Technology // WARDOG Graph
Your estate, held as one connected state.
Most tooling stores events. WARDOG maintains relationships. The graph is what makes it possible to reconstruct an attack rather than describe fragments of it.
security-state graph // live reconstruction
OBSERVE
telemetry ingested
simulated scenario · not customer data
Entities and relationships
What the graph holds.
Nodes are the things an attacker uses. Edges are how they were used, and when.
Identity
users, service principals, tokens, sessions, consent grants
Endpoint
devices, agents, users signed in, posture, isolation state
Process
lineage, command line, signer, injected modules, network use
File
hashes, paths, provenance, quarantine state
SaaS & email
apps, OAuth grants, mailbox rules, sharing, forwarding
Cloud
accounts, roles, key material, control-plane operations
Network
domains, destinations, beacon characteristics, egress decisions
Threat
techniques, indicators, prior verified behaviour, package provenance
Why it matters
Reconstruction is a graph problem.
A credential event, a consent grant and a spawned process are unrelated rows in a log store. In a graph, they are one path through one principal — with time, direction and dependency intact.
Continuously maintained
State is updated as telemetry arrives, so investigation starts from current context rather than rebuilding history under pressure.
Time-aware
Relationships carry validity windows, so WARDOG can answer what was true at the moment of compromise, not only what is true now.
Blast-radius ready
Because reach is a traversal, the cost and scope of a containment action can be calculated before it is authorised.
In the loop
Graph feeds every other stage.
For Brain
Supplies the context a hypothesis must explain, and the evidence that can refute it.
For Gate
Provides asset scope, tenant boundary and calculated blast radius as inputs to authority.
For Response
Identifies the precise targets: this session, this grant, this process, this host.
For Proof
Holds the before-and-after state that verification is measured against.
Request early access
WARDOG is in early access with a small number of design partners. Tell us about your estate and we will get back to you.