Capabilities

The full capability surface, stated precisely.

Where a capability is gated to a higher plan, it says so. Where it requires your own API key, it says that too.

Tiered EDR: Microsoft Defender for Endpoint, native OS tooling, or the built-in heuristic engine
12 MITRE ATT&CK rule families — encoded PowerShell, living-off-the-land binaries, ransomware behaviour, lateral movement, persistence
Behavioural engine for activity that matches no signature
Threat-intel enrichment via VirusTotal, AbuseIPDB and AlienVault OTX (your keys, your bill)
Your own detection rules: regex, keyword or threshold

New workspaces start in detect only: nothing is stopped or isolated automatically until you choose detect and block
Playbooks for ransomware canaries and credential dumping, which act automatically only in detect-and-block mode. Canary files are placed through the API today, not from the console
Isolate a host, lock the screen, kill a process, quarantine a file — one click, or automatic by your settings
Volume Shadow Copy rollback on Windows, and USB mass-storage block and unblock — both as actions you trigger, through the API or with our help, not yet as a standing policy
Ransomware canary files: a tripped canary raises a critical alert, and in detect-and-block mode isolates the device
Every command signed, time-limited and replay-proof

Patterns for payment card numbers, National Insurance numbers and other personal and client data, matched against process command lines and file paths in the telemetry we already collect, and recorded for review. This is pattern matching on what the agent sees, not a data-loss gateway: it does not inspect email, cloud uploads, printing or network shares, and it does not block a transfer.

Geo threat map by country, with a filterable detection feed underneath
Kill-chain stories: alerts inside one window stitched into a single timeline
Per-device activity summary — applications, documents and sites, with time spent
Persistent foothold hunter: Run keys, scheduled tasks, services, WMI, LaunchAgents, cron, systemd
Application inventory and a CVE scanner across every managed device

WatchTower ships no model of its own. Connect one and the AI features work; leave it unconnected and they say so, and everything else — detection, containment, alerting, reporting — runs without one
Bring your own provider — OpenAI, Anthropic, Google, Mistral, Groq, Azure, or a model you host yourself
Written assessment of your security state, from your model or from the product's own rules
Public advisories scouted, filtered to what you actually run, and rewritten as advice
Log analysis is off until you switch it on, and redaction is on by default
No model is ever in the path of a blocking decision

Phishing simulations using realistic pretexts
Restricted to email domains your organisation uses (public webmail domains excluded), and to administrators
Open and click tracking — no password or other form input is collected
Anyone who clicks lands on a short training page

Fifteen datasets, each exportable as PDF, Excel or CSV, for the whole organisation or one device
One-click export of everything as a single workbook
Every export written to the audit log with who took it
Preview before you download, so nothing is a surprise

HMAC-SHA256 signed webhooks with retry and a delivery log
Scoped REST API at /api/v1/*, keys hashed with Argon2id
Microsoft 365 identity threat detection: risky sign-ins, risky users, OAuth grants
PSA ticketing for Halo, ConnectWise and Autotask
OIDC single sign-on: Entra ID, Okta, Google Workspace
Prometheus metrics at /metrics — on request: the endpoint needs a token we issue by hand today, so ask us and we will set one up

Run it against your own endpoints.

Fourteen-day trial, every capability above unlocked.