In development · no public build yet

NiteWatch

Somebody's knocking on your door at 3 a.m. Here's who.

A consumer endpoint monitor for Windows that keeps a permanent record of every outbound connection your machine makes, reconstructs the chain of events that caused it, and tells you what happened in a sentence you can actually read.

Take the walkthrough Get on the early list

The problem

Your antivirus gives you a receipt. Not an answer.

"Threat quarantined." Great. What was it? How did it get on the machine? What did it touch before you caught it? Did it send anything anywhere? Consumer security tools answer none of that, because answering it requires remembering what happened — and they don't.

What you get today

"Trojan:Win32/Wacatac.B!ml quarantined."

You are exactly as informed as you were before it appeared. There is nothing to click, nothing to read, and no way to find out what it did between arriving and being noticed.

What NiteWatch tells you

"You opened invoice.pdf in Acrobat, which started powershell.exe, which connected to a server in Moldova and began rewriting files in your Documents folder."

Same event. The difference is that one of them is a story with a beginning, and you can decide what to do about it.

What it actually does

Four things, done properly.

The connection ledger

Every outbound connection, attributed to the program that made it: which executable, which destination, which domain, how much data moved in each direction, and when. It's process-attributed netstat that remembers — sortable, filterable, and still there tomorrow. Not a firewall popup you dismiss at 2 a.m.

The causal chain

NiteWatch doesn't just record events, it records what caused what. Click any connection and it walks the chain backwards: the program, what started it, the lookup that produced the address, the files touched around the same moment. This is the part nothing else in the consumer market does.

Alerts written for humans

Every alert is a hand-written narrative plus a numbered playbook — what happened, why it matters, and what to do first. Written per rule by a person, never generated on the fly. When minutes matter, step one is the step that limits the damage.

Response you authorise

Stop a process, block an address, quarantine a file, remove a startup entry — each one behind an explicit click, each with an undo path where the operating system allows one. NiteWatch advises. You decide. It never acts on its own.

The differentiator

"Why did that just happen?"

Under the hood, NiteWatch builds a causal event graph — a partially-ordered set with logical clocks, so it can establish that A caused B even when the operating system delivers them out of order or stamps them with the same millisecond. That graph is what makes the following sentence possible.

A connection, explained

You started brave.exe from explorer.exe. It looked up upload.example.com, connected to upload.example.com (93.184.216.34:443) — a network operated by FASTLY (US) — sending 4.1 MB and receiving 120.1 KB. Around the same time it read 14 files in Pictures\holiday.

That is generated text, but it isn't guesswork: every clause is grounded in an observed event. Where the graph can't support a claim, the sentence doesn't make it — a program whose parent was never seen is described as "was already running," not "you started." Confident wrongness is how security tools lose people.

Detection

Fourteen rules, four packs.

Rules are data, not code — readable YAML with the narrative and playbook written alongside the logic, so what fires and what it tells you live in the same file. Here is the whole shipped set. Not a category list: the actual rules.

c2 6 rules · command & control

A destination appears on a public malware-infrastructure feed
A program connects to a raw IP address it never looked up
An unsigned program makes its first contact with the outside world
First contact with infrastructure in an unexpected country
An upload immediately after reading credentials or key material
Connections on a metronome — the rhythm of a check-in schedule

persistence 4 rules · surviving a reboot

An image-hijack registry key pointed at a different binary
An existing autostart entry silently replaced
Something set to start from a temporary directory
An unsigned program added to startup

ransomware 3 rules · your irreplaceable files

Mass encryption confirmed — files are being rewritten right now
Mass file modification suspected — fast, wide, and worth checking
Backup destruction — something is deleting your ability to recover

credentials 1 rule · secrets at rest

A program reading the browser password stores or key material

Thresholds are set by measurement, not intuition. The beaconing rule waits for fifteen check-ins before it says anything, because eight produced eight false alarms per three hundred sequences of ordinary irregular browsing and fifteen produced none. The cost is catching a one-minute beacon on its fifteenth call instead of its eighth. That trade is the right way round: a security tool that cries wolf gets turned off, and a tool that's off catches nothing.

Privacy

Intelligence comes down. Your data never goes up.

A tool that watches everything you do has to be held to a higher standard than the thing it's protecting you from. These are architectural commitments, not policy promises — they're enforced in the code and covered by tests.

Analysis happens on your machine. Threat feeds and the address-ownership dataset are downloaded whole, then matched locally. Nothing automatic ever asks a third party about a specific address, because the question itself would reveal where you've been.
The one outbound query is yours to make. A "who owns this?" button asks a public registry who holds a destination. It never fires on its own — not on ingest, not on a timer, not on page load. The button states what it will do, and to whom, before you press it, and results are cached so a second look doesn't repeat the disclosure.
The dashboard is loopback-only. It binds 127.0.0.1, validates the Host header against DNS-rebinding, and requires a token stored owner-readable on disk.
No kernel driver. Ever, in this product line. NiteWatch observes and advises; it never sits in the path of an operation. That's a real capability limit, accepted deliberately — a bug in a kernel driver is a bug in your kernel.
No automatic response. Every remediation requires a click. A false positive that kills a process you needed is worse than the malware it was guessing at.

Where it actually is

In development. Here's what doesn't work yet.

The flight recorder, the causal graph, the rule engine, the alert UX and one-click response are built and running on Windows. That's the part worth being pleased about. This is the rest of it, because you'll find out anyway and you should hear it here first.

No public build to download. Not yet. There's a list.
The binary is unsigned. SmartScreen and some AV will flag it.
No installer and no service. It's a console app you start by hand.
Windows only. macOS and Linux need entirely different sensors.
No command lines or file hashes. The telemetry source doesn't supply them.
File watching covers your user profile. Other drives are out of scope.
The false-positive rate is unmeasured over a long real session — and it's the number that decides whether the tuning is right.
Threat-feed licensing isn't settled. Several good sources aren't usable commercially without written permission.

None of that is a reason not to build it. All of it is a reason not to tell you it's finished.

See it work.

The walkthrough is a clickable reproduction of the real interface — the ledger, a causal story, an alert with its playbook, and the response actions — narrated a step at a time.

Take the walkthrough Tell me when there's a build