100% self-hosted
The entire platform, including the AI, runs on your own servers or private cloud. Telemetry never leaves your perimeter.
SOC 2 Readiness
24/7 Security Monitoring
Canadian-Based SOC
GuardsArm Platform · v2.0.0
The whole security stack, running on your infrastructure
A self-hosted, white-label SIEM + XDR + EDR platform with a built-in AI SOC Analyst that runs entirely on your own servers.
It unifies log management, endpoint detection and response, vulnerability management, threat intelligence, identity threat detection and security automation into one console — and adds an on-prem AI analyst that triages, correlates and explains alerts using a local language model, so sensitive security data never leaves your network.
- Self-hosted
- White-label
- Local LLM
- Air-gap friendly
Why it is different
Most detection and response ships your data to the vendor
Cloud MDR is the default model: your telemetry goes to someone else’s infrastructure, and their analysts and their AI look at it there.
GuardsArm inverts that. The entire platform — detection, storage, investigation and the AI analyst — runs on hardware you control. Auditable, no per-gigabyte metering, and no data leaving your perimeter to be analysed.
Who it is for
MSSPs and MSPs
Run one deployment, sell managed SOC to many clients, each fully isolated, and re-brand the console as your own.
Healthcare
On-premises means protected health information never leaves the network, with HIPAA compliance tagging and evidence built in.
Fintech and SaaS
SOC 2 and PCI evidence, a full audit log, RBAC and tenant isolation.
SMB and lean security teams
An AI SOC analyst that handles first-line triage, so a small team covers more ground.
Differentiators
What you get that a cloud platform cannot offer
On-prem AI, local LLM
The AI SOC Analyst runs a local language model. Full triage, correlation and reporting with zero data egress to an AI provider.
White-label for MSPs
A fully re-brandable multi-tenant console. One deployment serves many customers, each isolated and seeing only their own data.
A unified stack
SIEM, XDR, EDR, vulnerability management, threat intelligence, ITDR, AIDR and SOAR in a single product — not a bundle of bolt-ons.
Full MITRE ATT&CK mapping
Detections and incidents map to ATT&CK techniques and tactics against a complete enterprise knowledge base.
Transparent architecture
Built on proven open foundations. No black box — you can audit the rules and the data, because both are yours.
No usage lock-in
Self-hosted licensing instead of per-gigabyte or per-event cloud metering.
Modules
One platform, not a bundle of bolt-ons
Every module below shares the same telemetry, the same severity model and the same response engine. They are parts of one product rather than separately licensed tools stitched together.
Detect
SIEM & Log Analytics
Collect, normalise and search security events from your entire environment — on infrastructure you control.
ExploreXDR — Detection & Correlation
Turn raw events into severity-graded, ATT&CK-mapped alerts — then connect them into real attacks.
ExploreEDR — Endpoint Detection & Response
Deep endpoint visibility and on-box response, from a lightweight native agent.
ExploreFlagship
AI SOC Analyst
An on-prem AI analyst that triages, correlates and explains — using a local LLM, so your data never leaves your network.
ExploreITDR — Identity Threat Detection & Response
Detect identity-based attacks across your directories and cloud identities.
ExploreAIDR — AI Detection & Response
Secure your organization's use of GenAI and LLMs.
ExploreThreat Intelligence & Threat Map
Enrich every detection with global threat context.
ExploreMalware Detection
Catch malware three ways.
ExploreRespond
Govern
Deployment
Deployed where your obligations require
On your own hardware, in your private cloud, fully air-gapped, or under your own brand. Security telemetry stays inside your perimeter in every one of them — including the AI analysis.
On your own infrastructure
The entire platform runs on hardware you own, in a datacentre you choose. Nothing about detection, storage or analysis depends on a connection to us.
In your private cloud
Deploy into your own cloud tenancy when you would rather not run metal. The boundary is still yours: your account, your region, your key management.
Fully air-gapped
Dependencies are self-hosted, so the platform operates with no internet egress at all — including the AI. For classified and operational-technology environments this is the only workable model.
Delivered under your brand
Service providers run one deployment across many customers, each isolated from the others, presented in a console carrying their own name rather than ours.
Flagship
An AI SOC Analyst that never sends your data anywhere
Purpose-built analyst models for triage, correlation and reporting, running a local language model on your own hardware. And it is a downstream consumer of detections, never the source of truth — so the platform keeps detecting whether or not the AI service is running.
Explore the AI SOC AnalystSee the platform running in your own environment
A walkthrough of the console, the deployment model, and what standing it up on your infrastructure actually involves.
24/7 SOC Monitoring Available