7 ms·
Launch HN: Overwatch (YC S22): OSINT platform for cyber and fraud risk
Hey HN! Arjun and Zara here - cofounders of Overwatch (https://www.overwatchdata.ai https://www.overwatchdata.ai), a platform to automate OSINT and threat intel, turning it into actionable insights. Check out our clickthrough demo here: https://app.storylane.io/share/qyayvtamapis https://app.storylane.io/share/qyayvtamapis.
Overwatch began when we were working with risk and threat intel teams at Google, Stripe, and government. We experienced the immense challenge every fraud and cyber threat analyst faces: manually parsing through an ocean of data to find valuable insights and filter out the noise. This included using many of the feeds and tools out there that were often very expensive, noisy, keyword-based, and lacked accurate entity extraction or advanced query features.
Most threat intelligence tools utilize thousands of keywords and teams of analysts to manually sift through torrents of alerts. These alerts are usually individual posts on various platforms across news, social media, deep and dark web sources that have some matching keyword. This is full of false positives, requiring many hours to wade through to figure out what intel matters most to our users, why, and what they can do next.
Overwatch uses an alternative approach by layering AI agents and NLP techniques, including a combination of multifarious datasets, cluster analysis, topic modeling, Retrieval Augmented Language Models (RALM) and domain knowledgeable agents.
This allows us to (1) Filter through OSINT in real time to identify events and narratives that matter to our users, and write reports on what they could do about it; (2) Identify dark web and deep web threats, fraud methods, new tactics, and compromised accounts, stolen checks, and credentials affecting our users or their peers; (3) Send an alert any time one a 3rd party supplier or parts of the tech stack are impacted by a widely exploited vulnerability, ransomware attack, or breach; and (4) Track malware and ransomware groups that are actively targeting your industry including Indicators of Compromise (IOCs).
Our intelligence is actionable because the alert comes with the context and important details that an analyst needs to make an informed decision. Being AI-native, we also have a range of chat and data visualization features to effectively function as an intel co-pilot or industry expert. Finally, our in-house intelligence analysts and investigators can assist threat intelligence teams with HUMINT investigations and darkweb acquisition.
Our current customers include internet platforms, financial institutions, and supply chain companies. Within a day of one breach, one of our customers used Overwatch to surface 18,000+ leaked credentials. Another used us to surface fraudulent checks and learn exactly how threat actors were targeting their specific product features.
Our website says “Request a demo” but if you want to poke around on a very basic example of how we’re aggregating dark web, deep web, social, and surface web, log in at https://app.overwatchdata.io/ https://app.overwatchdata.io/ using these credentials:
username: try_overwatch@overwatchdata.io
pw: HelloHNWorld
That login is for an un-personalized feed of cyber threat intel (breaches, vulnerabilities, ransomed organizations, and industry updates) that gives you a flavor of not just the kind of information from which we can collect, but more importantly, how our technology prioritizes, clusters, and summarizes alerts for cyber / fraud analysts. Try the chat agent on the left-hand side to parse through the data.
Or sign up for a longer trial and preview of our email alerts: https://xryl45u9uep.typeform.com/to/pvtZQyS0 https://xryl45u9uep.typeform.com/to/pvtZQyS0. You can also check out our clickthrough demo for dark and deep web intelligence: https://app.storylane.io/share/qyayvtamapis https://app.storylane.io/share/qyayvtamapis.
Integration options range from simple dashboard access to our API for those who want to weave our intelligence directly into other products. Pricing is dependent on how complex a threat landscape our users want to monitor and we’re still figuring out how to standardize this but we’ll always do our best for the HN community.
Since the platform is AI-powered, it can also be used for news monitoring, supply chain disruptions, regulatory monitoring, or social media monitoring. We’ve had a lot of experience wrangling text-based feeds and using numerous AI-models (from embeddings, entity extractors, and LLMs) to filter, categorize, cluster, and analyze the data into meaning - so let us know if you’d like to nerd-out or have had any particular challenges. Looking forward to your feedback and questions! Thanks, HN!
- ssahoo 2y agoCongratulations on the launch. I noticed that you guys are SOC2 type II certified. I wonder how did you achive that so fast?
- Bisen 2y agoThank you! It definitely didn't feel quick. We had a 3 month audit window and we used Vanta.
- technick 2y agoWaiting that 12 months to really demonstrate you have a working security program with efficient controls really pays off. It's something I look for when doing vendor reviews and I assume others do the same.
- Bisen 2y agoThat makes sense, we're going through our annual renewal now. It's a great experience to harden and test systems.
- jronald 2y agoFor the first SOC2, I don't hold this against a startup (I appreciate they are going through the efforts this early). Would want to see it become 6 month/1 year as the program matures. A vendor like this is low risk (aggregator of "public" information, limited data sharing, etc). I have all sorts of issues with Vanta/Drata "compliance as a service" tools, but adequate for something like this, at this point in time.
- fullspectrumdev 2y agoTbf, I’ve found it’s a good sign when an org goes through this pain early on - less chance for tech debt to pile up. Most of my employment has been in the security auditing/testing space, and the difference between “bolting it on later” and “building it in from the start” is incredible from both a purely technical and a process standpoint.
- 2y ago