Security agent for AWS and Kubernetes

Something has to stay awake.

Warden is a security agent that lives in your own AWS account: it works every finding, investigates an intrusion while it is still happening, and stops the attacker when you sign once with your passkey.

Warden is in an early access preview. Leave your email and access arrives by e-mail. How the install works.

Add your company and estate size Optional

The agent

It does the legwork, on your Bedrock.

Agents run on Amazon Bedrock inside your AWS account. Rules read what changed every 15 minutes and the whole estate every hour; the agents work what the rules surface, the way a good security engineer would. Nothing goes to us.

  1. Triage

    Every finding, weighed.

    Weighs each new finding against 30 days of your own estate's history. It proposes the false positives away, and catches the quiet finding that belongs to something bigger.

  2. Investigate

    Every dangerous one, worked.

    Turns a dangerous finding into a case. It reads CloudTrail, and EKS audit logs and VPC flow logs where you have them, and builds the timeline, the actors, and what they can reach.

  3. Hunt

    What no rule names.

    Finds enumeration bursts, machine-paced sessions and credentials that mint credentials. It traces each lineage back to the first stolen key from fields AWS recorded, and finds self-replicating AI-agent swarms at any branching factor.

  4. Harden

    The few fixes that matter.

    Turns findings into a short list of fixes and tighter rules, ranked by what an attacker could reach through each one. Every fix is a proposal for you to sign.

The event lane

Every write call in every account is read as AWS delivers it. Within the five-minute cycle the case exists, and with Defend on, its response plan is ready to sign, while the intrusion is still in progress.

Defend

One signature ends it.

For each attack, Warden prepares a response plan and shows you every step in plain words. It contains every attacker identity first: it fences their sessions, quarantines the principals they created, disables their keys and isolates their instances. Then it closes the path they used.

  • Every step is dry-run first
  • Every step is time-boxed and undoable on its own
  • One passkey signature covers the whole plan
  • After you sign, it contains what the attacker creates next, for two hours by default

What Warden may not do itself, such as rotating a secret or rewriting a trust policy, it lists under "You do these yourself".

Defend licenses are not issued yet. They are issued by request while Defend is proven in AWS.

Request Defend access
Ready to sign · 5 steps case k/7Q3F

Under attack: 1 key, 7 principals it created, can reach your signing key.

Proven: 9 facts from 23 records, 2 sources.

  1. 01
    Contain Deactivate access key AKIA…7QF2 origin of the lineage
    Dry run passed Undo · 6 h
  2. 02
    Contain Fence user, refuse sessions issued before apply ‹ci-deploy› ends tokens the key already minted
    Dry run passed Undo · 6 h
  3. 03
    Contain Quarantine 7 roles the key created ‹gen-1›…‹gen-3› created by the attacker
    Dry run passed Undo · 6 h
  4. 04
    Contain Isolate instance i-0c94…e1 calls from its own address
    Dry run passed Undo · 6 h
  5. 05
    Secure Fence the role they assumed ‹deploy-prod› the path they used
    Dry run passed Undo · 6 h
Follow For 2 hours, contain what this lineage creates next, without asking again.
You do these yourself Rotate the secret ‹prod/db› the key read. Remove the 7 roles after forensics.
Signs plan_hash 3f9a…c21e

The command center

Is anything happening to me right now?

The console answers first, in one of five states: watching, suspected, under attack, blinded, or not watching. An attack in progress takes the top of the page. Below it: what needs you, what the agent is handling, your vulnerabilities as stories, what Warden itself costs, and what to turn on in AWS so it sees more. Type "block them" and the plan appears in the chat. You sign it there.

wardensec.example.com Agents: on · $2.10 of $15 today
Under attack since 14:02 · still growing

A key from outside your network is minting roles in account 1111…

Who
1 origin key, 7 principals it created, 2 networks, 1 tool fingerprint
Reach
your signing key, ‹prod/db›, 3 buckets
Response
ready to sign: 5 steps
Ask Warden, or tell it what to stop

Youblock them

Warden

I drafted the response for case k/7Q3F from its lineage: deactivate the origin key, fence ‹ci-deploy›, quarantine the 7 roles it created, isolate i-0c94…e1, then fence ‹deploy-prod›. Each step passed its dry run.

Needs you
  • Plan k/7Q3F waiting for your signature
  • Rotate ‹prod/db› outside AWS
  • 1 contested suppression to decide
Handled by Warden
  • Investigating 1 case, 41 follow-up reads
  • 38 findings triaged today, 31 match 22 of 30 days of history
  • 2 hardening proposals drafted
Vulnerabilities
  • ‹ci-deploy› can reach your signing key in 2 steps from the internet
  • A snapshot is shared with an outside account
  • 2 clusters accept public API traffic
What Warden costs
  • $130 a month for this install, plus models
  • Models today $2.10 of $15, reserve $30
  • Month estimate from 7 days: $61
See more: turn these on in AWS
  • S3 data eventsonce on, object reads become visibleabout $9/mo
  • EKS audit log, cluster 3once on, who did what in Kubernetesabout $4/mo
  • VPC flow logsonce on, where an instance talks toabout $11/mo
The Now page during an attack. An example estate, rendered in HTML.

Contained

Easy to find. Easy to remove.

One namespace

Everything Warden runs lives in the wardensec namespace: four workloads, each labelled. In AWS, every resource sits in a named wardensec- stack, tagged, in one application view.

The Footprint page

Every resource it created, in Kubernetes and in each account, with why it exists and what it costs a month.

A clean, guided uninstall

The console shows everything that goes and undoes anything Defend holds first. It removes everything but the tamper-evident ledger, then proves it with warden footprint --after-uninstall.

Footprint $130.10 a month, plus model use
PlaceKindNameWhy$/month
namespace wardensec Deployment wardensec-console the console and signing page in node
namespace wardensec Deployment wardensec-lane the event lane in node
namespace wardensec CronJob wardensec the 15-minute read in node
namespace wardensec Deployment wardensec-egress the one route out in node
cluster Node group wardensec runs the four workloads $31.00
hub account Stack wardensec-hub VPC endpoints, 1 zone $94.90
hub account Stack wardensec-ledger Object Lock bucket, KMS key $4.20

Proof, not opinions

If it cannot prove it, it does not say it.

No model can act, suppress or excuse anything without a person's signature. That is why an attacker who talks to the agent cannot talk it into anything.

Verified evidence

Every sentence an agent shows was checked by code against the records it cites. What cannot be proven is dropped and counted, and every page says what it could not check.

Passkeys

Any passkey signs: a password manager, your phone, or a hardware key if you want one. The signature binds the exact plan, so a stolen console session can ask questions and nothing more.

The ledger

Every read, proposal, signature and step is chained into a ledger in your own account, under S3 Object Lock. It outlives an uninstall.

Two model makers

One model drafts. A model from a different maker has one job: to refute it. A claim the refuter contests is shown as contested, with the counter-fact.

Why not one admin-role agent

Pointing a model at your account is not a defense.

An agent with an admin role and a prompt can read a lot. Here is what it is missing.

One admin-role agent Warden
Continuous presence and memory Arrives once and sees a snapshot. Reads every 15 minutes, plus the event lane, and remembers every case.
Baselines of your estate Has no idea what is normal here. Learns each principal's normal over 30 days, only from calls nobody is accused of.
Read-only by construction Holds admin, so one injected tag can make it act. The model holds an invoke-only credential. Every read is a closed list run by code.
Quarantined attacker text Reads raw names, tags and user agents, so it can be steered. Sees fenced handles, never attacker-written text, with a decoy and a leak token on every call.
Decoys Cannot tell an attacker from a tenant. Embers: decoys nobody legitimate touches, so a touch is close to certain.
Verified evidence States conclusions. Shows only what code proved from cited records, checked by a second maker.
An authorised response Does nothing, or acts on its own. A plan with dry run, time box and undo, signed with one passkey, every step recorded.

Pricing

Watch is free. Defend is the paid plan.

Watch

Free license

The agents, the console, every case and finding, the posture stories and the hardening proposals. Warden reports and proposes, and takes no action in your accounts.

Defend

Paid plan, by request

Everything in Watch, plus response plans: one passkey signature to contain the attacker and close the path, every step undoable.

You pay AWS for what Warden creates in your account. Setup prints a dollar line for each item before it creates anything, and the Footprint page keeps the total in view.

Install

Get early access.

Warden is in an early access preview. Leave your email and access arrives by e-mail, with the install line. The Install page shows that line and the script it runs, for anyone who wants to read them first.

Add your company and estate size Optional

You need one AWS account, an EKS cluster and a domain you control for the console and the signing page. An estate is the AWS accounts and EKS clusters one hub watches: a single account, or an organization's accounts.

The install, step by step

  1. curl | sh installs one program, warden, verified against the release keys it carries.

  2. warden setup prints what it creates and what it costs, then creates the read-only roles, the hub and the chart.

  3. You become the first keeper in the browser, with your passkey.

  4. Add your Watch license from this site, and Warden starts watching.