Fleet overview
Live posture across the whole book of business.
Consent-based free check
Non-invasive, read-only. Creates a lead and a passive assessment.
Leads
Engagements
Live exploit watch OSINT
Read-only aggregation from public intelligence. Does not scan any third-party system.
Early warning — exploit forming OSINT
CVEs showing an exploit forming before the exploited catalog: a public PoC / detection template exists, or a patch has shipped (the patch-gap window). Existence metadata only — no exploit content, nothing scanned.
Decoy network our infra
WatchTower-owned decoys only — never a client or third-party system. Inbound attack traffic is stored as defanged metadata (technique, fingerprint hash, redacted signature) and clustered to surface emerging campaigns early.
Emerging campaigns forming
A technique/technology probed recently by several distinct sources — correlated to the registry so a virtual-patch rule can be pre-staged.
Technique clusters
Cross-fleet anomalies consented
Correlation runs only across clients who opted in (fleet_opt_in). When the same anomaly hits several opted-in clients, it surfaces here.
Fleet-wide patch recommendations
Recommendation only — a fleet rollout still runs the reviewed, per-asset-authorized deploy path that skips anything unauthorized.
Consent — opt an engagement in / out
Scheduled jobs —
The in-app scheduler runs these on their interval (DB-leased, so once across all workers). Edit cadence, toggle, or run on the next tick.
Send test email MessagePipe
Sends a branded test through the passthrough integration. "skipped" means MessagePipe isn't configured yet (safe dry run).
Audit log append-only
Invite a team member admin
Creates an operator or admin account and emails a one-time link to set their own password — no temp passwords. Admins can manage the team; operators run the console.
Team members
Audit requests
Customer-initiated requests. Triage and convert to engagements.