Wraithwatch Government

FedRAMP package ID

FR2612836790

Cloud service provider

Wraithwatch Corporation

Certification status

Agency Authorization In Process

Impact level

High

Certification class

Class D (High)

Authorization path

Agency

Certification type

Rev5

Marketplace phase

Initial Implementation

Deployment model

Government Community Cloud

Register snapshot

September 3, 2026

Service model

SaaS

Independent assessor

Coalfire Systems, Inc.

Status date

April 9, 2026

Business categories

Cybersecurity & Risk Management, Data Management

SAM.gov UEI

W4QUHXU4S836

Small business

Flagged on the marketplace record

Milestones on record

1

The marketplace carries Wraithwatch Government under package FR2612836790 with 17 recorded fields. Its current status was set on April 9, 2026. Coalfire Systems, Inc. is named as the independent assessor. No agency authorizations are listed against it in the current feed. It is delivered as SaaS on a government community cloud, filed under 2 business categories including Cybersecurity & Risk Management and Data Management. Its SAM.gov unique entity identifier is W4QUHXU4S836. Wraithwatch Corporation is flagged as a small business on the record.

• Grok for Government

  xAI

  Agency Authorization In Process, High impact, Agency path, Rev5.

• Kiteworks Secure Gov Cloud

  Kiteworks USA, LLC

  Agency Authorization In Process, High impact, Agency path, Rev5.

• Canopy

  Ripcord

  Agency Authorization In Process, High impact, Agency path, Rev5.

• Critical Event Management - GovCloud

  Everbridge

  Agency Authorization In Process, High impact, Agency path, Rev5.

• Island Enterprise Platform

  Island

  Agency Authorization In Process, High impact, Agency path, Rev5.

Wraithwatch is a Software-as-a-Service cybersecurity platform built on an intelligent security data fabric. The platform ingests data from across the customer's security and IT stack - endpoint detection and response, SIEM, identity providers, vulnerability scanners, cloud infrastructure, and more - through agentless, read-only API integrations. No agents are deployed on customer endpoints. Ingested data is normalized through deterministic entity resolution into a continuously updated entity graph that models every device, user, permission, vulnerability, configuration, and relationship in the environment. This unified data fabric eliminates tool-by-tool data silos and provides a persistent, queryable model of the customer's environment that powers all downstream platform capabilities. Continuous Governance, Risk, and Compliance: Wraithwatch replaces periodic, point-in-time compliance assessments with continuous GRC that recomputes every few minutes and immediately upon auto-detection of environmental changes. The platform mathematically computes every viable attack path based on current topology, configurations, permissions, and verified reachability. When the environment changes - a new CVE, a granted permission, a configuration drift - the platform recomputes risks including second-, third-, and fourth-order cascading effects. Compliance posture, risk exposure, and control effectiveness are maintained as living measurements against the entity graph rather than static snapshots. Agencies can execute neutralization plans directly from Wraithwatch or deploy compensating detections where paths cannot be eliminated. Threat Hunting: Autonomous reasoning workers explore SIEM indexes and security telemetry, identify anomalies and threat precursors, and surface findings with supporting evidence. Analysts issue natural language queries and the platform translates, hunts, pivots across data sources, and performs cross-index correlation at query runtime without requiring pre-mapped data schemas. Results convert into forward-looking detection rules. Threat Advisory Correlation: Wraithwatch continuously correlates incoming threat intelligence - including newly published CVEs, active exploitation advisories, novel attack techniques, supply chain compromise reporting, and other non-CVE threat disclosures - against the current state of the entity graph. When a new threat is published, the platform automatically evaluates the customer's environment and produces an "am I affected" assessment identifying specific impacted assets, exposure conditions, and recommended mitigations. This analysis incorporates the full environmental context - network reachability, compensating controls, privilege relationships, and configuration state - to determine actual exploitability, not just the presence of a vulnerable component. Control Plan Generation: Agency personnel describe a desired security outcome, and Wraithwatch evaluates every relevant setting across every integrated tool to generate a control plan. Plans are executable in full, one step at a time, or through phased rollouts with test groups. All actions are auditable with rollback support. All adversarial analysis runs against the digital twin. No live exploits touch production infrastructure. The platform operates in read-only mode by default; write-mode actions require explicit customer authorization and human confirmation. Wraithwatch supports cloud-hosted deployment on FedRAMP-authorized infrastructure and fully on-premise deployment for air-gapped and CUI environments.