Products · Platforms
Curo / Witness
Early accessReal-time security detection, with audit evidence retained for the long term.
Overview
Witness is security monitoring and audit evidence for Kubernetes in one platform, running entirely inside your clusters — no SaaS, no internet. Agents on every node stream audit events, Kubernetes events, metrics, logs, and syslog to one server. A rule engine turns exec-into-pod, secret access, and RBAC changes into real-time incidents, and the same record is retained long after the cluster discards it, so <em>“who deleted that secret, when, and from which IP?”</em> can be answered in seconds, with a CSV export. Built for SOC 2, ISO 27001, and PCI evidence.
DEPLOYS — inside your clusters, an agent on every node · offline install bundle · TLS-encrypted agents · web console.
Every product comes with an accountable owner.
- A named engineer owns each deployment — our products encode the Curo standard rather than dilute it.
- Autonomy is earned per customer, per workflow — no product is fully autonomous on day one.
- Exit-ready by design — your data, your logs, exportable at any time.
More in Platforms
Talk to the engineers behind Curo / Witness.
Every engagement begins with a 45-minute working session with a senior engineer.