Small & mid-sized business
Attackers do not scale their tooling down for smaller companies — they scale their targeting up, because you run the same cloud services with a fraction of the staff. Guardian Sentinel Essentials gives you the detection engine that protects the Fortune 100, the SOC that watches it around the clock, and a single per-endpoint price with nothing bolted on afterwards.
The honest position
You are under-protected because the security market sells you eleven products that each assume you have someone to operate them. The cost is never the licence. The cost is the person who has to read what it produces at 2 a.m.
See how managed response worksBundled essentials
Guardian Sentinel Essentials is not a cut-down engine. It is the same detection platform enterprise customers run, with the operational complexity removed and sensible defaults applied on your behalf.
Behavioural prevention for Windows, macOS, Linux, iOS and Android — including ransomware rollback that restores encrypted files from a local shadow store without touching your backup. One agent, no separate antivirus, no exclusion spreadsheet to maintain.
Endpoint securityGuardian connects to Microsoft 365 or Google Workspace in minutes and watches the things that actually cause small-business breaches: impossible-travel logins, mailbox rules that quietly forward invoices, MFA fatigue attacks, and the finance mailbox that just received a very convincing bank-detail change.
Identity protectionGuardian's SOC watches your environment continuously with a 3-minute response SLA. They contain what needs containing, and they call you — a named engineer, on the phone — when something requires a decision only you can make. Included, not an upsell.
Managed detection & responseConnect your AWS, Azure or Google Cloud account read-only and Guardian tells you what is exposed to the internet, which storage bucket is public, which key has not been rotated since 2021, and which OAuth app a departing employee left holding access to your CRM.
Cloud securityA lightweight discovery role on one existing machine per site inventories everything on the network — including the printer with a web interface on the internet and the NAS running firmware from 2018 — and flags what should not be there. No appliance to buy or rack.
Network securityA monthly one-page summary written for a board or an owner, plus the specific control evidence cyber insurers ask for: MFA coverage, EDR deployment percentage, backup verification, patch currency and mean time to respond. Generated, not assembled.
See the datasheetFast time-to-value
The median Guardian Essentials deployment reaches full coverage in three hours. There is no appliance, no professional-services engagement, and no six-week tuning phase — the defaults are the ones Guardian's own SOC would set.
Guardian installs alongside your current antivirus, verifies coverage, and removes the old agent afterwards using the vendor's own uninstall routine. Nobody is ever unprotected during a cutover, including the machines that were switched off that week.
Policies ship in a prevention-first configuration that Guardian's SOC maintains centrally. You can override anything, but you do not have to decide anything on day one to be protected.
Protection follows the device, not the office. There is no VPN requirement, no on-premise management server, and a laptop on hotel Wi-Fi is exactly as covered as one at a desk.
Managed options
Three ways to run Guardian, with the same platform underneath. Move between them without migrating anything — the difference is who holds the console and who answers the phone at 3 a.m.
| What you get | Self-managed | Guardian MDR | Through a partner MSP |
|---|---|---|---|
| Best for | An internal IT team that wants control and has capacity | Companies with no security staff, or one person who needs to sleep | Companies who already outsource IT and want one supplier |
| Who reviews alerts | Your team, with AI triage doing the first pass | Guardian's SOC, 24/7/365, escalating with a recommendation | Your MSP's SOC, backed by Guardian escalation |
| Response SLA | Yours to define | 3 minutes to first analyst action | Set in your MSP agreement, typically 15 minutes |
| Containment authority | Your administrators | Delegated to Guardian within limits you approve in writing | Delegated to the MSP within limits you approve |
| Threat hunting | Not included | Monthly, with a written findings report | Per your MSP's service tier |
| Incident response | Retainer available separately | 40 hours of IR included each year | Coordinated by the MSP, escalated to Guardian IR |
| Typical weekly effort | 6–10 hours | About 2 hours | Under 1 hour |
Scroll the table sideways to see every column.
Guardian works with 840 managed service providers worldwide. If you already have an IT partner, ask them — there is a reasonable chance they are already certified. See partners.
Simple pricing
Guardian Essentials is licensed per protected endpoint per month, billed annually, with identity, email, cloud posture, network discovery, managed detection and reporting included at every tier. There is no data-ingest meter, no charge for the console, no per-module uplift and no minimum seat count above ten.
Ransomware rollback. Threat intelligence. The mobile agent. The API. Onboarding. Support. Software updates. The monthly board report. The cyber-insurance evidence pack.
Straight answers
Not the ones a datasheet answers. The ones that decide whether this is realistic for a company your size.
Read the full FAQYou are not targeted by name, which is precisely the problem — you are targeted by exposure. Automated campaigns scan for the same unpatched edge device and the same unprotected mailbox regardless of company size, and ransomware affiliates explicitly prefer smaller organisations because the payment decision is faster and the defences are thinner.
Guardian's own incident data shows the median victim under 250 employees was compromised through an internet-exposed service that the company did not know was exposed. Nobody chose them; they were simply reachable.
The agent uses a median of 1.1% CPU and roughly 120 MB of memory at steady state, and performs no scheduled full-disk scan — detection is behavioural and continuous rather than periodic and disruptive. Users generally do not know it is installed, which is the design goal.
If you are replacing a legacy antivirus that runs a Tuesday-morning scan, most organisations report machines feeling faster after the migration, not slower.
With MDR included, a Guardian analyst is looking at it within three minutes. They take the containment actions you pre-authorised — isolating a host, killing a session, disabling an account — and then they telephone your nominated contact. A written narrative of what happened and what was done is waiting when you open your laptop.
If the incident exceeds normal containment, Guardian's incident response team engages under the 40 hours included in your licence, with a median time to containment of 47 minutes.
It usually simplifies them. Guardian works with 840 certified managed service providers who can run the platform on your behalf under their own agreement, and the licence is portable — if you change providers, the tenant and its history stay yours rather than belonging to the outgoing MSP.
You can also hold the contract directly and grant your provider delegated access, which is what most organisations above 200 endpoints end up preferring.
Partly, and Guardian will tell you where. During onboarding we map what your existing licences already cover and configure Guardian to complement rather than duplicate — many customers reduce a security add-on tier as a result.
The gap Guardian fills for most smaller organisations is not raw signal; it is that nobody is watching the signal, and that the built-in tools stop at the boundary of one vendor's products while your attack surface does not.
An uninstall command and an export. Your telemetry is exportable in open formats for the full retention period, configuration is exportable as JSON, and the agent removes itself cleanly. There is no proprietary data format holding your history hostage and no exit fee.
We would rather you stay because renewal is obvious than because leaving is painful.
I am the IT department. All of it. Guardian phoned me at 04:12 to say they had isolated a machine in our Leeds office and I did not need to do anything until morning. That call is the entire product as far as I am concerned.
We replaced four products with one and our security spend went down 18%. That was not the goal — the goal was to stop having four dashboards nobody looked at — but it made the board conversation considerably shorter.
Our insurer asked for MFA coverage, EDR deployment percentage and mean time to respond. Previously that was a fortnight of screenshots. Now it is a report I generate before the meeting starts.
Full product, full managed detection, no sandbox and no credit card. If Guardian finds nothing in your estate worth acting on, you will have learned something valuable and it will have cost you an afternoon.