Product
ShadowLatch shows which programs on your Windows devices connect where, tells you who owns each destination, lets you block what shouldn't be there, and gives servers a way to block intruders themselves. The same console works on your phone. Running devices for clients? See ShadowLatch for MSPs.
Home
A summary of your fleet: open Review items, devices that are offline or need an update, what was blocked in the last day, the apps and devices moving the most data, and the top destinations and services.
Flow
Devices, applications and destinations in three connected columns. Select anything and its connections light up. Filter by device, time and service, or watch it live as new connections arrive.
Activity
One page for both. With Live on, every connection appears the moment it opens: time, outcome, application, destination, owner, service, location, device and user, paused while you hover and with repeats collapsed so a busy network stays readable. With Live off it is the searchable record of every connection, as far back as your plan keeps: filter by device, user, application, destination, outcome, direction and time, and export it for reports.
Network
Destinations, Services and Applications in one page. Every address your devices talked to, one row each: the names devices resolved for it, its owner and location, the category, which devices and applications reached it, on which ports, how often, how much data, and when it was first and last seen. Block the address, its owner or its whole country from the same row.
Review
ShadowLatch learns what's normal for your account and queues what isn't: a new application, a new destination, a new port or protocol, or an unusually large transfer.
Reports
Totals and trends for any range up to a year: connections, blocks and data against the period before, a device-by-day map that shows when each machine was busy and when something was blocked, and the busiest applications, destinations and devices. Narrow it to blocked activity, the local network or inbound connections, and export it for an audit.
Rules
A profile holds everything a group of devices should do: protections, blocked categories, policy folders and alerts. Every device follows Default until you give it another profile, by company, group or device, and a single device can still differ where you allow it. Changes are staged, reviewed and applied together, with a note in the history.
Policies
Block or allow from any row in Activity, Network, Review or Home: the sheet names exactly what will be blocked and where, and files it into the right profile. For anything more, the policy wizard takes a site, a URL, a service, a country or a network owner and shows in a sentence what the policy does and what it would have matched in the last seven days. Save it as report-only to watch first, and enable it when you have seen enough.
Library
The building blocks profiles use. Look up which category a site falls in, add sites to a category or leave them out, and create your own. Choose which threat feeds devices match and whether each one alerts or blocks, and keep lists of countries and network owners for your policies.
Names, not just numbers
Each device resolves its own names through ShadowLatch, so browsers stay on the system resolver and every connection keeps its name instead of hiding behind encrypted DNS. That is also where devices refuse known-bad and newly registered names before a connection starts. Send public names to Cloudflare, Quad9 or Google over encrypted DNS while internal names stay on your network, and refuse other encrypted-DNS services so nothing leaves unseen. Adapters return to their own DNS servers whenever the agent stops.
Devices
Versions, groups, companies, the protected-data badge, the DNS resolver's state and intruder blocking at a glance. Build the installer with the options you want: group, company, tray icon, DNS resolver, server profile.
Intruders
Any managed device that sees repeated failed logons or a port sweep blocks the address on the device within seconds. Blocks are temporary, grow longer when an address comes back, and every device in the account learns from each block. The exposure view shows what a device listens on, who connected inbound, and what it blocks right now.
Policies
Block an application, a destination, a content category, everything a network owner announces, or a whole country. Decide who may reach a device (Remote Desktop, SSH, file sharing): ShadowLatch mirrors each inbound policy as a Windows Firewall rule and puts it back if anyone changes it. A policy is active as soon as devices pick it up. Not sure yet? Save it as Report only: devices record what it would have blocked, you check Review, then you switch it to Enabled. Apply it to one device, a group, a company or everyone, and remove it when it's no longer needed. Every change lands in the audit log.
Where it fits
ShadowLatch is the network layer. It shows and controls what applications connect to, and leaves file scanning and threat hunting to the tools you already run.
It records which program reached which address, port and name, and when. It never captures packets or opens HTTPS traffic, so it's safe to run where privacy matters.
An allowed connection means the device tried and was permitted; a blocked one means ShadowLatch stopped it. Counts are observations, which is exactly what an investigation needs.
Every page searches the full retained window, 30 days to six months depending on plan (longer on request). Choose the length that matches how far back your team looks.
The closed beta begins on November 1, 2026.