watcher monitors 24/7, correlates findings from every service, prioritises them and calls you with the recommended steps. Action is taken by your team or your solution partner — with a ready road map in hand.
Watcher is callingCritical alarm · Finance
03:47
“Leaked password, no second factor. Reset the password and make ThreatAuthenticator mandatory.”
ObservationA finance account's password is circulating on a leak forum; no second factor is enrolled.
AnalysisThe same user submitted credentials in last month's phishing test. Takeover risk is immediate.
DecisionReset the password, enforce ThreatAuthenticator today, assign a short awareness module.
What micro SOC means here
Monitoring is ours. Action is yours, with a road map.
Most organisations do not lack security data — it is scattered. Watcher reads the results of the services, joins repeats of the same problem across different sources and puts everything in one risk model. The services keep being managed from their own screens; Watcher only reads them.
Priority is never lost
Hundreds of rows sit in one order of importance.
Change is visible
Every assessment is compared with the one before.
Explained to management
A technical list becomes one sentence on the decision-maker's desk.
Alerts 24/7
A critical finding triggers a voice call and an email.
Three levels
Every finding lands in one of three levels.
The level decides the channel and the timing. An alarm wakes someone up; an advisory waits for the quarterly review.
Warning
Same dayA risk to plan for this week: an unpatched server, a newly exposed service, an expiring certificate.
Delivered by: email with the closing steps
Advisory
Every periodHow to get stronger this quarter: trends, weak spots, training needs by department.
Delivered by: AI-written executive report
Connecting the dots
Three services reported three small things. Watcher reports one priority.
Signals that look minor on their own change meaning when they sit together. An employee's password appears in a breach record. The same employee clicked the last phishing simulation. Their laptop is missing critical updates.
Threat intelligence
A breach record contains the employee's corporate password.
Phishing simulation
The same employee clicked the last campaign and opened the form.
Endpoint management
Their laptop is missing two critical updates, one listed in CISA KEV.
ALARM
One person, one device, one open door.
Reset the password, patch the laptop first in the next ring, and schedule a follow-up simulation for this user's group. Watcher prepares all three — each runs only after approval.
The briefing
From hundreds of findings to a short list of decisions.
Observation
What was measured
The score, which categories were measured and which are weakest.
Analysis
Why the score is what it is
Which findings and assets drive it, which vulnerabilities are already exploited in the wild and which are likely to be next.
Decision
What to do first
The actions in order, with the distance to the target score.
Prepared actions
It prepares the work. You approve it. It runs.
For supported workflows, Watcher prepares the matching action in the console — with its reason and its scope — and waits for an authorised person.
| The decision | What Watcher prepares |
|---|---|
| Critical patches are missing | A patch deployment for the affected machines: ring by ring, inside your maintenance window, with a failure threshold. |
| A fix has been applied | A verification scan that reports what was resolved, what remains and what reappeared. |
| People keep clicking | A phishing simulation for the group that clicked last time. |
| Credentials were found in a breach | An alert to the responsible person, tracked until the password reset is confirmed. |
| A certificate is about to expire, or an address is blocklisted | An alert before it becomes an outage or a delivery problem. |
| An application has reached end of life | A list of the machines that still run it, with a proposal to remove it. |
Control
Autonomy with a signature.
Human control remains central. Watcher uses the same controls as a manual operation, and every action leaves a record.
- Nothing runs until a person approves it. Every action is proposed with its reason and scope.
- Same controls as manual work. Rings, maintenance windows, failure thresholds and rollback.
- Read-only where it matters. Directory and database audits stay read-only; Watcher never writes to Active Directory or a database.
- Every action is recorded. What was done, on which asset, on whose approval, and what changed afterwards.
- The score stays deterministic. Watcher explains the number and works to move it; it does not calculate it.
Sources
Eleven sources Watcher reads.
Each one feeds a risk category. Add a service and Watcher starts reading it in the same company record.
Transparent scope
Product road map
- Posture score and breakdown Live
- AI report Live
- Delta reporting Live
- PDF executive report Live
- Written and voice alerts Live
- New device detection Planned
- Machine learning Under evaluation
Your data, clear boundaries
What Watcher sees — and what it never sends
- Personal data is not sent to the language model; only numerical summaries and ratios are passed on.
- If the AI service is unavailable, no invented score is shown — the calculated score stays unchanged.
- Data produced in your environment stays in the component inside your organisation.
- Alerts leaving your organisation carry no vulnerability details; recipients are directed to the console.
Watcher licence
Licensed per company. Start with a month.
Prices are quoted on request.
Trial
Demo
1 monthA full Watcher report on your real data.
Standard
Annual
12 monthsContinuous reporting, delta tracking and the PDF executive document.
Long term
Three-year
36 monthsA long-run posture curve and an audit history.
See a Watcher briefing on your own data.
One month, full scope, real findings. We map your external surface and produce your first posture score.