When I tell people that Watch Cortex classifies threats in under 8ms on-agent — no cloud call, no GPU, no round-trip — the first question is usually: how?

The second question is: why bother? Just send it to the cloud.

Let me answer the second one first, because it explains all the engineering decisions that follow.

Why on-agent matters

The cloud-call model for security agents has a fundamental problem: it fails when you need it most.