← All products
Security & software
In developmentHearthward
An on-premise early-warning system for a single machine — it notices file tampering, ransomware-style encryption, and sneaky autostart changes, and keeps a signed record you can trust as evidence.
What it does
- File-integrity monitoring (SHA-256 + BLAKE2b) that catches content, permission, owner, and attribute changes
- Entropy detection — a file that suddenly turns high-entropy is flagged as probable encryption/ransomware
- Ransomware canaries (honeyfiles) — one trip is a warning, a mass trip means ransomware in progress
- Registry monitoring of autostart/persistence keys — a new Run-key value is flagged HIGH
- Real-time watch with velocity detection — a burst of changes in seconds reads as an attack underway
- A tamper-evident, append-only, HMAC-signed event log (with a verify step) — the record can't be forged or edited
- Optional containment (kill a process, cut a share) — off by default, report-only until you enable it
How you'd use it
- Runs on one Windows box, stdlib-only, with no network egress unless you set up an alert sink
- Point it at the files, folders, and registry keys that matter; it learns the baseline
- Get alerts (syslog / CEF / JSONL / email) and a signed report of exactly what changed
Try it
Interactive demo · sample data, not a live system
/etc/hosts Unchanged
app.config Unchanged
Payroll_2027.xlsx (canary) Untouched
Watching 3 files. Integrity verified.
Where it's at: Version 0.2 is built and tested — 36 unit tests green plus an end-to-end smoke test. It ships as code with a generic example config; your real watch-list stays on your machine, never bundled (shipping it would hand an attacker a map). Ready to pilot on a single box.
Price & availability
Not for sale yet, so there's no price. Version 0.2 is ready to pilot on a single Windows machine — ask us about a pilot.