Platform
IN DEVELOPMENT / DESIGN INTENT
A full-spectrum security operating system.
WARDOG is not an EDR wrapper or a generic SIEM. The engineering programme converges endpoint, identity, mail, network, cloud, SaaS, data, applications, attack surface and human-interaction risk on one governed substrate — with deterministic authority, explicit uncertainty and evidence for every consequential action.
- Substrate
- Graph · Brain · Gate · Response · Proof · Packs · Telemetry · Ledger
- Authority
- Gate is deterministic, deny-by-default and the sole privileged authority boundary.
- Scope
- Personal · SME · MSP · Enterprise
Programme disclosure
Capability without theatre.
This page is a public map of the canonical WARDOG engineering programme. It intentionally mixes evidence-backed foundations already exercised in the programme, active Stage 2 build-out and later-stage frontier direction. Roadmap and frontier items are not claims of live customer deployment, certification, production efficacy or completed provider integrations.
Evidence-backed foundation
Contracts, governance, simulation fixtures, tests, provenance rules and bounded response seams that have already been exercised in the engineering programme.
Active programme
Capabilities being implemented and hardened through the current staged queue. Provider adapters may remain simulated until explicitly authorised.
Frontier direction
Later-stage research and engineering targets that must remain measurable, reversible where applicable and bounded by Gate.
Shared substrate
One control plane for every security domain.
Modules can use replaceable open-source or commercial engines behind WARDOG-owned contracts, but evidence semantics, tenant boundaries and authority stay inside WARDOG.
Graph
A tenant-scoped security-state and interaction-risk graph linking assets, identities, messages, URLs, sessions, applications, workflows, evidence and requested actions.
Brain
Bounded analysis that can classify, explain, compare hypotheses and propose next steps, but cannot grant itself authority or infer human intent with certainty.
Gate
The deterministic, deny-by-default authority boundary for privileged response and controlled economic actions.
Response
Provider-neutral, reversible action proposals with bounded scope, expiry, replay protection and independent post-action verification.
Proof
Append-only evidence and provenance so observations, decisions, actions and verification can be reconstructed and challenged.
Pack Network
A governed path for signed detections, policies and response content to move from candidate research through testing, approval, shadow/canary and production.
Telemetry Fabric
A common ingestion and normalisation plane for endpoint, identity, mail, network, cloud, SaaS and other security observations.
Billing Ledger
Transparent action metering and economic authority, designed around attributable WT reservation, commit, release and compensating-credit events.
Coverage
Security modules designed to converge, not compete.
Every module feeds the shared graph, telemetry, proof and policy boundaries so WARDOG can reason across an incident instead of treating each tool as an isolated alert source.
Sentinel
Native AV/EDR/XDR, anti-ransomware, exploit-prevention and endpoint containment foundations.
Identity
Sign-in, session, token, device registration, privilege, application and directory defence.
Message authentication, phishing/BEC analysis, URL/QR/attachment evidence, mailbox hunt and bounded response proposals.
Network
Flow, DNS, HTTP/TLS, proxy, secure-web-gateway, Wi-Fi/captive-portal and traffic-manipulation defence.
Cloud
Cloud resource, identity, configuration, control-plane, workload and audit security.
SaaS
Cross-application posture, identity, configuration and activity controls.
Data / DSPM
Sensitive-data discovery, exposure context, movement and release-governance foundations.
Vulnerability
Asset-aware vulnerability, exposure, exploitability and remediation prioritisation.
Surface / EASM
External attack-surface discovery, ownership, exposure and change tracking.
Mobile
Mobile device, application, identity, network and risk-state coverage.
App / API
Application, API, dependency and software-supply-chain security.
SIEM
Normalised detection, correlation and evidence-backed security operations across modules.
Hunt
Bounded retrospective investigation across telemetry, graph context and provider-neutral search adapters.
Forensics
Evidence-preserving reconstruction, provenance and post-incident analysis.
Compliance
Control-state evidence, auditability and continuous proof rather than checkbox-only reporting.
Awareness
Human-centred security education informed by real attack patterns without turning users into the authority layer.
Supply Chain
Software, vendor and dependency risk with provenance and replaceable-engine boundaries.
Recovery
Verified restoration, rollback and recovery-state evidence after containment or disruption.
Personal
Consumer and family protection using the same governed substrate with appropriately reduced complexity.
MSP / Enterprise control
Tenant, customer, site, portfolio, budget and delegated-administration boundaries for managed and large estates.
Social Shield
Anti-social-engineering is a first-class security domain.
WARDOG's interaction-risk graph is designed to connect claimed identity, verified identity, message, URL, QR target, attachment, device/session, OAuth app, domain, voice/video persona, payment destination, requested action and organisational workflow. No model is permitted to infer human intent with certainty or grant authority.
Cross-channel threat coverage
- Phishing, scams and business email compromise
- Identity coercion and helpdesk social engineering
- OAuth and device-code abuse
- Adversary-in-the-middle token theft
- QR, CAPTCHA and browser-in-browser phishing
- AI-personalised spear phishing and AI-brand impersonation
- Deepfake voice and video impersonation
- Vendor and payment-change fraud
- Captive-portal and traffic-manipulation lures
- Government, diplomatic, defence, intelligence and research-targeted campaigns
Protected principals
- Executives and board-level principals
- Finance and payment approvers
- Privileged administrators
- Ministers, diplomats and government officials
- Defence, intelligence and sensitive research personnel
- Procurement, legal and HR
- Other tenant-defined high-risk roles
High-consequence requests — credentials, device codes, OAuth scopes, payment/vendor changes, privileged resets and sensitive-data release — are designed to require stronger deterministic verification and out-of-band approval when policy demands it.
Emerging threat loop
Threat intelligence can propose. It cannot silently rewrite enforcement.
External research enters a governed lifecycle: source provenance → candidate TTP → map → simulate → false-positive test → approval → signed detection pack → shadow/canary → production. New reports never directly change enforcement.
2026 planning inputs
Current programme inputs include AI-enabled dynamic device-code phishing, adversary-in-the-middle token compromise, OAuth redirection abuse against government/public-sector targets, rapid QR phishing growth, CAPTCHA-gated phishing, AI-brand impersonation, state-linked captive-portal/traffic manipulation and nation-state AI-assisted reconnaissance/social engineering.
These are engineering and simulation inputs, not claims that every pattern is already covered in production.
Replaceable engines, owned authority
WARDOG can ingest capability from open-source, commercial and private engines behind owned contracts with licence, provenance, integrity, sandbox and shadow-evaluation controls. Engine tournaments can compare quality. No engine becomes the authority plane and no third-party report can bypass Gate.
Deterministic authority
The investigating system proposes. Gate disposes.
Privileged actions require evidence, policy authority, bounded scope, auditability, expiry/replay protection, reversibility where applicable and post-action verification. Missing evidence, malformed state or unavailable dependencies resolve to denial or explicit human approval — never permissive execution.
- 01
Observe
Continuous telemetry from endpoint, identity, SaaS, email and cloud.
- 02
Reconstruct
Events become a connected security-state graph, not a queue.
- 03
Hypothesise
Bounded reasoning proposes competing explanations.
- 04
Verify
Evidence is tested against thresholds before anything acts.
- 05
Contain
Only policy-authorised containment is permitted to execute.
- 06
Remediate
Root cause and persistence are removed, not just the symptom.
- 07
Prove
Post-remediation state is re-checked and recorded as evidence.
- 08
Learn
Verified behaviour improves detection without sharing raw data.
Transparent action billing
WT is an accounting unit, not a cryptocurrency.
WARDOG's working token unit is designed to make discretionary actions attributable and governable without turning safety into a paywall. Baseline fail-closed protection must remain available when discretionary WT balance is exhausted.
Attribution
Tenant → request/security context → action → Gate security/economic policy → execution → result → verification → tariff → ledger event.
Economic authority
Reservation, commit and release semantics with idempotency, anti-double-charge behaviour and compensating credits.
Budget controls
Spend ceilings, human-approval thresholds, MSP pooled budgets and enterprise cost centres without opaque surprise charging.
No premature payments
Real payment activation is deliberately deferred until ledger correctness and economic-authority behaviour are proven.
Frontier direction
Autonomous defence, bounded by measurable safety.
The later-stage programme pushes beyond alert handling toward continuous simulation, investigation, hardening and proof — while retaining deterministic authority and explicit uncertainty.
Frontier AI remains advisory or narrowly delegated under explicit deterministic policy. Machine-speed containment is reserved for pre-authorised conditions with measurable scope, evidence, verification and rollback semantics.
Request early access
WARDOG is in development. Tell us about your estate and your interest in early access.