Launch HN: Overwatch (YC S22): OSINT platform for cyber and fraud risk

Thank you! It definitely didn't feel quick. We had a 3 month audit window and we used Vanta.

I love it! We’ve seen the job title change a bit depending on the sector but can be under fraud analyst, threat intel analyst, risk analyst, financial crime analyst, sometimes trust and safety teams.

Titles vary greatly but the general domain is information security and cyber security. Here is a good primary of basic qualifications and duties for a given role (Generic, not tuned to a specific company) - https://www.cyberseek.org/pathway.html

This type of information (OSINT of vulns/cves, proof of concepts) is useful for the Blue team side of defending against attackers. With easy to access information in a timely manner, the defenders can proactively put roadblocks and alerts into place for vulnerabilities as opposes to AFTER they are popped/hacked by such.

Prevention is ideal; detection, a must.

There's no getting into anything you haven't already been doing 6+ years right now.

Great point! From some of our case studies we see users catch 25% more 3 days earlier than other solutions.

To your point catching every threat or every alert especially on darkweb is always a cat and mouse game. Our idea is a prioritization problem – how do you mitigate the biggest risks quickly.

The existing OSINT tools we used are keyword search based / pretty noisy so we’ve been focusing on the idea that given there’s no way analysts can find or triage every alert, how do you catch the biggest stuff. We do a few things from AI crawlers to continue to expand data collections to AI categorization, clustering, data extraction etc to make it easier to track the cover the most ground.

Definitely! Would love to chat more. A lot of our users want more customized monitoring / agent versions of this, and our dashboards are pretty easy to customize.

Opening up certain components of the platform is something we are definitely looking into and passionate about.

I can jump in on the data source question - we can track specific accounts and keywords on Twitter, we aren't paying for the full firehose yet. We also track those original ransomware and dark web sites and blogs being referenced and just figuring out how best to cluster them all into the same event. Thanks for checking it out!

AI tool with the same name as a game where a robot uprising is one of the main backstories seems like it could be a bit problematic...

Trademarks are namespaced by subject matter.

Maybe split the difference by naming Sombra the CTO

I disagree - I think the name is great.

Consider Venn diagrams: the audience for these two homynymous products has small overlap. Further moderated when you consider term stickiness to respective meanings is only high for a small fraction of that audience.

In other words, most people aware of both can cope with a mutual name. And some may even think it's cool. Each name enhancing the other through association and analogy.

Overwatch is definitely the right choice. Consider the 'OG' meaning originates from military terminology. In this context, "overwatch" refers to a tactical position where one unit provides covering fire and surveillance for another unit as it moves forward or performs an action. The overwatch position is typically elevated or strategically placed to have a clear view of the battlefield, allowing the overwatching unit to detect threats and engage enemies to protect the advancing or exposed units.

This concept ensures that the moving or vulnerable unit can operate with reduced risk, as the overwatching unit can neutralize potential dangers and provide critical information about the surroundings. The practice of overwatch is a fundamental tactic in military operations, emphasizing teamwork, communication, and strategic positioning.

It is also, and more to the point of being a real trademark issue, the name of a managed threat hunting service from Crowdstrike.

Doesn't the government have a program named overwatch as well? Something in the air force cyber transport division...

In 3 important ways besides price: -Personalization: The platform can be fully customized to your interests, e.g. 3rd party vendors, tech stack, products, peers or industry. It’s like having your personalized threat intel org that cuts through the noise. Each of the alerts are ranked and tailored to your interests. -Customization: The platform can be used for a range of use cases, with agents undertaking tasks ranging from finding and extracting check, loan, and credit card fraud, risky narratives about your brand, through to breaches or emerging ransomware groups targeting your tech stack or vendors. Those agents can even identify breaking events that could be near your assets. -So what and now what: Each report provides finished intel, whether finding or extracting relevant indicators of compromise, background on the threat actor and victim, compromised credentials, or compromised credit cards and checks. We can even automate workflows through integrations or creating cases/escalations for specific teams.

In 3 important ways besides price:

-Personalization: The platform can be fully customized to your interests, e.g. 3rd party vendors, tech stack, products, peers or industry. It’s like having your personalized threat intel org that cuts through the noise. Each of the alerts are ranked and tailored to your interests.

-Customization: The platform can be used for a range of use cases, with agents undertaking tasks ranging from finding and extracting check, loan, and credit card fraud, risky narratives about your brand, through to breaches or emerging ransomware groups targeting your tech stack or vendors. Those agents can even identify breaking events that could be near your assets.

-So what and now what: Each report provides finished intel, whether finding or extracting relevant indicators of compromise, background on the threat actor and victim, compromised credentials, or compromised credit cards and checks. We're training our agents to be even more specific with answers e.g. "what IOCs relate to malware groups most active in the airline industry". We can even automate workflows through integrations or creating cases/escalations for specific teams.

Some of our customers said they spend around 3hrs a day on navigating new vulnerabilities alone. Step 1: wading through info from some easy and some hard to access sources; Step 2: trying to bring together all the most relevant information. E.g. just detecting your payroll provider got ransomed is just one step, then you have to research the group, any indicators that you might also be infected etc. then step 3: what do I do next? e.g. adding relevant hashes to virus total.

We not just help with relevant detection, but also automate some of the next two steps as well. Bringing the total weekly time saved down to a few minutes a day.

That's definitely the vibe of the example we're presenting. But for specific customers, the agent can cluster and bring additional relevant context to each of the 'events', and even recommend actions / automate certain actions e.g. if you detect a compromised account, send it team X.

Just an offtopic heads-up that emails in HN profiles aren't visible to other users, only to admins.

If anyone wants to share an email address with other users, it needs to go in the About box.

We totally hear you and that’s why we don’t really charge by keyword but instead look at how many agents we need to deploy/ use cases we build towards. A 1000+ assets is the norm for our users. Would you be interested in connecting on a call to better understand the use cases and tell you more about how it works?

RF contracts are heavily services based and cost up to 7 figures for tailored intel across a number - we delivers a similarly personalized experience but for a fraction of the price. AI agents can also do a range of additional and customizable tasks e.g. bringing together relevant context about a threat actor, tracking fraud methods, compromised checks and cards, narrative analysis, geopolitical disruptions etc. They can also be automated to create new escalations and actions through integrations. It's like having RF data as well as digital analysts to do a lot of the leg work for you.

EDR's are a great way to help secure endpoints but high fidelity threat intel which is tailored to your environment and org's needs can help increase awareness and shine light on potential security blindspots. This is especially critical when the threats are ever evolving and time to exploit is decreasing year over year. Qualys in a 2023 report stated that "25 percent of these security vulnerabilities were immediately targeted for exploitation, with the exploit being published on the same day as the vulnerability itself was publicly disclosed. They offer some outside the perimeter threats but by reputation, it’s a weakness and narrowly targeted to your organizations credentials and vulns, and orgs usually still need a threat intel provider. For example, one of our users who already uses an EDR, may not know about a 3rd party that’s been ransomed by a threat actor e.g. APT 73. An alert from Overwatch saying a 3rd party has been compromised will also include information about recent IOCs e.g. hashes and file extensions attributed to that threat actor so that the user can add them to virus total and scan internally to make sure they haven’t been compromised. This is an example of how EDRs and threat intel can work in concert.

Also storyline type demo sucks. A simple video that I can rewind will be preferred.

Our current users are CISO's security ops team, threat intel team, blue team, fraud strategy or fraud intel team. Hope that helps!

Now there’s “Overwatch” the game, “Overwatch” the anticheat platform, and “Overwatch” the OSINT platform!

Great points - can say this is all 'coming soon'! One note, because this profile isn't personalized to a particular user's products, tech stack, and 3rd party/ supply chain, it's especially chaotic. For a more tailored profile, the social, news, and dark web posts all cluster around a specific events since there are far fewer critical events of interest to a specific user. No excuses, just sharing for background. Interesting point on the hedge fund use case, haven't been able to find a good user/ persona to interview about that and would love any suggestions if you have any. Thanks again for checking us out.