Guardian Partner Network
Sixty-eight percent of Guardian's new business is sourced or influenced by partners. We built the programme around that reality: protected margin, real technical enablement, multi-tenant tooling that was designed for service providers rather than retrofitted, and a co-sell motion that treats your account team as our account team.
Four routes, one platform
There is no cut-down partner edition and no separate codebase. Whether you resell a licence, wrap a managed service around it, integrate your own product with it or architect it into a client's transformation programme, you work with the same detection engine, the same API surface and the same release train as our largest direct enterprise accounts.
Programme tiers
Tier is earned on certified capability and sourced revenue over a rolling twelve months, reviewed each February and August. Requirements and entitlements are published in full so you can model the economics before you invest — and so no two partners are quoting the same deal at different numbers.
Registered
For firms transacting their first Guardian opportunities and building a practice.
Select
For partners with a repeatable Guardian motion and their own delivery capacity.
Premier
For established security practices co-selling into named enterprise accounts.
Elite
For strategic partners running Guardian at national or global scale.
Base margin is fixed by tier. A registered opportunity adds a protected uplift for the life of the deal, and Premier and Elite partners earn a further accelerator once they pass 115% of their annual sourced-revenue plan. Figures are effective margin on the Guardian list price for a first-year subscription.
| Entitlement | Registered | Select | Premier | Elite |
|---|---|---|---|---|
| Base margin | 10% | 16% | 22% | 28% |
| Deal registration uplift | 5 pts | 6 pts | 7 pts | 8 pts |
| Registration protection window | 90 days | 120 days | 180 days | 180 days |
| Marketing development funds | Not available | By proposal | 2% accrual | 4% accrual |
| Named partner account manager | — | Shared pool | Named | Named + exec sponsor |
| Solution architect hours per quarter | — | 8 | 32 | 96 |
| Not-for-resale entitlement | 25 endpoints | 100 endpoints + 1 cloud account | 500 endpoints + 5 cloud accounts | Unlimited internal use |
| Multi-tenant management console | — | Included | Included | Included + white label |
| Release-candidate early access | — | — | 30 days | 45 days |
| Partner Advisory Council seat | — | — | By invitation | Standing seat |
| Annual sourced revenue requirement | None | US$250K | US$1.2M | US$5M |
Scroll the table sideways to compare all four tiers.
Margins shown are effective on first-year subscription list price and exclude professional services, which partners price independently. Public-sector and FedRAMP-authorised transactions follow a separate schedule — see Government & defence.
Technology alliances
Every alliance listing is backed by a maintained connector, a published data contract and a joint support path with a single escalation number. Certification is re-tested against each Sentinel minor release; connectors that fail regression are marked degraded in the catalogue within 24 hours rather than quietly left to rot.
Bi-directional streaming of normalised detections, entity graphs and raw telemetry in OCSF. Guardian pushes enriched incidents rather than raw alert noise, which typically cuts ingested volume by 60–80% against a forwarder-based approach.
Agentless posture assessment plus runtime sensors for VMs, containers and serverless. Marketplace transactability means customers can draw down committed cloud spend to pay for Guardian, which routinely shortens procurement by a full quarter.
Session-level risk signals flow both ways: Guardian consumes authentication context to score behaviour, and pushes containment verdicts back so a compromised identity is stepped up or disabled at the provider in under four seconds.
Incidents open, update and close as tickets with full bidirectional state sync, including asset and CMDB reconciliation. Response playbooks can wait on a change approval and resume automatically when it lands.
Firewall, SASE and NDR alliances exchange indicators and enforcement actions. A Sentinel containment verdict can push a quarantine policy to the edge without a human touching a console, then revoke it automatically once the host is remediated.
Ransomware verdicts trigger immutable snapshot pinning before encryption spreads, and recovery tooling receives a scoped list of affected paths so restores are surgical rather than wholesale.
Service provider programme
Sentinel was built for providers who run hundreds of customer estates from one screen. Tenants are cryptographically isolated at the data layer, each with its own key hierarchy, retention clock and residency setting — but an analyst in your SOC works a single unified queue across all of them, with cross-tenant threat hunting and one place to promote a detection everywhere at once.
Reseller & distribution
Registration is adjudicated on first submission with evidence, not on relationship. Once approved, the opportunity is locked to you for the protection window — Guardian sellers are compensated identically whether the deal closes direct or through you, so nobody on our side has a reason to go around you.
Submit the account, contact, estimated seats and expected close date through the portal or the partner API. Duplicate detection runs against open opportunities and tells you immediately if the account is already claimed.
Channel operations reviews within one business day. Approvals arrive with the locked price book attached; declines cite the conflicting registration ID and its expiry so you know exactly when the account frees up.
Pull in a Guardian solution architect for the proof of value, request executive sponsorship, and use the shared deal room for security questionnaires, architecture diagrams and compliance evidence.
Quote through your distributor or directly. Registration credit follows the renewal for as long as you remain the customer's servicing partner — renewals are not re-competed out from under you.
Guardian transacts through eleven authorised distributors covering North America, EMEA, LATAM and APJ, with local currency invoicing, credit lines and stocking of multi-year subscriptions. Ask your regional channel manager for the current list.
Partners can originate private offers on AWS, Azure and Google Cloud marketplaces with channel margin preserved, letting customers retire committed cloud spend against a Guardian subscription without eroding your economics.
Guardian is available on several public-sector purchasing vehicles through authorised partners. FedRAMP High workloads are delivered exclusively from the Guardian Government Cloud by partners holding the Public Sector authorisation.
Programme benefits
Enablement, tooling and support are not held back as tier incentives. The things you need to sell competently and deliver safely are available to every partner from the moment the agreement is countersigned.
Six learning paths, from the two-hour Sentinel Sales Foundations track to the 40-hour Sentinel Architect programme. Exams, lab environments and re-sits cost nothing, and certifications carry a 24-month validity with a short delta course on renewal.
See the curriculumA permanently available demo tenant seeded with realistic adversary activity, plus one-click proof-of-value environments that replay a Guardian Labs intrusion so a prospect watches containment happen live instead of reading about it.
Campaign kits with editable landing pages, sequenced email copy, paid social creative and a webinar-in-a-box format. MDF claims are reimbursed within 30 days of proof of performance — the median in 2025 was 17 days.
When one of your customers is in trouble, Premier and Elite partners can activate the Guardian IR team on a joint engagement basis under your paper. You keep the customer relationship; we bring the forensics bench.
Incident responsePull the current SOC 2 Type II report, ISO certificates, penetration test summary and completed CAIQ from the portal under the partner NDA, so you can answer a customer's security questionnaire the same day it arrives.
Compliance centreWeekly adversary briefings, pre-publication access to major research, and the campaign tracking data behind our attribution — usable in your own customer communications under a standing content licence.
Threat intelligenceYour first 90 days
Agreement countersigned, portal accounts provisioned, price book and margin schedule issued, NFR tenant created. Your channel manager holds a 45-minute kick-off to map your existing customer base against Guardian fit.
Two sellers complete Sales Foundations and Competitive Positioning; one engineer completes Sentinel Certified Engineer, including the deployment lab and the detection-tuning workshop. Both tracks are remote and self-paced.
First opportunities registered, joint account planning session with your Guardian solution architect, and a co-branded launch campaign drawn from the campaign kit library.
Deploy into the prospect's environment — typically 300 to 2,000 endpoints — and run the standard 14-day evaluation plan with pre-agreed success criteria. Your engineer leads; ours shadows and only steps in if asked.
Quote through distribution, transact, then a structured handover into deployment with a named implementation owner on both sides. Median first-deal close for new partners in 2025 was day 84.
We had built managed services on three other vendors before. Guardian is the first one where the multi-tenant story survived contact with 180 customers. Provisioning a new tenant is a ninety-second API call, and we promote detection content across the whole base from one screen instead of forty.
Become a partner
Applications are reviewed by the regional channel team within two business days. There is no application fee and no minimum commitment to reach Registered status.
Programme questions
Guardian sells direct into a defined list of global strategic accounts and every other account is channel-preferred. More importantly, our field sellers carry the same quota credit and the same commission rate on a partner-fulfilled deal as on a direct one. Removing the compensation gap removes the incentive to compete with you.
The strategic account list is published to Premier and Elite partners each quarter, so you always know which handful of logos are out of scope before you invest in pursuit.
First valid submission wins. Validity means a named end-customer contact, an identified project and a realistic close date — not a company name typed into a form. If two partners register the same account within 48 hours of each other, channel operations reviews the supporting evidence and awards protection to the submission with demonstrable engagement.
Declines always cite the conflicting registration ID and its expiry date. If the incumbent registration lapses without progress, the account returns to open status and you are notified automatically if you asked to be watch-listed.
Elite service-provider partners can white-label the analyst console, the customer portal and all generated reporting, including custom domains and your own colour palette. Premier partners get co-branded reporting and a customer portal carrying both logos.
Two things are never white-labelled: the vulnerability disclosure channel and the published subprocessor list, both of which must remain traceable to Guardian for the customer's own compliance obligations. See Trust & security for the reasoning.
You are tier 1 and tier 2 for your customers; Guardian is your tier 3. Partner-raised cases are queued against the same severity matrix as direct-customer cases, with a 15-minute response target for Severity 1. Service-provider partners additionally get a dedicated escalation channel staffed by engineers who work only on multi-tenant deployments.
Service providers report actual consumption monthly and are invoiced in arrears at a volume-banded rate that steps down as aggregate seats grow across your whole book. You set the end-customer price; Guardian never publishes a managed-service list price that would anchor your customer's expectations against you.
Ramping customers can be reported at zero for their first 30 days so onboarding overlap does not cost you margin. Compare the commercial model against direct pricing on the pricing page.
A functional review against the published data contract, a security review of the connector's authentication and secret handling, a performance test at the ingest rate you claim to support, and a documented joint support runbook with named escalation contacts on both sides. Most alliances complete certification in six to ten weeks.
Recertification is automatic against every Sentinel minor release. If a regression is detected, the catalogue entry is marked degraded within 24 hours and we contact your engineering lead directly before any customer sees the change.
Yes. Referral partners introduce an opportunity, Guardian carries the sales cycle and the paper, and the partner receives a referral fee on first-year subscription value. It suits advisory firms and auditors who cannot resell for independence reasons. Select "Referral partner" on the application form.
Join 1,240 partners who build, sell and deliver on Sentinel. Applications reviewed in two business days, portal access the day you sign.