Everything is let in and recorded. Only what's new gets read. Anything never seen before is held at the door — and nothing slips past unseen. The watch is yours.
The usual way to watch what reaches your machines is to rent a service that watches from the outside — sampling by signature, shipping your logs somewhere else, and metering you the whole time. When the watch lives on your node, that goes away.
instead of sampling by signature from the cloud
instead of shipping your logs out by the gigabyte
instead of waiting for a signature to exist
Every one of these watches you from the outside, meters you by the endpoint, the gigabyte, the seat — and has to have seen the threat before. A gate on your own node reads the new, holds the never‑seen, and keeps the whole book — with no one outside in the loop.
Market averages from public list pricing and industry benchmarks — directional, and they vary with size and contract. The point isn't the exact figure; it's that every one of these watches from outside and meters you, and a gate on your own node doesn't.
This is detection and completeness — every arrival read and accounted for, the never‑seen held for review — not a promise that nothing bad exists. The difference is the watch stays yours.