BareketAIBareketAI PWX
Run a free scan
Runtime detection and response

Runtime threat detection and response

Catch attacks and unexpected changes across the power layer of your data center as they happen; from BMCs and firmware to the rails that feed every GPU, and the tenant who held the node at that moment.

Run a free scanRequest a pilot
001TENANT002WORKLOAD003HOST004BMC005ACCELERATOR006RAIL007PSU

Know the moment something changes

PWX constantly compares what your power layer is actually doing with what it should be doing, across the layers your existing security tools cannot reach: the BMC, the firmware, the power cap, the accelerator and the rail beneath it.

Live detection · gpu-pool-bEvery BMC read from outside the host it manages
LIVE
12 s agoBMCBMC user created, then the event log cleared · gpu-node-07N09 · management plane tamperingCRIT
1 m agoFIRMWAREFirmware changed during a tenant session · gpu-node-09N03 · no maintenance window, no ticketCRIT
4 m agoPOWER CAPGPU cap lowered 700 W to 450 W by a person · gpu-node-03N07 · outside automationHIGH
9 m agoBMCBMC login from outside the management networkN09 · source 192.168.40.9HIGH
14 m agoCONFIGBIOS settings differ from the fleet golden buildN10 · 3 of 4 nodes agreeMED
001PWX MONITOR

Detect attacks on the management plane

Spot attacks beyond the reach of EDR across BMCs, firmware, power caps and power supplies. PWX reads them from outside the host they manage, so a compromised operating system cannot switch the watching off, and every finding names the rule and the evidence it rests on.

  • New BMC users, role changes, cleared logs and logins from outside the management network
  • Firmware and BIOS changes off the maintenance window or inside a tenant session
  • Power cap changes made by someone who is not the automation
Suspicious activity on gpu-node-07Five correlated findings across tenant, BMC, GPU and rail in eighteen minutes
CRITINC-0412
02:01CRITRail saw it, no layer above didN15 · PWX-01 verdict, no host or BMC event
02:05CRITBMC power-cycled the node, no ticketN08 · inside the tenant session
02:09HIGHGPU drew above its enforced capN11 · 812 W against 700 W
02:14HIGHNode reported down, still drawing powerN13 · scheduler says down, rail says 1.1 kW
02:19MEDEnergy does not add up between layersN12 · PSU input vs node vs GPUs
Who held the node at 02:05TENANT gamma · JOB train-7 · SLURM
002PWX MONITOR

Catch anomalies across the whole stack

Compare what every layer says, from the scheduler's lease down to the rail, with what the power actually does. Tampering, unexpected changes and work nobody scheduled are flagged as they happen, joined into one incident and tied to the tenant who held the node at that moment.

  • Sixteen cross-layer rules over one graph: tenant, workload, host, BMC, accelerator, rail, PSU
  • Every finding carries the tenant of the moment, the chain it sits on and a one-line reason
  • Into Splunk, Datadog, syslog or your SOAR as an ordinary alert
One chain, one moment · 02:01 UTCFrom the tenant down to the power supply
MISMATCH
TENANTgammaHOSTgpu-node-07BMCiDRAC9GPUH100 · 0RAILVRM_01

What the host and BMC report

Rail voltage 1.80 V
Setpoint changes none
Host EDR no alerts

What the rail measures

Rail voltage 1.62 V
Setpoint write on PMBus T+0 ms
Verdict ISOLATE · 20 ms
003PWX-01

Know when the physics disagrees

Firmware can forge a status; it cannot forge the electricity. Where you need milliseconds, the PWX-01 agent reads the rail a hundred times a second from the BMC and raises a verdict from the measurement itself, before any layer above has noticed.

  • Commanded against measured: the controller's report checked against the rail
  • Attack to verdict in 13.6 to 20.1 ms across eight dated bench runs
  • A rail verdict with no matching event above it is its own finding
ILLUSTRATIVE SCREENS · NODE NAMES AND VALUES ARE EXAMPLES · RULE IDS ARE THE PWX MONITOR RECONCILIATION RULES (0.6.0) · BENCH FIGURES FROM BENCH/FACTS.MD (SEPTEMBER 2026)

From our research

GROUND TRUTH

The rail does not lie

Runtime detection at the rail · PWX-01

Why a verdict read from the electricity holds when the host, its firmware and its EDR have all been turned against you.

Read
PROOF

Attack to verdict, on dated bench runs

Bench evidence

The runs behind the 20 ms figure: what was measured, on what hardware, and what the bench does not prove yet.

Read
SANDBOX

Every rule, on an emulated fleet

Emulated, and labelled as such on every screen

Each reconciliation case injected into an emulated fleet: open an issue and follow it from the tenant down to the rail.

Read

Secure your AI data center

Start with a free, agentless scan of your BMCs. Then a pilot on PWX Monitor, with success criteria agreed in advance.

Run a free scanRequest a pilot