Sentinel keeps watch on your server day and night, and it answers on WhatsApp. Ask what it sees at any hour, tell it to block an address or lock down access, and it replies with what it did.
Sentinel
AI Partner
Online
Sunday, 23:41
You said: Anything wrong right now?
Sentinel said: Two things. A critical OpenSSL advisory is open on app-01, and 1,208 failed SSH logins came from 203.0.113.44 in the last hour. The logins are still arriving.
You said: Block that address.
Sentinel said: Blocked. Traffic from 203.0.113.44 is denied at the firewall.
ufw deny from 203.0.113.44
logged23:42 SAST
verifiedruleset re-read, 0 accepts
Semgrep, gitleaks, npm audit, OWASP ZAP, Lighthouse, axe and k6, mapped to OWASP Top 10 and CIS Benchmarks.
The sweep finds things. The thread is where you deal with them, at whatever hour you happen to look.
Every action is logged with the time and the change, so you can see what was done and undo it.
“Block 203.0.113.44.”
The address is denied at the firewall, the rule is logged, and the ruleset is read back to confirm it.
ufw“Lock down ssh.”
Password login and direct root login are turned off, the previous config is kept, and the change is tested before Sentinel reports back.
sshd“What changed since Friday?”
Every file, package and inbound rule that moved, in time order, with the diff.
diff“Who is on the box right now?”
Open sessions with the source address, the login time and the command in front of each one.
whoA sweep runs on your schedule. The report arrives in the thread.
Sentinel maps the attack surface: services, ports, routes and dependencies.
Dependency audit, static analysis, secrets scan, dynamic scan and load checks run against the target.
Findings are deduplicated, scored by severity and exploitability, then ranked.
One report in the thread with evidence and a fix for each finding, and what changed since the last sweep.
The thread gives you the short answer. The report holds the rest: one entry per finding, in severity order, with the evidence Sentinel collected and the command that closes it.
Anything you fix is re-tested on the next sweep and marked verified only when the check passes.
sentinel sweep host: app-01 2026-10-26 02:00 SAST
duration 11m 42s checks 214 findings 6 new 2 resolved 3
[critical] CVE-2026-XXXX openssl 3.0.13 CVSS 9.1 fix: apt upgrade openssl
[high] ssh PermitRootLogin yes /etc/ssh/sshd_config fix: set to no, reload sshd
[medium] missing header Content-Security-Policy nginx fix: add policy, see snippet
[medium] express-rate-limit absent on /api/login fix: add limiter, 5 req/min per IP
[low] TLS 1.0 enabled on port 8443 fix: restrict to TLS 1.2 and 1.3
[info] drift: /etc/nginx/conf.d/app.conf changed since 2026-10-24Example report. Values are illustrative.
app-01, openssl 3.0.13, reachable on port 443
openssl 3.0.13 installed 2026-05-14
fix in 3.0.14 available on the security channelFix apt update && apt upgrade openssl
app-01, /etc/ssh/sshd_config
PermitRootLogin yes was line 32
PermitRootLogin no now line 32Verified Re-tested 2026-10-26 02:00 SAST: root login refused, password authentication disabled.
Sentinel reads your server, and it can change it when you say so. Here is how far that goes and where it stops.
Three stages. Pricing depends on the size of the estate, so we quote after the briefing.
Thirty minutes on your stack, what Sentinel would watch and what the first sweep would cover.
No charge
Scoped access, a baseline sweep, and your number added to the thread.
Contact us for pricing
Daily sweeps, answers in the thread at any hour, and a message when something critical appears.
Contact us for pricing
No. Sentinel runs on a business number and you message it from the WhatsApp you already use. Nothing to keep open on a desktop.
A scoped account on the server, read access to your repository, and read only credentials for the services it checks. Nothing wider than the checks require.
Yes, when you ask it to. It reads without asking and changes only on a message from you. Anything that could lock you out needs a second confirmation first.
The sweep runs on schedule, and a critical finding is sent when it is found rather than held for the morning. You can reply then, or read it with coffee.
By severity and exploitability, using CVSS where a CVE exists and reachability where it does not. Anything reachable from the internet comes first.
It reports the location and type of a leaked secret, never the value, and recommends rotation. Values are redacted in reports and logs.
Remove the account or ask us to. Access ends there, and your reports stay yours.
Ask it what it can see on your server. If you would rather talk it through first, book a briefing.