Know what's on your network — and what's exposed beyond it.
Continuous wireless, network, and perimeter monitoring for offices, data centers, and facilities that can't afford blind spots.
Built for environments where an unauthorized signal — wireless, network, or internet-facing — is treated as a risk by default.
Deployment Segments
Purpose-built architectures for facilities with distinct security postures.
Small Offices & Practices
Law offices first — they guard privileged client data and already pay for sweeps — plus consultancies, medical practices, and single-location businesses.
- hidden-tracker detection
- unauthorized Wi-Fi/network devices
- after-hours presence alerts
Corporate & Data Centers
For facilities where perimeter integrity matters continuously, not on a quarterly sweep schedule.
- full-subnet device classification
- public-IP exposure checks
- multi-site rollout
- engine on your own servers, if you prefer
High-Security Facilities
For environments where any unexpected signal is treated as a threat by default.
- continuous unattended monitoring
- no-internet operation (planned)
- only the radios you need on board
- complements existing physical security
Multi-Layer Detection Capabilities
Sensors only listen and collect; recognition runs in one engine — in our cloud or on your servers — so every improvement reaches every sensor at once.
Wi-Fi Monitoring
Passively sweeps 2.4GHz and 5GHz, hidden networks included. Reports every access point in range — vendor, model, security posture, and any downgrade in that posture — without joining a single network.
Bluetooth & BLE Identification
Identifies specific tracker protocols — Apple Find My, Tile, Samsung SmartTag, Google Fast Pair — not just "a BLE device nearby." A device with nothing identifying in its advertising is reported as unknown, not guessed at.
Connection-Attempt Detection
Identifies devices actively trying to connect where they shouldn't — a strong signal that something nearby is probing for access.
Local Network Classification
Every discovered host is scored into a device category, model, OS, and vendor — with a confidence value and a named match source, never a bare guess. Each contributing signal stays inspectable.
External Exposure Check
Periodically scans your network's public IP the way an attacker would, catching anything unintentionally exposed to the internet before someone else finds it.
Decoy Networks
Bring up decoy Wi-Fi networks — up to 32 from one sensor. Any device that tries to join one is logged, from the first probe to the disconnect. Can be switched off by region.
Anomaly Detection
Detectors for gateway spoofing (ARP and IPv6), Wi-Fi deauthentication and access-point floods, Bluetooth pairing spam, trackers that keep reappearing, after-hours presence and devices that quietly rename themselves.
Beyond Wi-Fi & Bluetooth
Already working on our prototypes: LoRa mesh and LoRaWAN, Zigbee and Thread, drone Remote ID over Bluetooth and Wi-Fi, and software-defined radio across 15+ bands with 433 MHz decoding. Our own office board carries a row of radio modules to cover many bands at once; it is a prototype, not yet in production.
Thousands of signals in, a handful of entities out.
Any detector can list devices. Linking signals across protocols and sensors — a phone's rotating Bluetooth address, its Wi-Fi probes, the host it becomes on your network — is the hard part, and it already runs.
Wi-Fi, BLE, Zigbee, Thread, LoRa, drone Remote ID, SDR and the local network.
Matching signals across sensors and protocols, each link with a capped confidence and the evidence behind it.
One device, or one person carrying several — an observation, never a claim of identity.
A clear notification — push, webhook or automation rule — instead of a list of MAC addresses.
Open signals and their characteristics only — strength, timing, pattern. We never read the content of anyone's traffic.
Deploy as a fleet, not just a device.
Multiple sensors can be grouped and managed together — a facility with several rooms or floors doesn't mean managing several separate accounts. See status, events, and findings across the whole group from one view.
Which sensor is closest — not just that something's nearby.
When more than one sensor in a group sees the same device, comparing signal strength across them shows which sensor it's closest to — useful for narrowing down where in a facility something is, without claiming exact-meter precision indoor RF can't reliably deliver.
How often, and for how long.
Visit counts and total duration per device, over any window you choose — not just whether something is here right now, but the pattern of when it comes and goes.
A score you can actually interrogate.
Every host gets a 0–100 exposure score, computed fresh each time — never stale. It factors in device type, which risky ports are open, how new and unidentified the host is, and whether an anomaly is currently open on it. The full factor breakdown is always visible next to the number — a score nobody can question gets ignored.
10.0.1.44
Legacy Access ControllerWhy continuous monitoring belongs between sweeps.
Continuous vs. Quarterly Sweeps
Professional TSCM sweeps are thorough, and expensive — a small office pays roughly $1,500–2,500 per visit, once or twice a year — and they only tell you what was true the day someone visited. On the per-sensor plan, a year of HaloWarden costs about one sweep and runs between them, so you're not blind for the rest of the year.
Transparent Pricing vs. Opaque RFQs
Enterprise RF and network monitoring platforms typically require a multi-thousand-dollar engagement or a government-style RFQ process with no public pricing. HaloWarden publishes its pricing, and starts at a fraction of that for smaller sites.
Why now: the rules already expect it.
The Pentagon directed electronic device detection in its SCIFs and SAPFs.
The standard for secure facilities treats wireless activity as something to control, not assume away.
Businesses already pay for sweeps once or twice a year, and stay blind in between.
The systems that deliver continuous monitoring today are priced for governments. HaloWarden brings the same idea to a business price. It is not an accredited SCIF product.
What we're honest about.
A capability list that only lists capabilities isn't useful to anyone evaluating a security product. Here's what's still in progress.
Bluetooth trackers that rotate their address (most modern phones do this every ~15 minutes) may briefly appear as more than one device before we reconcile them.
Detection thresholds are sound defaults — we're actively tuning them against real-world data, not guessing forever.
Every read of your data is authorized and logged, but automated anomaly alerting on staff access patterns is still on our roadmap, not yet live.
Blocking a device from your own network is built but not yet verified on real hardware. It ships off by default, IPv4 only, behind explicit consent levels.
Our port-classification engine also runs standalone — it can identify services and flag risk from any nmap or masscan scan output, not just our own sensors.
Transparent Facility Tiers
Planned pricing — HaloWarden is pre-launch, and final prices may change before shipping. Unlimited pays for itself from the seventh sensor.
| Deployment Tier | Per Sensor | Unlimited | Enterprise | Secure |
|---|---|---|---|---|
| Best For | Single office, a few sensors | Multi-room office or facility, six sensors and up | Corporate, data centers, multi-site | High-security and closed sites |
| Hardware | $999 / office kit | $999 / office kit | Custom, per point | Custom, per point |
| Monitoring | $49/mo per sensor | $299/mo, unlimited sensors | License from $7,500/yr | License from $35,000/yr |
| Deployment | Hosted by us | Hosted by us | Our cloud or your own servers; on-site appliance planned | No internet: standalone sensor, closed mesh or on-site controller — planned |
| Request Early Access | Request Early Access | Get a Quote | Talk to Our Team |
See what's actually on your network — and what's visible beyond it.
Continuous wireless and network visibility deployed without extensive infrastructure remodeling.