Night Watch

A second line of defence, working while you sleep.

This does not exist yet. There is nothing to download and no date promised. This page describes what is being built, in the open, and it will be built in front of you: Night Watch is the first do-it-yourself workshop project in this magazine.

Your antivirus is the first line of defence. Night Watch is the second one, and it takes the night shift. It is named after Rembrandt's painting, and it has two halves.

Eunuch — the guard who cannot betray you

The name is the castrated guard of a harem: someone trusted with what matters most precisely because he has been made incapable of funny business with it.

• It runs at night on your own machine, using an AI model installed locally — through Ollama, LM Studio or similar. Nothing about your hard disk is sent to anybody's server.
• Ordinary Python scripts do the heavy work of scanning. That is cheap, fast, and something a person can actually read and check.
• Only the few genuinely suspicious things the scripts surface are handed to the AI, which analyses them with real tools — reverse engineering with Ghidra, for instance — and compares what it finds against databases of known attacker behaviour and known signatures.

Why this can work at all: many attackers prepare for hours or days before doing any damage. Ransomware goes looking through your files before it locks a single one. That waiting period is the opening, and a watchman who looks every single night can catch the preparation before the damage.

The part everyone gets wrong

Eunuch is deliberately almost powerless, and that is its main feature, not a limitation. It is allowed to do very, very little, so that it can never become a threat itself. The reason you would let a program read everything on your computer is the proof that it cannot act on what it reads.

Golden Man — the one who sees tomorrow

Named after the Philip K. Dick story about a mutant who can see into the future. This half finds the problem before there is a problem.

• At night, on the same physical machine, your whole computer is recreated inside a virtual machine — VirtualBox, VMware or similar — running the same operating system. If you run Windows 11, so does the copy.
• Scripts copy your real situation into that copy, so from inside, it looks like a real, ordinary, used computer, not a laboratory.
• Then we lie to it about the time. The clock inside is set forward so that it is already tomorrow morning of a working day, while in truth it is the middle of the night and everything is sealed in a box. Malware that waits for the right moment therefore chooses a moment of our choosing.
• We lie about the activity too: plausible fake logs, so that anything watching believes this is the machine in daily use rather than a sandbox.
• Then the local AI and the scripts examine what actually happened, and can do it again for different situations.

Tomorrow's attack happens tonight, in a place where it cannot hurt anything, and you are told about it over breakfast.

Why it is in a magazine about AI

The old computer magazines — the good ones — always had a workshop: pages that walked you through building a real thing yourself, a piece at a time. This magazine has one too, and Night Watch is the first project in it. Every week explains a bit more of how it was actually made, because the honest way to teach something is to teach a thing that genuinely had to work.