Resource Center | Guardian

Featured this month

Start here

Whitepaper62 pagesPublished 14 January 2026

2026 Threat Landscape Report: the year breakout time fell below an hour

Guardian Labs analysed 4.2 trillion weekly security events and 1,180 incident response engagements to measure how quickly intrusions now spread. Median breakout time — the interval between initial compromise and the first lateral movement — fell to 41 minutes, down from 62 the previous year. The report breaks the number down by sector, initial access vector and adversary category, and sets out what a defensive programme has to change to stay ahead of it.

Threat intelligence Executive briefing Benchmarks

Read the report

Case study8 min read

Northbridge Financial cut mean time to contain from 9 hours to 6 minutes

How a 41,000-endpoint bank replaced four point tools with a single autonomous platform, and what the first ninety days of the migration actually involved.

Read the case study

WebinarOn demand48 min

Inside a live ransomware containment, minute by minute

Guardian's incident response lead replays a 2025 engagement from the first alert to the final eradication check, with the console open and the decisions explained as they were made.

Watch on demand

Guide22 pages

The NIS2 readiness workbook for essential entities

Article 21 measures translated into 46 concrete controls, with the evidence each one needs and a self-scoring sheet you can complete in an afternoon.

Get the workbook

Browse by type

Six libraries, one index

Each collection is maintained by the team that owns the subject matter — Guardian Labs for research, the product organisation for specifications, and the services practices for the operational guidance.

Blog

Adversary research, detection engineering notes, product releases and analyst commentary. Two to four new posts every week from Guardian Labs and the engineering teams.

312 articles · updated weekly

Read the blog

Whitepapers

Long-form technical and strategic research: threat landscape analysis, architecture reference designs, and quantitative studies drawn from platform telemetry.

48 papers · new research quarterly

Browse whitepapers

Case studies

Named customers, real numbers, and the parts of the deployment that were difficult. Every study is reviewed and approved by the customer before publication.

76 studies · 14 industries

See customer outcomes

Webinars & events

Live technical sessions, quarterly threat briefings and recorded conference talks. Registration is optional for the on-demand library — recordings stream without a form.

94 recordings · 6 live sessions a month

Watch and register

Datasheets

Module specifications, supported platforms, deployment prerequisites, scale limits and sizing guidance. Written for architects who need numbers, not narrative.

31 datasheets · versioned per release

View specifications

Security glossary

Plain-English definitions of 180+ terms, from ASPM to zero standing privilege, each with the context that explains why it matters and what it is often confused with.

184 entries · continuously revised

Open the glossary

Browse by topic

The library

Filter by subject to see everything Guardian has published on it, across all six content types.

Filter All types Articles Research Customers Video Specifications Showing 9 of 640

WhitepaperCloud & containers

Kubernetes attack paths: from exposed dashboard to cluster admin

Eight documented escalation chains observed in production clusters, each with the RBAC change or admission policy that breaks it.

34 pages Read

ArticleIdentity security

Session token theft has overtaken password attacks

Why stolen cookies now beat MFA more often than credential stuffing does, and the four controls that make a token worthless off-device.

9 min read Read

Case studyManufacturing

Keeping 22 plants running through a supply chain compromise

A vendor update carried a loader into the IT estate. Containment held it out of the OT network, and no production line stopped.

7 min read Read

WebinarAutomation & AI

What an AI analyst actually does with an alert

A live walkthrough of the Sentinel reasoning chain: enrichment, hypothesis, evidence weighting, and where a human is still required to decide.

52 min Watch

GuideCompliance & risk

DORA resilience testing without breaking production

How threat-led penetration testing requirements map onto an existing offensive security programme, and what evidence supervisors expect.

18 pages Read

DatasheetEndpoint security

Sentinel endpoint agent: platforms, footprint and scale limits

Supported kernels, average CPU and memory consumption under load, offline behaviour and rollback semantics, with sizing tables to 500,000 endpoints.

Version 9.4 Open

ArticleIncident response

The first ninety minutes: a containment decision framework

Isolate, observe or rebuild — a structured way to make the call under pressure, with the evidence each option destroys or preserves.

11 min read Read

WhitepaperOT & critical infrastructure

Monitoring the IT/OT boundary without touching a controller

A passive-first reference architecture for Purdue levels 2 to 3.5, with protocol coverage and safety review guidance.

28 pages Read

GlossaryThreat detection

What is behavioural detection, and how does it differ from anomaly detection?

Two terms used interchangeably that describe different things, with worked examples of where each succeeds and each generates noise.

Definition Open

Browse all 640 resources

Guardian Labs

Research published on a schedule, not when marketing needs a launch

Guardian Labs is a 140-person research organisation with a standing publication commitment: weekly adversary tracking notes, monthly detection content releases, quarterly deep research and an annual landscape report. Nothing on this site is behind a form, and nothing is written by someone who has not done the work.

Every statistic cites its population, window and method
Detection logic in research posts is published as Sigma, free to reuse
Corrections are issued publicly with a dated change note
Vulnerability research follows a 90-day coordinated disclosure policy

How intelligence reaches the platform

Published output

Last eight quarters

Items published per quarter across all six libraries.

Curated collections

Reading lists assembled for a job, not a topic

If you have ninety minutes and a specific problem, start with one of these sequences rather than the search box.

Evaluating an XDR platform

Seven items covering architecture questions to ask, how to design a proof of value, and the metrics that separate marketing claims from operational reality.

7 items · ~90 min Open

Building an incident response capability

From retainer decision to runbook library to the first tabletop, with templates for the incident record and the regulatory notification clock.

9 items · ~2 h Open

Securing a multi-cloud estate

Identity-first architecture, workload protection, IaC guardrails and the runtime signals that matter once the build pipeline has done its job.

8 items · ~2 h Open

Your first SOC 2 or ISO 27001

Scoping decisions that cost or save months, the control library approach, and what continuous evidence collection changes about audit season.

6 items · ~75 min Open

The Thursday briefing

New adversary tradecraft in your inbox every week

One email, every Thursday: what Guardian Labs observed that week, the detection logic to catch it, and a short note on anything that changed in the platform. Read by 94,000 security practitioners. No product spam, and one-click unsubscribe in every issue.

Work email address

We use this address only to send the briefing.

Also send me Quarterly deep research when it publishes Invitations to live webinars and regional events Monthly platform release notes

By subscribing you agree to the Privacy Policy. We never sell or share subscriber data, and we do not pass addresses to the sales team.

Issue 214 · 30 July 2026

In this issue: PALE MERIDIAN moves to OAuth consent phishing; three new Sigma rules for CI/CD token abuse; why your SSO logs are missing the field that matters.

Issue 213 · 23 July 2026

In this issue: A ransomware affiliate switching to ESXi first; measuring detection coverage honestly; the case against 90-day password rotation, again.

Back issues are published to the blog two weeks after they are sent.

Looking for something else?

Not everything lives in the library

Product documentation

Deployment guides, API reference and integration recipes live in the support portal alongside version-specific release notes.

Go to support

Trust and compliance artefacts

Our SOC 2 Type II report, ISO 27001 certificate, penetration test summary and subprocessor list are available on request through the trust center.

Open trust center

Press and analyst enquiries

Media kit, executive biographies, brand assets and the fastest route to a Guardian Labs researcher for comment.

Visit the newsroom

Everything Guardian knows, written down

Start here

2026 Threat Landscape Report: the year breakout time fell below an hour

Northbridge Financial cut mean time to contain from 9 hours to 6 minutes

Inside a live ransomware containment, minute by minute

The NIS2 readiness workbook for essential entities

Six libraries, one index

Blog

Whitepapers

Case studies

Webinars & events

Datasheets

Security glossary

The library

Kubernetes attack paths: from exposed dashboard to cluster admin

Session token theft has overtaken password attacks

Keeping 22 plants running through a supply chain compromise

What an AI analyst actually does with an alert

DORA resilience testing without breaking production

Sentinel endpoint agent: platforms, footprint and scale limits

The first ninety minutes: a containment decision framework

Monitoring the IT/OT boundary without touching a controller

What is behavioural detection, and how does it differ from anomaly detection?

Research published on a schedule, not when marketing needs a launch

Last eight quarters

Reading lists assembled for a job, not a topic

Evaluating an XDR platform

Building an incident response capability

Securing a multi-cloud estate

Your first SOC 2 or ISO 27001

Not everything lives in the library

Product documentation

Trust and compliance artefacts

Press and analyst enquiries

Read enough. Want to see it running?