Skip to content
Wardog

Platform

A defence loop, not a detection feed.

WARDOG maintains a live model of your security state, reasons about deviations from it, and is permitted to act only inside boundaries you define. Everything it does leaves evidence.

Surface
Endpoint and identity first, extending to SaaS, email and cloud.
Authority
Deterministic policy gate, signed and time-boxed.
Output
Verified security state and an evidence record.

Design principles

Constraints are the product.

Autonomy is only acceptable when its limits are explicit, testable and auditable.

  • Separation of reasoning and authority

    The investigating system proposes. A deterministic policy engine disposes. AI is never handed arbitrary execution rights.

  • Evidence before action

    Every response has a stated precondition and an evidence threshold that must be met before authorisation is even requested.

  • Bounded blast radius

    Scope, asset count and identity count are evaluated before execution. Wide actions require a higher bar or a human.

  • Reversibility by default

    Preference is given to actions that can be rolled back, and every authorisation carries an expiry.

  • Verification, not assumption

    Post-action state is re-read from the environment. A successful API call is not treated as a remediated environment.

  • Tenant isolation

    Multi-tenancy is structural. Data, policy and authority are scoped per tenant and per site by construction.

Operating loop

Observe through learn.

  1. 01

    Observe

    Continuous telemetry from endpoint, identity, SaaS, email and cloud.

  2. 02

    Reconstruct

    Events become a connected security-state graph, not a queue.

  3. 03

    Hypothesise

    Bounded reasoning proposes competing explanations.

  4. 04

    Verify

    Evidence is tested against thresholds before anything acts.

  5. 05

    Contain

    Only policy-authorised containment is permitted to execute.

  6. 06

    Remediate

    Root cause and persistence are removed, not just the symptom.

  7. 07

    Prove

    Post-remediation state is re-checked and recorded as evidence.

  8. 08

    Learn

    Verified behaviour improves detection without sharing raw data.

Request early access

WARDOG is in early access with a small number of design partners. Tell us about your estate and we will get back to you.

Talk to us