Nightwatch never clocks out.
A 24/7 AI incident agent trained on the same offensive models as Rogue. It knows what an attack looks like from the inside — so it investigates every alert, contains what's real in minutes and has the timeline written before your on-call engineer finds their laptop.
What happens while you sleep.
A real Nightwatch incident, timestamps intact, details changed.
A senior analyst, an incident commander and a scribe.
Nightwatch covers the whole lifecycle — from the first alert to the post-incident review — and shows its work at every step.
Every alert, investigated
Not sampled, not suppressed. Nightwatch queries your SIEM, EDR, identity and cloud logs, writes a verdict and cites the evidence. Teams typically see 94% of alerts closed with no human touch.
Tiered, pre-approved response
Isolate a host, revoke sessions, disable an account, block an indicator — inside the blast-radius limits you set. Anything bigger asks first in Slack or Teams.
Runs the incident
Opens the bridge, assigns roles, keeps the timeline and posts status updates every 30 minutes.
Regulatory clocks
Tracks SEC, NIS2, DORA and GDPR deadlines and drafts notifications for counsel.
Fed by Rogue
Every attack Rogue lands that went unseen becomes a detection Nightwatch drafts for your SIEM.
You decide how far it goes.
Autonomy is a dial, not a switch. Most teams start at tier 0 for two weeks, review every verdict, then turn the dial.
| Tier | Examples | Runs |
|---|---|---|
| Tier 0 — Investigate | Enrich, query logs, message the user to confirm activity, open a ticket | Always, autonomously |
| Tier 1 — Contain | Isolate a workstation, revoke sessions, reset MFA, block a domain or hash, quarantine email | Autonomously within your confidence and blast-radius thresholds |
| Tier 2 — Disrupt | Production servers, privileged or service accounts, firewall rules, cloud resource changes | Only with a human approval tap |
Customer perspective
We used to page someone eleven times a week. Now it's once, and when it happens the containment is already done and the brief fits on a phone screen.Head of Security Operations, global payments network
Nightwatch, answered.
Want to see it on your own alerts? We run a two-week shadow trial: Nightwatch investigates in parallel and changes nothing.
What is an AI SOC agent?
An AI SOC agent is software that performs the investigative work of a security analyst: it takes an alert, gathers evidence from your SIEM, EDR, identity and cloud logs, reasons about whether it is malicious and writes up its conclusion. Nightwatch goes further and can take pre-approved containment actions and run the incident timeline.
What can Nightwatch do without a human?
Only what you pre-approve. Containment actions are grouped into tiers: tier 0 (enrich, ask the user, open a ticket) runs freely; tier 1 (isolate a workstation, revoke sessions, disable a non-privileged account) runs when confidence and blast radius are within your thresholds; tier 2 (anything touching production servers or privileged identities) always requires a human tap in Slack or Teams.
How does Nightwatch avoid hallucinated conclusions?
Every claim in a Nightwatch verdict is linked to the log query or API call that produced it, and verdicts that cannot be grounded in evidence are escalated rather than closed. You can replay any investigation step by step.
Which tools does Nightwatch integrate with?
SIEMs including Splunk, Microsoft Sentinel, Google SecOps and Elastic; EDR from CrowdStrike, SentinelOne and Microsoft Defender; identity from Okta and Entra ID; AWS, Azure and GCP audit logs; email security; and Slack, Teams, PagerDuty, Jira and ServiceNow for response.
Does it help with breach notification deadlines?
Yes. When an incident crosses a materiality or reporting threshold you define, Nightwatch starts the clock and drafts the relevant notification — such as the SEC Form 8-K Item 1.05 four-business-day disclosure, the NIS2 24-hour early warning or a DORA major ICT incident report — for your counsel to review.
Run a two-week shadow trial.
Nightwatch investigates your real alerts in read-only mode next to your current team. At the end you get a side-by-side: verdicts, time saved and what it would have contained.