The rail does not lie.
Runtime detection for the power layer that reads the physics instead of the self-report: a verdict in 20 ms, from evidence a compromised host cannot forge, delivered into the tools your SOC already runs.
Request a pilotDetection that reads the physics, not the self-report.
Every security tool you run asks a device how it is doing. PWX measures what the power rail actually does, a hundred times a second, and raises a verdict from that measurement: a setpoint rewrite, a rail outside its safe range, a controller reporting one voltage while the rail runs at another, energy that no scheduled work explains.
- Five detectors on every rail: safe operating area, drift, commanded vs measured, multivariate baseline, energy balance
- Attack to verdict in 13.6 to 20.1 ms across eight dated bench runs
- 95 of 95 attack cycles detected; 99.62 % quiet over a 30-minute run
What the host and firmware report
What the rail physically does
A compromised host cannot hide from the rail.
Once a host or its firmware is compromised, everything it reports can be a lie, and tools that watch from the host go blind with it. The PWX agent runs in the BMC, outside the host's trust domain, and reads the rail directly. Firmware can forge a status; it cannot forge the electricity.
- Agent in the BMC: out of band, independent of the host OS and its EDR
- Commanded vs measured: the controller's report checked against the physical rail
- A verdict needs physical or protocol evidence before any power action
Five signals, one incident.
Detectors are signals, not alarms. A verdict engine fuses them into one state with hysteresis and persistence, so a thousand frames of evidence become one incident with the asset, the rail, the command, the closest ATT&CK technique and a signed audit chain. Analysts get the three findings that matter, not the firehose.
- One episode record per incident, with every layer that fired
- Closest ATT&CK mapping and a tamper-evident SHA-256 chain
- Fleet-wide correlation across servers and racks in the pilot
From detection to response, in order.
A verdict is only worth what happens next. Today the evidence lands in your SIEM in under a second and your SOAR or NAC can isolate the BMC port on it. On the roadmap, PWX-06 filters power commands inside the BMC and drops a malicious write in milliseconds, before it ever reaches the rail.
- Today: 20 ms detection, evidence in Splunk and Datadog
- Pilot: your controls act on the verdict
- Roadmap: PWX-06 inline blocking and fleet rules