# AI Watchdog — 24/7 server monitoring and automatic threat response | RootCore LLC

> An in-house monitoring system that analyses server traffic and logs in real time, blocks attackers automatically, and sends a written report every week.

Page: https://cyber-security.rootcr.com/en/ai-watchdog/
Updated: 2026-08-20

---

# AI Watchdog — continuous monitoring

> **In short:** A hardened server does not stay protected on its own: new vulnerabilities appear, systems change, and attacks run at night too. The AI Watchdog is RootCore's in-house monitoring system: it analyses traffic and logs second by second, responds to suspicious patterns without human intervention, and sends a written weekly report on what happened.

## Why is a monthly check not enough?

Because attacks do not happen once a month. The typical case looks like this: at two in the morning an automated attempt sequence starts, runs for a few minutes, and either succeeds or fails. If somebody looks at it in the morning, all they see is the consequence.

Continuous monitoring covers those few minutes. It is not better because it collects more data — it is better because the response does not wait for a human.

## What does it watch, and what does it react to?

| What it watches | Example response |
|---|---|
| Login attempt patterns | Blocking the source after repeated failures |
| Network traffic and port scanning | Excluding the scanning source, recording the pattern |
| Web request content | Rejecting requests carrying attack patterns |
| System logs and processes | Alert on unusual processes or privilege changes |
| File integrity | Alert when a file that should not change is modified |
| Certificates and expiry | Advance warning before anything expires |
| Resource usage | Alert on load anomalies before the service goes down |

## What does the client get?

- **Alerts** when something actually happened — not for every event, because that defeats the purpose.
- **A weekly report** on how many attempts arrived, what the system blocked, and whether anything changed in the security posture.
- **A searchable trail** for incidents: when, from where, what happened.
- **A monthly review**: tuning the rules against real traffic.

## What does it cost and how does it start?

Monitoring is billed monthly; the fee depends on the number and complexity of the protected systems. Getting started includes an [assessment](/en/server-security/): it is only worth monitoring what has been put in order first. We quote after the assessment, as a fixed amount — the assessment is free and commits you to nothing.

## Frequently asked questions

### What does the system see on my server?

Logs, network events, process and file-level changes — that is, operational data. Customer data stored in the application database is out of scope; we do not collect it.

### What if a false alarm blocks somebody?

Blocks can be reverted, and patterns can be learned: the point of the regular review is exactly to remove false positives. On critical business routes (payment, login) we set stricter conditions so that the chance of a wrong block is as small as possible.

### Does this replace backups?

No. Monitoring is about preventing attacks and detecting them early; backups are about having somewhere to restore from when things go wrong. The two complement each other, and we review your backup routine during the assessment.

### Does the service have to be stopped for rollout?

No. Monitoring is added alongside the running system, without downtime.

### Can it be cancelled?

Yes, monthly, with no minimum term. On cancellation the system is removed from the server and the logs it produced are deleted.