Matching and prioritisation
Pulls multiple official and public vulnerability sources, matches them to your asset versions and assigns one of four levels with the reasoning attached — or marks it "needs confirmation" when data is incomplete.
AMAS Corewatch Security Governance PlatformFrom "are we affected?"to audit-ready,in one workflow.
Corewatch matches official vulnerability feeds against the asset versions you actually run, every day. It prioritises by transparent rules, tracks remediation deadlines and turns every decision into audit evidence. Severity is decided by rules and version matching, never by AI.
Multi-tenant cloud service · two-step verification on every account
- Four levelsEvery level shows its reasoning
- Rule-basedAI never sets severity or status
- Needs reviewMissing data is never "safe"
- Audit trailRemediation exports to auditors
01 — The problem
Advisories arrive daily. Accounting for them is the hard part.
For owners, security leads, engineers and auditors at IT service providers and growing businesses — every step from "does this affect us?" to "prove it is fixed" needs an owner and a record.
- 01
Too many advisories, too little relevance
New CVEs land every day, but nobody maps them to the exact products and versions you run.
- 02
"Not matched" quietly becomes "not affected"
Gaps in the data get treated as safe, and real exposure drops off the list.
- 03
Fixes that can't be proven
Remediation lives in emails and spreadsheets, rebuilt from scratch at every audit.
02 — Capabilities
From intelligence to audit evidence, in one place.
All of the following are available today. Items marked "by plan" vary across the Free, Professional and Enterprise tiers.
Containers by plan
Assets, SBOM and VEX
Register assets by hand, collect host and container components, or upload SBOM and VEX statements.
Tickets, actions and deadlines
Affected items open as tickets with response and resolution deadlines. Only people can mark an item patched or verified — with a note.
Channels by plan
Notifications where you work
Email, LINE, Teams and webhooks, plus daily digests and product-watch alerts.
Pack: Enterprise
Reports, audit trail, compliance pack
Monthly reports, deadline attainment and audit exports — plus a vendor-compliance document pack for public-sector contracts.
Quota by plan
Work with your own AI agent
Export remediation tasks to your own AI agent and import its findings for a person to confirm. Read-only API tokens are available.
03 — How it works
Four steps, run for you every day.
- 01
Add assets
Manually, via the collector, or by SBOM upload.
- 02
Match and prioritise
Daily official feeds, version matching and transparent rules — reasoning included.
- 03
Ticket and notify
Tickets by level, owners alerted, deadlines started.
- 04
Remediate and prove
People confirm the fix; the record exports straight to auditors.
04 — Governance & trust
AI assists. It never decides.
Security records have to stand up to scrutiny, so who decided what must be unambiguous: rules set the level, people close the item.
Severity without AI
Only rules and version matching. AI helps summarise official English advisories in Traditional Chinese — its output cannot change a level or a status.
Unmatched is not "safe"
Incomplete data is flagged for confirmation and stays on the list until someone resolves it.
Clear roles, isolated tenants
Five roles with distinct duties, each organisation isolated from the others, and two-step verification on every account.
Append-only audit trail
Every ticket, assignment, fix and verification is recorded and ready to export.
05 — Where it stands
Current statusEarly access
We run it ourselves every day. Early access is now open.
The production service is live and used by our own organisation. External customer trials have not started yet; we can enable a Professional or Enterprise trial for organisations we are in conversation with. Self-service sign-up is not yet open.
Corewatch is cloud-only today; there is no on-premises edition.
- LiveIn production, internallyUsed daily by our own organisation.
- NowEarly accessTrials enabled case by case.
- Planned Q1 2027External customer trials
- PlannedGeneral availabilityGated on passing an independent penetration test.
Services and what comes next
Labelled by what is actually available; items not yet open cannot be ordered.
- AvailableConsultant-led scanning and follow-up
- AvailableISO 27001 implementation coaching
- Internal pilotSecurity governance knowledge baseISO 27001 control mapping, audit preparation and source-cited AI Q&A; external availability to be confirmed.
- Internal pilotIncident-response retainer
- PlannedExternal exposure checksNot offered yet.
06 — The AMAS family
Same governance principles, different front lines.
Each product runs on its own, and each keeps the same rules: clear roles, traceable records, and AI that assists but never decides.
Available
AMAS Enterprise AI Knowledge Governance Platform
Every answer cited. Every access governed.
Learn moreDemo available
AMAS Enterprise HR Governance Platform
Payroll calculated to Taiwan's rules, with maker-checker controls
Learn morePilot projects
AMAS AI Video Governance Platform
Hours of footage, prioritised for human review
Learn moreNext step
See what your assets are exposed to.
Early-access enquiries: we walk through the full flow from vulnerability intelligence and version matching to remediation tracking and audit reports.