Richards Technologies logoRichards Technologies
← All products

Security & software

In development

Holdwatch

A behavioral security watchdog for small networks. Instead of chasing known virus signatures, it learns how your machines normally behave and sounds the alarm when something acts like ransomware or an intrusion — with a record that can't be quietly changed.

What it does

  • Detects by behavior, not just signatures — 8 MITRE ATT&CK-mapped rules plus a self-learning anomaly layer
  • Builds a provenance graph of what launched what, so every alert comes with the story behind it
  • Keeps a hash-chained, tamper-evident audit log — the record can't be quietly altered
  • Signed, anti-rollback updates, so the watchdog itself can't be spoofed or downgraded
  • A weekly self-improvement cycle that re-scores its own detection and auto-promotes or rolls back
  • A live fleet view that shows each machine's real status — and honestly flags stale or offline nodes
  • An AI-safety cage on any automated summary: it can only report what the evidence shows, never invent

Screenshots

Holdwatch dashboard in demo mode: a critical sample incident with its process chain and ATT&CK techniques, a verified audit chain, and the observe-only tier
The Holdwatch dashboard in demo mode — it replays sample events and says so; it is not watching a real machine.

How you'd use it

  • Install the watchdog on each Windows machine (Win 10 22H2 / Win 11)
  • Watch the fleet from one place and get alerted when behavior looks malicious
  • Keep a signed, defensible record of what happened on every endpoint
  • Run it on-premise — your monitoring data never leaves your network

Try it

Interactive demo · sample data, not a live system
Front Desk PC Protected
SERVER-01 Protected
Owner Laptop Protected
Register Protected
Monitoring 4 endpoints. All clear.
Where it's at: The detection engine is built and tested — the behavioral rules, anomaly detection, provenance graph, tamper-evident audit log, signed updater, and self-learning cycle all run today, and it catches a full demo attack chain end to end. It runs in observe-and-alert mode now; wiring live-machine telemetry (via Sysmon) and adding automated response are the next tiers, and the installer still needs code-signing before a wide release. We're preparing a first local pilot.

Price & availability

Not for sale yet, so there's no price. We're preparing a first local pilot — ask us if you'd like to take part.

Ask us about Holdwatch →