About us

Built by people who work the cases.

WardTower comes from practitioners in incident response, offensive security, purple-teaming and assurance. We run security operations for our customers, and we build the software we do it with.

Why we started

Most of an investigation is stitching.

An alert names a host. The account behind it lives in the identity provider, the process tree is in the EDR, the mail is in another console, and the last time this happened is in a closed ticket nobody remembers. Every analyst rebuilds the same picture by hand, and the picture is gone once the case closes.

Automation was supposed to help. What we kept seeing either followed a fixed playbook that broke on the first unusual case, or wrote a confident summary that didn't survive the post-incident review. Neither one could say "the evidence isn't there, a person should look at this."

AI added another problem. To be useful, an assistant needs to reach your EDR, your SIEM and your identity provider. Too often that reach comes from a permanent key pasted into a settings file, with no record of what was done with it.

So we built Steward to keep the picture together and stop when the evidence is weak, Omni to control what people and AI can reach, and Automaton to carry out the follow-up with a person signing off. Then we started running security operations on top of them, because the best way to know whether a tool works is to rely on it at night.

The name

Why WardTower.

To keep ward is an old way of saying to keep watch, and a tower is where you keep it from. That's the job: someone awake and paying attention, high enough up to see how the pieces connect, and honest about what they can and can't see from there.

What we hold to

Rules we work by, and test.

Stop when the evidence is weak

A system that can't say it doesn't know isn't ready to close a case. Weak or contradictory evidence goes to a person.

A person makes the risky calls

Automation gathers evidence, makes suggestions, and can send messages and open tickets. Anything that changes your systems, accounts or records, and any containment, waits for a person to approve it.

Access for a case, not forever

An AI assistant gets only the tools one investigation needs, for a limited time, with a second person's sign-off by default.

Your data stays yours

Each customer gets a separate Omni with its own data and encryption key. We don't train models on your data.

Every decision shows its work

The questions asked, the evidence reviewed and the reason for the verdict are kept with the case, so someone else can follow the same path.

We break our own controls

We deliberately break our security controls to prove our tests catch it, and we keep the results.

Who we are

Practitioners who still do the work.

We've worked in assurance and governance, offensive security, purple-teaming and DFIR, across enterprise, cloud and industrial environments.

Assurance

Governance that gets used

Program design, choosing the right controls, and explaining risk in terms executives act on, from years of advisory work.

Offense and purple

We know how attackers think

Hands-on testing and purple-team work show how an attacker actually moves, and we feed that back into how we investigate.

DFIR and MDR

Calm under pressure

Forensics, hunting and containment from people who've handled real incidents and run detection programs, including in OT and ICS environments.