If you run a company of one on AWS, your security posture lives in eleven consoles you never open. GuardDuty findings nobody reads. IAM access keys nobody rotates. Certificates that expire on Saturdays. Dependabot alerts in the hundreds. You can’t justify $10k/year for a compliance platform, and you don’t need one — you need awareness and prioritization.

The job to be done, stated plainly: tell me what’s wrong across my accounts, what changed since yesterday, and the one thing I should fix this week — without me opening consoles.

That sentence is why AntWatch is a digest first and a dashboard second.

Dashboards are where findings go to be ignored

A dashboard is a pull medium: it only works if you build the habit of opening it, and the whole premise of the problem is that you don’t open security consoles. Adding a twelfth console — even a pretty, consolidated one — doesn’t change the physics.

A daily email is a push medium. It arrives whether or not you remembered security exists today. So the design rule I wrote into the product docs is: the digest is the product; the dashboard is the drill-down. Every architectural decision follows from it. The digest leads with a score, what moved since yesterday, and the worst findings first. The dashboard exists for the minutes after the email made you care — trend, pillars, the full findings table.

A score you can explain

Every scoring system faces the same failure: either it’s so generous it’s meaningless, or one noisy source flattens it and you stop looking. AntWatch’s scoring is deliberately simple, because a buyer must be able to explain their own score:

  • Each data source is a pillar, scored 0–100; the overall score is the equal-weight mean, so one bad pillar can’t zero you out.
  • Findings are deduplicated by control — “control X, 187 resources” is one line with a count, not 187 rows.
  • Severity deductions are capped per band, so three hundred Medium findings can’t bury a new Critical. Criticals are uncapped — four criticals flattening a pillar is signal, not noise.
  • Clean pillars count. A collector that ran and found nothing lifts your score, which is the honest reading of “your certs and domains are fine.”

Dogfooding made the case for honesty concrete. My first deployed digest scored my personal AWS account at a noisy, inflated-severity 42. After the dedup, caps, and seeded-pillar refinements the same account scored an honest 61 — a number I could defend line by line — and climbing it into the 80s meant actually fixing things, not tuning the formula.

What it actually caught

The first digests weren’t subtle. They flagged a console user without MFA (fixed the same day) and two access keys past the 90-day mark, named by user and key id — zero noise, immediately actionable. It also surfaced a monthly budget blowing through its limit, which is the kind of finding a solo founder feels in the wallet. None of these required a SIEM. They required something that looks every day and tells you.

Your security data never leaves your account

AntWatch is self-hosted by design: a CDK stack you deploy into your own account — Lambda, DynamoDB, EventBridge, SES — with near-zero idle cost, because a tool for solo founders can’t cost $50 a month to sit there. No multi-tenant SaaS, no third party holding your findings. When it goes on sale, the license check is the only thing that ever phones home.

That’s custody as a feature. A security product that exfiltrates your security data to score it has a strange definition of security — and for the solo founder, “it’s all in my account” is one less vendor review, one less breach-notification clause, one less thing.

AntWatch is in dogfood now and opening for early access soon. If a daily score in your inbox sounds like the right shape for this problem, the subscribe box below is the place to hear about it first.