Security platform for MSPs and IT teams
Know what to fix first.
Cronzy Watch reads your estate from Wazuh, Palo Alto firewalls, AWS, Cisco and UniFi, ranks vulnerabilities by how likely they are to be exploited, turns attacks into cases, and shows you how to fix them.
The problem
Thousands of findings. Time to fix a few.
Scanners and agents produce long lists sorted by a generic severity score. Cronzy Watch puts one question first:what is actually being exploited, on which asset, and what do I do about it?
How it works
From connected to fixed in four steps
Connect, read-only
Add your Wazuh, firewalls, AWS and switches. Credentials are entered once in encrypted fields and are read-only by default.
Rank
Every asset gets a risk score from exploitation data, criticality and exposure. Vulnerabilities with no vendor fix are handled on their own line.
Correlate
Attacks and detections become cases with severity, deadline and timeline, with an e-mail when something is critical.
Fix
Follow the plan or paste the CLI. Mark the fix applied and Cronzy keeps watching until the case clears.
What it does
One view over your whole estate
Risk ranked by real exploitation
Every vulnerability is weighed with CISA KEV (known exploited) and EPSS (likelihood of exploitation), not CVSS alone, so the list starts with what attackers actually use.
Attacks correlated into cases
Scattered alerts become one case with severity, deadline and timeline. Scans weigh less than exploits, so the noise stays out of your queue.
How to fix, ready to paste
Each case and CVE comes with a remediation plan and, for firewalls, the exact CLI to apply. No searching vendor advisories at 2 a.m.
Firewall and network posture
Palo Alto configuration checks, advisories, GlobalProtect and threat-log intelligence, plus Cisco and UniFi switch inventory and a live network map.
Cloud coverage
AWS Inspector findings, organisation-wide coverage gaps and Security Hub, alongside your endpoints.
Internet exposure and discovery
See what the internet sees: exposed services, and assets nobody told you about, found through certificate transparency and DNS.
Detections you can read
A built-in pack of Sigma rules, plus import of your own. Detections feed the same cases as everything else.
Compliance view
Your findings mapped to CIS Controls v8 and ISO 27001 Annex A. A working view for your audits, not a certification.
Response with four-eyes approval
Block an address on the firewall, or isolate a host, block an address on it or kill a process through Wazuh. One person requests, another approves, everything is audited.
Built for MSPs
Many clients, strictly separated
Cronzy Watch is multi-client from the ground up, so one team can run security for many customers without mixing their data.
Row-level isolation
Each client's data is separated at the database level, not only in the interface.
Roles and sign-in
Role-based access with custom roles, MFA and single sign-on (OIDC), so technicians and client admins see what they should.
Audit and reporting
An audit log of who did what, and branded e-mail alerts and digests you can send on to your clients.
Deployment
SaaS first. A site collector when you need it.
Use Cronzy Watch as a hosted service. For networks that must not accept inbound connections, add a small collector on site.
Cronzy Watch SaaS
- Nothing to install or patch on your side
- Connect cloud and reachable sources directly
- Updates arrive without maintenance windows
With a site collector optional
- Runs at the client site and reaches devices on the inside network
- Outbound-only: it calls out to Cronzy, so no inbound firewall rule is needed
- Signed updates: the collector only installs releases signed by Cronzy
- Collects firewall, switch and Wazuh data that is not reachable from the internet
Security by design
A security tool you can trust with your estate
Read-only by default
Cronzy reads your systems. Response actions are limited to a short, defined list, and each one needs a second person to approve it.
Guardrails on actions
Security infrastructure, such as the Wazuh manager and your collectors, can never be blocked or isolated by an action. Timed actions undo themselves.
Credentials stay encrypted
Client credentials are entered in encrypted fields in the app and are never kept in code, chat or logs.
Get started
Request a demo
Tell us a little about your environment and we will get back to you, usually within one working day.