Real-time grey-zone maritime threat detection for the Baltic.
AIS · Sentinel-1 SAR · OSINT fused into a single analyst console. Dark vessels, loitering, and anomalous behaviour near subsea cables and critical infrastructure — with provenance for every alert.
Four major incidents. Two years. One shipping lane.
Grey-zone attacks against Baltic subsea infrastructure have moved from isolated events to a pattern. Each one left a public trail of AIS gaps, satellite passes, and news reporting — fusion work that today happens manually, after the fact.
Four pipeline ruptures in Swedish + Danish EEZs. Subject of national investigations in Sweden, Denmark and Germany.
Balticconnector gas pipeline (FI–EE) and two telecom cables severed. Finnish NBI investigation focused on the Chinese vessel's track.
BCS East-West (SE–LT) and C-Lion1 (FI–DE) severed within 18 hours. The bulk carrier's anchor was dragged across both cables.
Estlink 2 (FI–EE) HVDC link + four subsea telecom cables cut. Finnish authorities boarded and detained the tanker.
One analyst console, four fusion layers.
Tidewatch is deliberately narrow: Baltic Sea, subsea-cable + suspicious-vessel threat model. Everything runs on open or commercially licensable data — fully defensible provenance for every alert we raise.
Real-time vessel positions from AISStream over the full Baltic AOI. Normalised, deduped, spatially indexed, rendered < 5 s after broadcast.
Sentinel-1 Process API → CFAR amplitude detection → fusion with AIS. Anything the satellite sees but isn't broadcasting surfaces as a dark-vessel alert.
Loitering near cables, AIS-off-inside-zone, route deviation, rendezvous. All explainable, all score-ranked, deduplicated so the feed stays quiet.
Evidence-grounded answers over alerts, vessel history, and OSINT. Every claim links back to a raw data ID — no hallucinated vessel names.
Ingest, fuse, detect, explain.
Three sensor streams converge in a single spatiotemporal index. Anomaly detectors run on rolling windows; a fusion reconciler matches SAR detections to AIS; the analyst console reads from the same index and only over structured tools — no hallucinated vessel data possible.
What Tidewatch addresses — and what's still ahead.
The capabilities analysts and decision-makers ask for in grey-zone maritime operations, mapped to what Tidewatch does today. The two items we don't yet address are Phase 2 — honest framing beats over-claiming.
Narrow today. Theatre-wide platform later.
Phased by design: prove the pipeline on a constrained AOI first, earn operational pilots second, expand the theatre later. Scope discipline is the single biggest predictor of delivery.
- Live AIS + SAR fusion pipeline
- Anomaly detectors: loitering, AIS-off, dark-vessel
- Natural-language analyst console with evidence grounding
- Historical replay of public Baltic incidents
- Exportable incident reports
- Red/blue agent-based wargaming
- Reinforcement learning for course-of-action ranking
- Pilots with cable operators and coastal agencies
- Allied platform integration pathways
- North Sea, Eastern Mediterranean, Black Sea
- Edge deployment on patrol assets
- Multi-tenant org + role-based access
- Mobile companion for maritime operators
Alex Bobes — CTO, 16+ years across AI, security, and cloud
Tidewatch is built by Alex Bobes, a Romanian technology leader based in Bucharest. CTO across eight companies in 16+ years, with deep work in AI systems (RAG, LLMs, agents), cybersecurity (infrastructure hardening, compliance, penetration testing), and technical SEO. Tech investor and published author on Amazon, HackerNoon, and Authority Magazine.
Founder of Asociatia Taxi Gratis, Romania’s free medical-transport NGO — 12+ years, 30,000+ km/year, 400+ people helped annually. Recognised with the JCI Ten Outstanding Young Persons award (2019) and operating support from Pro TV and OSCAR Downstream.
- 16+
- Years in tech
- 8
- Companies led
- 65+
- Articles published
- 400+
- People helped / year (NGO)
Tidewatch’s technical posture follows the same principles Alex applies elsewhere: hardened infrastructure, open-source data only (no classified inputs), explainable rules-based detectors before ML, and reproducible incident reports. The build doc, the full source, and the data sources are public.