AI Watchdog — continuous monitoring
Why is a monthly check not enough?
Because attacks do not happen once a month. The typical case looks like this: at two in the morning an automated attempt sequence starts, runs for a few minutes, and either succeeds or fails. If somebody looks at it in the morning, all they see is the consequence.
Continuous monitoring covers those few minutes. It is not better because it collects more data — it is better because the response does not wait for a human.
What does it watch, and what does it react to?
| What it watches | Example response |
|---|---|
| Login attempt patterns | Blocking the source after repeated failures |
| Network traffic and port scanning | Excluding the scanning source, recording the pattern |
| Web request content | Rejecting requests carrying attack patterns |
| System logs and processes | Alert on unusual processes or privilege changes |
| File integrity | Alert when a file that should not change is modified |
| Certificates and expiry | Advance warning before anything expires |
| Resource usage | Alert on load anomalies before the service goes down |
What does the client get?
- Alerts when something actually happened — not for every event, because that defeats the purpose.
- A weekly report on how many attempts arrived, what the system blocked, and whether anything changed in the security posture.
- A searchable trail for incidents: when, from where, what happened.
- A monthly review: tuning the rules against real traffic.
What does it cost and how does it start?
Monitoring is billed monthly; the fee depends on the number and complexity of the protected systems. Getting started includes an assessment: it is only worth monitoring what has been put in order first. We quote after the assessment, as a fixed amount — the assessment is free and commits you to nothing.
Frequently asked questions
What does the system see on my server?
Logs, network events, process and file-level changes — that is, operational data. Customer data stored in the application database is out of scope; we do not collect it.
What if a false alarm blocks somebody?
Blocks can be reverted, and patterns can be learned: the point of the regular review is exactly to remove false positives. On critical business routes (payment, login) we set stricter conditions so that the chance of a wrong block is as small as possible.
Does this replace backups?
No. Monitoring is about preventing attacks and detecting them early; backups are about having somewhere to restore from when things go wrong. The two complement each other, and we review your backup routine during the assessment.
Does the service have to be stopped for rollout?
No. Monitoring is added alongside the running system, without downtime.
Can it be cancelled?
Yes, monthly, with no minimum term. On cancellation the system is removed from the server and the logs it produced are deleted.