Fortwatch Review

Eleven scanners, one AI explainer. That's the pitch, and it's honest. The feature list — OWASP Top 10, cloud bucket exposure, subdomain takeover detection, emerging threat re-scans on Pro — is legitimately useful for teams that've outgrown UptimeRobot but can't staff a Datadog deployment. No agents, no self-hosting. You paste a domain and scanning starts. That's real speed to value.

The asset pricing is where this gets expensive quietly. Each subdomain is a separate billable asset. A mid-size SaaS with api., app., admin., staging. is already at four assets before they've added a single IP. At $149/month for Pro, that math compounds fast, and Slack integration doesn't even unlock until that tier.

No public funding data. No changelog. The website is Next.js, the support email is hello@fortwatch.ai, and the enterprise tier is listed as free with 'direct access to engineering.' That last detail either means a small, founder-led team — which I'd consider a positive — or it means they haven't figured out enterprise sales yet.

For a 10-to-50 person team that needs external attack surface coverage without a security hire, pilot the Pro tier at $149/month. Watch the asset count in month two before you commit to Business.

Eleven scanners, no agents, and a $149/month Pro entry point. For a lean security team protecting a mid-market attack surface, that's a defensible starting position. The agentless architecture is the right call — reducing deployment friction means teams actually use it, and cloud-based external scanning doesn't require privileged access grants that create their own risk surface. OWASP Top 10 coverage plus SSL/TLS monitoring plus cloud exposure detection in one dashboard is a coherent threat model for the SMB segment Fortwatch is targeting.

The per-asset billing model is where procurement conversations get complicated. Each subdomain counts as a separate billable asset — api.example.com and example.com are two line items. If we're managing a sprawling SaaS product with 40 subdomains, the $229/month Business plan math changes fast, and we're still capped at 25 team members. Emerging threat scanning — the automatic re-scan triggered by critical new CVEs — is locked to Pro and above, which means the $99 Essential tier has a meaningful gap in continuous coverage posture. That's not a minor footnote; that's the difference between detecting a Log4Shell-style event in hours versus the next weekly scan window.

Compared to Datadog's security module or Qualys VMDR, Fortwatch's compliance reporting surface looks thin in the public evidence. No changelog is visible, and there's no mention of SOC 2, ISO 27001, or PCI DSS reporting outputs — category-standard capabilities for any tool entering enterprise procurement. The Enterprise tier pricing is listed as free in the public page, which suggests custom negotiation, but without published SLA guarantees or audit log depth details, I can't assess where the accountability controls live.

If we adopt this for an SMB or growth-stage company, in three years we likely have good external visibility but we're rebuilding the compliance reporting workflow separately. The Jira, GitHub, and PagerDuty integrations are the right connective tissue for a DevSecOps motion, and that's genuinely useful. But any organization approaching a SOC 2 Type II audit or enterprise customer security reviews will hit the ceiling of what Fortwatch's current evidence supports.

Three paid tiers published without a sales call: $99, $149, $229/month. Enterprise is listed as 'Free' — that means custom, not zero. Procurement won't fight the transparency here. Compare to Datadog, where you're pricing via quote before you see real numbers. Fortwatch wins on visibility alone.

The subdomain billing is the real number. Every subdomain is a separate asset. A mid-size SaaS with api., app., admin., staging., and docs. plus root domain is already at 6 assets before they add cloud IPs. No published per-asset rate beyond the seat-and-tier structure, which means invoice predictability is low. Year 1 at Pro is $149 × 12 = $1,788. Asset creep at 10 subdomains could push that number materially depending on overage logic — and there's no public overage rate. That's the gap in the model.

Essential locks Slack integration out entirely — email only. Meaningful Slack alerting requires Pro at $149/month minimum. Emerging threat scanning, the CVE auto-rescan feature, is also Pro-gated. A team that buys Essential thinking it's full-featured will hit that wall by week 2. Contract terms and auto-renewal windows aren't publicly documented, which is a procurement friction point.

Agentless is the right call. No agent deployment means no change management, no server access negotiation, no oncall wake-up because someone pushed an agent update. You point it at your domains and IPs and scanning starts. For a small security team — or a solo engineer wearing the security hat — that's not a small thing. The docs indicate everything flows through the web dashboard, which is fine until you need to script asset ingestion at scale.

The per-asset billing is where day-three reality sets in. Each subdomain is a separate billable asset. A typical SaaS shop with api., app., auth., admin., staging. — you're at five assets before you've covered one product. At $149/month on Pro, that math gets ugly fast compared to Datadog's infrastructure pricing, which at least bundles hosts. Emerging threat scanning, the CVE-triggered re-scan feature, is Pro-only. Running Essential and a critical CVE drops? Weekly scheduled scans. That's the exposure window.

The integration list is credible — Jira, GitHub, PagerDuty, Slack, AWS, Datadog. Slack and webhooks gating to Pro ($149/month) is annoying but defensible. What's harder to forgive is no changelog. For a security tool, changelog absence means I can't track when scanner logic changes, can't correlate a new finding spike to a product update. Tenable publishes plugin update counts daily. That's the bar.

OWASP Top 10 coverage and cloud exposure detection — public S3 buckets, misconfigured IAM — are the right attack surface priorities for 2024. The AI prioritization layered over raw CVE output is exactly what's needed when you're triaging alone. 'Basic' risk scoring on Essential versus 'Advanced' on Pro is vague enough to be a buying concern without being specific enough to evaluate.

The meta description — 'Eleven scanners watching your public surface. One AI explaining what matters.' — is one of the more honest product pitches I've seen in this category. No vague promises. Just a clear statement of what it does. That kind of specificity usually means someone on the team actually thought about what buyers care about, which is a decent sign for how the rest of the product might feel day to day.

The agentless setup is real, and it matters. You enter domains and scanning begins. No installs, no maintenance, no YAML files to argue with. For a three-person team that doesn't have a dedicated security hire, that's not a small thing. OWASP Top 10 coverage plus SSL/TLS monitoring plus cloud exposure detection — finding open S3 buckets before someone else does — that's meaningful coverage for $99 a month. Except the per-asset pricing means api.example.com and staging.example.com and dev.example.com are each a separate billable asset. That bill quietly grows.

Also: Slack notifications require the $149 Pro plan. On the Essential tier you get email only. In 2024, requiring an upgrade for Slack feels like the kind of choice that makes a team feel punished for using the product normally. UptimeRobot gives Slack on free. That comparison isn't flattering.

The product is web-only, which is fine for a security dashboard — nobody's triaging CVEs from their phone. But no changelog is a yellow flag for a security tool. Knowing what changed last Tuesday matters when your job is knowing what's exposed.

Three flags before I get into features. One: no changelog visible — I can't tell if this thing ships or stalls. Two: 'Enterprise — Free' pricing is a placeholder, not a plan. Three: no funding data anywhere public. Could be bootstrapped and profitable. Could be pre-revenue and fragile. Can't tell.

The per-asset pricing is the buried trap here. Each subdomain counts as a separate billable asset. A mid-size company with api., app., staging., admin. subdomains hits $229/month fast — maybe faster than the Business plan's feature set justifies. Slack integration locked to Pro at $149/month is also a friction point that Datadog and even UptimeRobot don't pull. Emerging threat scanning — automatic CVE re-scans — is genuinely useful and clearly gated to Pro and above. That's honest tiering, at least.

The AI positioning is the kind of claim that ages poorly if the underlying scanners are commodity wrappers. 'Eleven scanners, one AI explaining what matters' is a good line. Whether it's differentiated from Detectify or Intruder in practice, based on what's visible here, is unclear. API exists. Docs exist. Blog exists. That's more than most new entrants show.

Fair summary: real product, real features, real pricing transparency on tiers. Viability signals are thin. Watch the changelog cadence in month three.