Sentinel
A neutral check on the monitoring layer.
When a claim is filed today, the only evidence that monitoring worked is the monitoring vendor’s own log. Sentinel adds a second opinion that the vendor does not control, recorded as it happens.
How it works
Three steps run continuously for every monitored shipment. None of them requires replacing a tracker or an operations center.
Compare against independent sources
Position, timing and condition readings from the tracker are checked against sources an attacker would have to compromise separately. Agreement on position, the order of events and plausible environmental readings rolls up into a concordance score, with a penalty when sources are not truly independent.
Test the monitoring stack itself
With the customer’s authorization, Sentinel runs controlled exercises in a lab or test environment: spoofed GPS, replayed packets, poisoned operations-center feeds, default credentials and unsigned firmware. Each finding is scored by severity. The goal is to measure risk, not to break production.
Seal each window in an attestation
Every window, typically 15 minutes or one milestone, is signed with a hardware-held key. The record carries the score, the sources used and any findings, and can be stored by the captive and examined after a claim.
Independent sources, by lane
The minimum useful set depends on the lane. Sparse lanes are scored more cautiously, and the attestation says so.
| Source | What it confirms | Where it applies |
|---|---|---|
| Tracker GPS, cellular or LoRaWAN | Reported position, temperature, humidity and shock | Every lane (the feed being checked) |
| Cellular network triangulation | Position, from carrier partners or independent probes | Road and rail |
| Port and terminal AIS and gate scans | Arrival, departure and container moves | Ocean and port drayage |
| Carrier EDI milestones | Departure, arrival and customs events | Ocean, air and road |
| Warehouse WMS scans | Receipt, put-away and dispatch | Warehouse and cross-dock |
| Satellite imagery or CCTV | Physical presence, on request | High-value lanes |
What gets flagged
A score below the threshold, 0.85 by default, flags the shipment for review or for a higher retention. These are the patterns behind most low scores.
Drift without corroboration
The tracker’s position moves away from where independent sources place the shipment.
Healthy but unconfirmed
The tracker reports normally, but no independent source has confirmed the shipment for too long.
Implausible conditions
Temperature or shock readings that do not match known conditions on the lane, or a tracked asset that suddenly disappears.
Built for known failure modes
Each of these has been described in published research or reporting. Sentinel is designed so that none of them can pass silently.
| Failure mode | What Sentinel records |
|---|---|
| Silent de-monitoring through spoofed or compromised trackers | Independent sources stop confirming the shipment, and the score falls |
| Operations-center feed poisoning | Independent sources diverge from the feed, and the attestation records the low score |
| Firmware tampered with before deployment | Test exercises surface abnormal device behavior |
| Attackers using the telemetry stream to pick targets | Attestations do not expose high-value identifiers to the monitoring vendor |
| Disputes over whether a loss is cyber or physical | Signed attestations give every party the same neutral evidence |
Background and sources are on the Evidence page.
Fits beside what you already run
Tracker feeds
Connectors for major tracker vendors, so the feed is read as it is, not re-instrumented.
CargoWise and EDI
Shipment, milestone and party data from CargoWise and carrier EDI provide the expected route and events.
Captives and reinsurers
A dashboard and API for captive managers, plus an immutable audit log of every attestation.