Twenty-seven answers, written by the people who would have to defend them

One product, one sensor, one console, one data model. Endpoint, cloud, network, identity and data protection are capabilities of the same platform rather than separately architected tools sharing a logo. That matters operationally: a detection can correlate a process execution on a laptop with an anomalous token issued in your identity provider and an unexpected egress flow, because all three are events in the same graph.

The practical consequence is that you never integrate Guardian with Guardian. There is no connector between our own modules, no duplicate agent, and no reconciliation job to work out whether two consoles are describing the same incident. See the platform overview for the architecture.

Windows 10 21H2 and later, Windows 11, Windows Server 2016 through 2025, macOS 13 Ventura and later on both Apple silicon and Intel, and the major Linux distributions: RHEL and derivatives 8/9/10, Ubuntu LTS 20.04 onward, Debian 11+, SUSE Linux Enterprise 15, Amazon Linux 2 and 2023. Container runtimes covered are containerd, CRI-O and Docker, on Kubernetes 1.26 and later including EKS, AKS, GKE and OpenShift.

Legacy estates are supported with a reduced-capability sensor for Windows Server 2012 R2 and CentOS 7, which many customers still need for OT and clinical systems. Mobile threat defence covers iOS 16+ and Android 12+. Full version matrices and end-of-support dates are in the datasheets.

Median steady-state CPU is below 1 percent, resident memory is approximately 180 MB on Windows and 145 MB on Linux, and the installed footprint is under 400 MB including local models. During a full on-demand scan CPU rises to a configurable ceiling that defaults to 25 percent of one core.

The number that usually matters more is boot and login delay, because that is what users complain about. Guardian adds a median of 0.4 seconds to boot and no measurable login delay. On Windows the sensor runs its detection logic in user mode with a minimal kernel callback surface, which is why an agent fault cannot bugcheck the machine — a design decision the industry learned the hard way.

For most customers it replaces the security-detection workload of the SIEM, and about a third of customers retire the SIEM entirely within two years. Sentinel already ingests, normalises, correlates and retains security telemetry with sub-second search across the full retention window, so running a second copy of that pipeline is usually pure cost.

What Sentinel does not try to be is a general-purpose log warehouse for application, billing and business telemetry. If your SIEM is doing that job, keep it and stream Guardian incidents into it — we have certified integrations for Splunk, Microsoft Sentinel, Elastic, QRadar, Chronicle and Exabeam, listed on the integrations page.

Every triage decision produces a written record: the evidence considered, the detections that fired, the historical sightings compared against, the hypotheses evaluated and rejected, and the confidence attached to the conclusion. That record is stored with the incident, is queryable through the API and is exportable for audit. It is not a summary generated after the fact — it is the reasoning trace itself.

Autonomous containment is always bounded by a policy you write. You decide which incident classes may be actioned without a human, on which asset groups, at which confidence threshold, and during which hours. Everything else is a recommendation with a one-click approval. Details are on the automation and response page.

Protection is local-first. Prevention models, behavioural detection and ransomware rollback all execute on the device using models that ship with the sensor, so an offline laptop in a hotel is defended exactly as it would be on the corporate network. Telemetry is buffered locally for up to 14 days and uploaded when connectivity returns, preserving the full timeline.

For permanently disconnected estates, Guardian supports an on-premises deployment where the entire control plane runs inside your boundary and intelligence updates are delivered as signed offline bundles on whatever cadence your change process allows. This is common in defence, nuclear and pharmaceutical manufacturing environments.

Per protected asset, per month, billed annually. One endpoint, server or workstation is one asset. Cloud container capacity is counted at 8 vCPU of concurrent protected capacity per asset unit, averaged over the month rather than measured at peak. One monitored human identity is one asset. One passively discovered OT device is one asset.

Console users, API clients, service accounts, machine identities, detection content and telemetry produced by Guardian sensors are never licensed units. Full rates and plan inclusions are on the pricing page.

Nothing stops working. There is no licence enforcement that leaves a machine undefended while procurement catches up, because an unprotected endpoint is a security incident waiting to happen and we are not willing to cause one over an invoice.

Overage is reconciled at the next quarterly true-up and invoiced pro rata at your contracted rate. If growth pushes you into a better volume tier, the improved rate is applied to the entire estate rather than only to the new assets. Sustained overage triggers a conversation about resizing the commitment, not a penalty.

Yes. Guardian transacts through more than 400 resellers, distributors and MSSPs worldwide, and is listed on the AWS, Microsoft Azure and Google Cloud marketplaces. Marketplace purchases usually draw down against your committed cloud spend, which for many organisations is the fastest route through procurement.

Public sector buyers can transact through GSA, G-Cloud, SEWP and equivalent regional frameworks. Support, service levels and product entitlement are identical regardless of purchase route — you are never a second-class customer for buying through a partner. See Guardian Partners.

USD, EUR, GBP, CAD, AUD, SGD and JPY, invoiced annually in advance by default. Quarterly and monthly invoicing are available on Enterprise and Sentinel Complete. Standard payment terms are net 30, with net 45 and net 60 available by region and by negotiation.

Multi-year terms fix the per-asset rate for the whole period, including assets added mid-term. Three-year commitments are typically 12 percent below the annual rate and five-year around 18 percent. Purchase orders, e-invoicing portals and consolidated billing across business units are all supported.

You keep full read and export access for 30 days after the subscription ends. During that window you can export incidents, detections, telemetry and audit logs through the API or as bulk archives in open formats — JSON, Parquet and OCSF — not a proprietary blob that only Guardian can read.

Thirty days after the export window closes, all customer data is permanently deleted from primary and backup systems within 45 days, and Guardian issues a signed certificate of deletion. Sensors can be removed by policy, by script or by your normal software-management tooling; there is no phone-home requirement and no uninstall password held hostage. The full data lifecycle is documented on Trust & security.

Open cases from the Guardian console under Support → New case, which attaches your entitlement, tenant region, sensor versions and recent platform events automatically. Email to [email protected] also works. Premium, Signature and Complete customers can additionally open cases by phone.

Severity 1 first-response targets are four hours on Standard, one hour on Premium, fifteen minutes on Signature and three minutes on Sentinel Complete. Every case is answered by an engineer with production access, not a triage script. Full severity definitions and update cadences are on the support hub.

Guardian MDR puts our SOC inside your tenant. We monitor continuously, triage every incident within three minutes, investigate, and take containment action on your behalf under a written authority matrix that you approve line by line — which hosts may be isolated, which accounts may be disabled, at what hours and at what confidence.

You keep full visibility and can override anything at any time; it is your tenant, not a black box we operate beside you. MDR customers also receive proactive threat hunting as a monthly written report and a named shift lead they can call. Details on the managed detection and response page.

Yes. A standard retainer is 40 pre-paid hours per year with a one-hour engagement service level and a named lead responder who is briefed on your architecture before anything happens. It covers ransomware, extortion, business email compromise, insider incidents, destructive attacks and data theft, including forensic imaging, malware analysis, threat-actor attribution and regulator-ready reporting.

Unused hours convert to consulting, training or tabletop-exercise credit at renewal, so a quiet year is not wasted budget. Retainer customers also get a discounted hourly rate if an incident exceeds the retained hours. Without a retainer, the emergency hotline is still answered — the first triage call is free for anyone. See incident response.

Email [email protected], encrypted with the PGP key published on Trust & security. We acknowledge within one business day, provide a triage decision within three, and agree a remediation timeline with you rather than imposing one.

Guardian operates a public bug bounty with legal safe harbour for good-faith research, no gag clause and no requirement to delay publication beyond a coordinated 90 days. Researchers are credited in the advisory unless they ask not to be, and qualifying findings are rewarded on a published scale.