Watch Cortex

Watch is an autonomous security and monitoring platform for Linux servers. A lightweight agent installs in under 60 seconds with a single curl command — no firewall changes, no inbound ports, no SSH access from Watch.

The Cortex AI engine runs locally on every node. Threat classification happens on-device without a cloud round-trip, so the backend going down never stops active defense. When a brute-force attack, reverse shell, cryptominer, or port scan is detected, Watch acts immediately — banning IPs, killing processes, enabling lockdown — with every action logged, chained, and reversible.

Fleet intelligence via Cortex Hive. When one agent catches a threat, every agent in your fleet is instantly warned. Cross-org indicators of compromise broadcast attacker IPs and TTPs across your entire fleet without exposing any customer data.

Four levels of autonomy — you choose:

Watch Mode — observe and alert only, humans approve everything Assist Mode — non-destructive actions run automatically, destructive ones surface as one-click suggestions Autopilot Mode — confirmed threats acted on immediately; uncertain threats queue for human override Sovereign Mode (Empire only) — fully autonomous operation, humans notified after action Built-in compliance mapping for CIS Benchmark, SOC 2 Type II, PCI-DSS v4, HIPAA, ISO 27001, Zero Trust (NIST 800-207), and GDPR — with automated remediation and cryptographic audit trails.

Key capabilities:

Real-time CPU, memory, disk, and I/O metrics streaming to dashboard Process monitoring and threat detection with behavioral baselines CVE scanning and package vulnerability scoring SSH key management and config change monitoring Encrypted credential vault (AES-256-GCM, per-org key isolation) Automated playbooks and incident response plans Webhook and integration dispatch (Slack, PagerDuty, Splunk HEC, Datadog) On-call rotation management with phone call alerts File integrity monitoring with tamper detection Zero-trust policy engine — enforced locally, survives backend outages Two-person approval (4-eyes) for destructive actions SCIM 2.0 user provisioning and SSO (SAML/OIDC) Pricing: Developer $39/mo (5 servers), Business $149/mo (25 servers), Enterprise (unlimited), Empire (sovereign/white-label). 14-day free trial on all plans. No per-host fees.