Higher education, research & K-12
Universities run the hardest network in the world: forty thousand unmanaged devices, a research estate that must stay collaborative to be useful, a residential network that is functionally a consumer ISP, and a security team of six. Guardian Sentinel is built for exactly that shape — high coverage, low operational cost, and an education licence that does not punish you for having a lot of people.
The distributed campus
“The campus network” is a convenient fiction. In practice a university runs half a dozen environments with incompatible risk profiles, different governance and, historically, different security tools. Guardian covers all of them from one console and lets each keep the policy it actually needs.
Research & intellectual property
Pre-publication research is the most valuable data a university holds and the least protected: it lives on lab-managed Linux boxes, moves between institutions by arrangement rather than policy, and is handled by post-docs whose careers depend on sharing it. Guardian protects it without making collaboration impossible.
Guardian classifies research artefacts by content and context — genomic sequence files, CAD and simulation output, unpublished manuscripts, grant documents marked as controlled unclassified information — and maps them to the grant, the principal investigator and the export-control category. Most institutions discover CUI in three places they did not expect within the first month.
Explore data protectionResearch must cross institutional boundaries. Guardian records the transfers instead of blocking them blindly: who moved which dataset to which partner, under which agreement, at what volume. When an export-control review arrives, the answer is a report rather than a six-week reconstruction from email.
Identity protectionCompute clusters cannot afford a security agent that steals cycles from a queue that is booked eleven months out. The Guardian Linux sensor runs in eBPF with a measured median overhead of 0.4% CPU, no kernel module to break on the next kernel bump, and a scheduler-aware mode that yields during priority jobs.
Workload protectionThe groups that target research do not deploy ransomware; they establish quiet, long-lived access and exfiltrate slowly. Guardian Labs tracks 41 clusters with a documented academic-sector focus and ships their behavioural signatures — credential harvesting from federated SSO, abuse of legitimate collaboration tools, slow DNS exfiltration — as detections, not just indicators.
Threat intelligenceStudent data privacy
Education records are protected by FERPA regardless of where they end up, and since 2023 the GLBA Safeguards Rule has applied to financial-aid data at every institution that participates in Title IV programmes. Both require you to know where the data is. Most institutions do not, because the data leaves the SIS the moment somebody exports a spreadsheet.
| Data category | Obligation | Where it escapes | Guardian control |
|---|---|---|---|
| Education records & transcripts | FERPA — disclosure control, access logging, parental and student rights | Advisor spreadsheets, departmental shared drives, personal cloud storage | Content classification with lineage from the SIS export onward, plus alerting on personal-cloud destinations |
| Financial aid & FAFSA data | GLBA Safeguards Rule — written programme, MFA, encryption, monitoring | Third-party servicers, email attachments, ticketing systems | Egress monitoring on the aid office, MFA enforcement checks, and an annual control report for the auditor |
| Health & counselling records | HIPAA where the clinic bills, FERPA where it does not | Shared clinical workstations, imaging systems, referral email | Segmented clinical zone with its own retention policy and a separate access-audit trail |
| Research data with human subjects | IRB conditions, GDPR where EU subjects are involved | Lab NAS devices, unmanaged laptops, collaborator transfers | Dataset tagging inherited from the IRB protocol, with transfer logging per partner institution |
| Admissions & recruitment | FERPA on matriculation, state privacy law throughout | CRM exports, agency portals, marketing platforms | SaaS-to-SaaS flow visibility through the integrations layer, with alerting on new data-bearing connections |
| Alumni & donor records | Contractual and reputational; PCI where gifts are taken by card | Advancement databases, event platforms, volunteer laptops | Payment-path monitoring and least-privilege review on advancement systems |
Scroll the table sideways to see every column.
A student asks what you hold on them. Guardian's data map answers across the estate — not only the SIS, but the twelve places a copy landed — with the access history attached.
State notification laws run on days, not weeks. Guardian produces the affected-record set, the timeline and the control narrative as an export, so counsel starts from evidence rather than interviews.
The average institution runs 340 SaaS applications, most bought by a department. Guardian surfaces which ones actually receive student data and which merely claimed they might.
Constrained teams & budgets
Education security teams are not junior; they are outnumbered. The binding constraint is analyst hours, so Guardian is measured on how few of them it consumes — not on how many alerts it can generate.
Guardian licenses education by managed endpoint, not by identity. Student personal devices on the residential network are covered by network sensing at no per-device charge — because charging a university per student is how security budgets die. Research clusters are licensed per node with a volume tier that recognises an HPC estate is not an office.
See pricing detailSector scenarios
Over four days the residential network absorbs an entire mid-size ISP's worth of unmanaged hardware, a third of it already carrying something unpleasant. Guardian fingerprints each device from network behaviour, quarantines the ones beaconing to known infrastructure, and hands the student a remediation page instead of handing your help desk a ticket. Typical result: 94% of infections resolved without a human conversation.
Six weeks later it is holding grade data for four hundred students and nobody in IT knows it exists. Guardian's SaaS discovery finds the OAuth grant the day it is issued, classifies the data flowing to it, and raises it for review with the actual usage attached — which is a far better conversation than a policy reminder.
Guardian correlates the exposed credential against live sessions, finds that it is still valid on a federated service that missed the last password rotation, forces re-authentication, and checks the grant's data stores for access from the addresses associated with the leak — all before the researcher reads the email telling them to change it.
Detection at the first encryption attempt, automatic isolation of the affected hosts, and rollback of the encrypted files from Guardian's local shadow store. The 41 institutions in Guardian's education base have collectively lost zero days of teaching to ransomware since 2023. Incident response is on retainer for the case that is worse than that.
We are six people for forty-one thousand identities, and the honest problem was never detection quality — it was that nobody had time to read what the old tools produced. Guardian gives us alerts that arrive already investigated. The first month we finally closed the backlog. The second month we started doing the proactive work we had been writing into strategy documents for four years.
Guardian will run a scoped assessment across one faculty, one administrative system and the residential network, and present the findings in the format your committee already uses. Two weeks, no licence commitment, and the report is yours regardless of what you decide.