Skip to content
Wardog

Platform // WARDOG Proof

Never trust a 200.

An accepted API request is a statement about a request, not about your environment. WARDOG closes an incident only after re-reading the state that the action was supposed to change.

incident evidence record

Post-remediation verification

Sample / demonstration data
Incident
INC-2026-0418-A7
Classification
Credential compromise → OAuth persistence → C2
Confidence
0.94 (verified)
Affected identities
1 · j.mercer@demo.example
Affected assets
1 endpoint · WS-4471
First observation
2026-04-18T09:14:22Z
Containment issued
2026-04-18T09:14:51Z

actions · precondition → authorisation → execution → verification

  • Endpoint isolationverifiedhost reachable only via control channel
  • Session + token revocationverified0 active refresh tokens remain
  • Malicious OAuth grant removalverifiedgrant absent on re-query
  • Forwarding rule removalverifiedmailbox rules re-enumerated
  • C2 domain blockingverifiedresolution denied at egress

evidence root

sha256:9f24b1c0a7e5d3f8112c4a6b0e7d9c2f5a83b41d6e0f7c9a2b5d8e1f403c6a7b

Verification

What gets re-checked.

Verification is action-specific. Each response type defines the query that proves it worked.

  • Identity

    Active sessions and refresh material are re-enumerated to confirm zero remain for the affected principal.

  • Consent

    The application grant is re-queried to confirm absence, along with any grants added during the incident window.

  • Mail

    Mailbox rules and forwarding configuration are re-read and compared against the pre-incident baseline.

  • Endpoint

    Isolation state, process presence and persistence locations are confirmed from the agent, not assumed.

  • Network

    Confirmed infrastructure is re-tested at the enforcement point to establish the block is effective.

  • Residual risk

    Anything that could not be verified is recorded explicitly as an open item rather than silently closed.

Evidence record

Written for the people who ask hard questions.

Insurers, auditors, regulators and boards ask the same thing after an incident: what happened, what was done, and how do you know it worked. The record is designed to answer that without a reconstruction exercise.

  • Reproducible

    Every conclusion links to the evidence that supports it and the checks that were run.

  • Tamper-evident

    Records are hashed into an evidence root so alteration is detectable.

  • Complete

    Refusals, escalations and expiries appear alongside successful actions.

  • Exportable

    Structured output, intended to be consumed by other systems as well as read by people.

Request early access

WARDOG is in early access with a small number of design partners. Tell us about your estate and we will get back to you.

Talk to us