Change intelligence

Determine what materially changed

Not every finding is a fire. Material change detection highlights what meaningfully shifted: new exposure, broken controls, new agent capabilities, or vendor posture drift.

Email [email protected] Start free trial

Why change is the unit of attention

A static score can look fine while the underlying surface drifts. Certificates age. Headers disappear after a deploy. DNS records get edited. An AI agent gains a new MCP tool. The failure mode is not “we never scanned.” It is “we scanned, but we did not notice what changed.”

Material change detection is the risk engine step that answers: what is different enough that a human should act now? It sits between raw signal collection and prioritization.

Material vs noise

Continuous monitoring produces volume. Without a change lens, every recurring finding competes with every new one. Teams either mute alerts or drown in them. Material change focuses on deltas with consequence:

Noise still exists. The goal is not zero findings. The goal is a short list of changes that deserve ownership this week.

Examples that show up in real work

External attack surface

Yesterday your primary domain passed header checks. Today a CDN change dropped HSTS. That is material change: same asset, weaker control, clear evidence. Watch is built to surface that kind of regression with remediation guidance instead of burying it in a long inventory dump.

Agent environments

Last week an endpoint had a narrow tool set. This week a new MCP server appears with broader capabilities. That may be intentional, but it is still a security-relevant change. Continuous Agent Security on Watch Pro exists so those shifts are visible, not discovered during an incident review.

Vendors

A supplier’s public posture can slip without anyone on your team deploying code. When vendor monitoring is in scope, that drift becomes part of the same change story you use for customer and insurance questions.

From change to action

Change alone is not a plan. The risk engine pairs material change with prioritization and required actions, then verifies remediation. That is how continuous visibility becomes operational decisions instead of another unread report.

How this relates to posture drift

Posture drift is the long arc: controls that erode over days or weeks. Material change detection is the practical daily cut of that arc. If you care about both, start with change that warrants attention, then keep monitoring so regressions do not quietly reopen.

FAQ

How is this different from daily scan results?

Scans produce findings. Material change detection emphasizes deltas that matter for risk decisions.

Does this cover AI agents?

Yes on Watch Pro Agent Security. Local Agent Check remains free for point-in-time assessment.

What counts as material change?

Meaningful shifts such as new or worsened exposures, control regressions, new agent capabilities or permissions, and monitored vendor posture drift.

Turn your security on.

Email [email protected] to activate Watch or Watch Pro, or start a free trial without a card.

Contact hello@ Start free trial