Guardian professional services
Technology closes part of the gap. The rest is people who have run this before — 1,180 practitioners across managed detection, incident response, offensive testing, compliance and security architecture, delivering in 31 languages from nine regional hubs.
Average time from engagement to containment: 47 minutes
The catalogue
Every service below is delivered by Guardian badged staff against a published statement of work, a named engagement lead and a defined acceptance test. No unnamed subcontractors, no open-ended time and materials.
A 24 / 7 / 365 SOC that watches your Sentinel tenant, triages every alert, and takes pre-authorised containment action on your behalf inside a three-minute acknowledgement SLA.
Retained and emergency breach response. Forensics, containment, eradication, recovery and the written record your regulator, insurer and board will each want in a different format.
Programme-level advice: maturity assessment, security architecture review, zero-trust roadmap and cloud migration security — costed, sequenced and defensible to your board.
Adversary simulation graded to your maturity: scoped application and infrastructure tests, full-scope red team, and purple-team exercises run shoulder to shoulder with your defenders.
Readiness, evidence and audit support for PCI DSS 4.0, HIPAA, DORA, NIS2, ISO 27001, SOC 2 and FedRAMP — mapped once to a single control set instead of five times over.
Analyst certification on the Sentinel platform, hands-on detection engineering labs, incident-commander drills and workforce awareness programmes that measure behaviour change.
Engagement models
The same practitioners are available four ways. Most enterprises run two or three models simultaneously — a retainer for the unexpected, a project for the planned, and a residency for the continuous.
You buy a block of practitioner hours and a contracted response time. Legal terms, data-handling agreements, evidence-handling protocol and escalation contacts are all signed in advance, so the first hour of a real incident is spent on the incident rather than on procurement.
Unused hours do not expire silently. They convert to proactive work — threat hunts, tabletop exercises, detection engineering or playbook development — at the quarter boundary, with your approval on how they are spent.
Best fit
Organisations with an internal security function that need surge capacity and a rehearsed path to expert help.
Typical shape
12-month term · quarterly true-up · named engagement lead · two rehearsals per year included.
See retainer tiersScope, deliverables, acceptance criteria and price agreed before work starts. Change requests are priced and approved in writing rather than absorbed quietly into the timeline. If we mis-scope it, that is our commercial risk, not yours.
Projects run against a published delivery method with a mid-point checkpoint, so you see draft findings while there is still time to act on them rather than receiving a surprise on the final day.
Best fit
Assessments, penetration tests, architecture reviews, compliance readiness and zero-trust roadmaps.
Typical shape
Fixed fee · 3 milestones · mid-point findings readout · 90-day free retest on offensive work.
See consulting scopesGuardian's SOC covers the hours your team cannot — overnight, weekends, public holidays, or the eight weeks of the year your senior analysts are on leave. Handover is structured: a written shift report, open investigation state and any action taken under your pre-authorised playbooks.
Authority is explicit. You decide, per asset group, whether we may isolate a host, disable an account or roll back a change without waking someone up — and that boundary is enforced by the platform, not by convention.
Best fit
Established security teams that cannot economically staff three shifts, or that need coverage across new time zones after an acquisition.
Typical shape
12- or 36-month term · per-endpoint pricing · 6-week onboarding · quarterly purple-team validation.
See MDR coverageA named practitioner works within your organisation two to five days a week for six months or more — attending your stand-ups, sitting in your change advisory board, and building detections against your applications rather than generic ones.
Residents are deliberately rotated out with a documented handover. The goal is a capability your team keeps, not a dependency you rent indefinitely.
Best fit
Enterprises building an internal capability under time pressure, or standing up a new regional SOC.
Typical shape
6–24 months · 2–5 days per week · on-site or embedded remote · named deputy for continuity.
Discuss a residencyDelivery methodology
Guardian Delivery Method is the standard every practice runs against. It exists so that a red team in Frankfurt and a compliance readiness in Singapore feel like the same company — and so that you always know what happens next.
A live engagement dashboard shows phase, percentage complete, open questions and any blocker sitting on your side. No weekly-status-email archaeology.
Anything critical is reported within four hours of discovery, under an agreed out-of-band channel. Nothing severe waits for the final report.
Every recommendation carries an effort estimate, an owning function and a sequencing note, so the report becomes a plan rather than a list.
Measured outcomes
Guardian measures every service against a baseline captured before work starts and re-measured 90 days after handover. The figures below are medians across 3,400 engagements delivered in the last twelve months.
Median performance, before engagement vs. 90 days after
Who shows up
Guardian does not subcontract delivery. Every practitioner on your engagement is a Guardian employee, background-checked to the standard your sector requires, and cleared for the jurisdictions your data sits in.
Guardian maintains cleared personnel pools for US federal work (Public Trust through Top Secret), UK SC and DV, NATO Secret, and the local equivalents in Australia, Canada, Germany and Singapore. Sector-specific vetting — financial services screening, healthcare privacy training, and OT-safety certification for plant environments — is applied by default, not on request.
How we vet and secure our own peopleDelivery hubs in Austin, Ottawa, São Paulo, London, Frankfurt, Dubai, Bengaluru, Singapore and Sydney provide continuous cover with local-language service in 31 languages. Engagements are anchored to a single hub for accountability, with a named deputy in the adjacent time zone so nothing stalls overnight.
See global SOC coverageThe retainer paid for itself in the first ninety minutes. We had a name, a number and a signed data-handling agreement already in place — no procurement, no NDA scramble, just responders on a bridge.
What I value is that the consulting report was actually costed. I could take it straight to the finance committee instead of translating twenty findings into a budget request myself.
Practical questions
No. Incident response, penetration testing, compliance advisory and consulting are all available to organisations running any security stack. Our responders and consultants work routinely with Microsoft Defender, CrowdStrike, SentinelOne, Splunk, Elastic and Chronicle environments.
Managed detection and response is the exception — it is delivered on the Sentinel platform, because the SLA depends on the response actions the platform makes possible.
Emergency incident response begins immediately: a responder is on a bridge within 15 minutes of a hotline call, and remote forensics typically starts inside the first hour. Retainer holders skip the contracting step entirely.
Planned work — assessments, tests, roadmaps — normally starts two to four weeks after signature, driven mostly by your own change-window and access-provisioning timelines rather than by our availability.
You do. Reports, detection content, playbooks, architecture diagrams and scripts produced during an engagement are delivered in editable source and assigned to you outright. Guardian retains no exclusivity over anything written for your environment.
Evidence collected during an engagement is held in your assigned residency region, under a documented chain of custody, and destroyed or returned on a schedule you set in the statement of work.
Retainers are priced on committed hours and response tier. Projects are fixed-fee against an agreed scope. Co-managed operations are priced per protected endpoint and identity, on a 12- or 36-month term. Residencies are priced per named practitioner per day.
Every quote itemises what is included, what is explicitly out of scope, and the rate that would apply to additional work. See platform pricing for how services combine with a subscription.
Yes. We routinely deliver under FedRAMP boundary rules, ITAR restrictions, EU-only staffing requirements, works-council agreements limiting personal-data visibility, and financial regulators' third-party oversight regimes including DORA. Constraints are captured in the rules of engagement during the Frame phase and enforced through scoped platform access.
Critical findings are reported to your nominated contact within four hours of validation, over a pre-agreed out-of-band channel. If the finding indicates an active compromise, the engagement pauses and our incident response practice is offered immediately — retainer holders draw on existing hours without a new contract.
Scoping calls are run by the practitioners who would deliver the work, not by a sales engineer reading a datasheet. Thirty minutes is usually enough to tell you whether we are the right answer.