100% self-hosted
The entire platform, including the AI, runs on your own servers or private cloud. Telemetry never leaves your perimeter.
SOC 2 Readiness
24/7 Security Monitoring
Canadian-Based SOC
GuardsArm Platform
Why GuardsArm
Everything a cloud MDR does in their environment, you run in yours — including the AI.
The whole category is built on sending your security data somewhere else to be analysed. For a great many regulated and data-sensitive organisations that is not a preference to be weighed, it is a condition they cannot meet.
- No data egress
- Local LLM
- White-label
- Air-gap capable
The comparison
Self-hosted against the cloud MDR model
Written against the delivery model rather than any named vendor, since what differs is structural: where the data sits, where the AI runs, and who the console belongs to.
| Dimension | Cloud MDR model | GuardsArm |
|---|---|---|
| Where your telemetry lives | On the vendor's infrastructure, analysed in their environment. | On your own servers or private cloud. It never leaves your perimeter. |
| Where the AI runs | In the vendor's cloud, on their models. | On your hardware, on a local language model. No call to an external AI provider. |
| Pricing shape | Typically metered per gigabyte or per event, which quietly decides what you collect. | Self-hosted licensing. What you collect is a security decision, not a billing one. |
| Branding | Their console, their name in front of your client. | A re-brandable multi-tenant console you deliver as your own. |
| Auditability | Detection logic and data handling sit behind the vendor boundary. | Rules and data are yours to inspect, because both are on your side of the line. |
| Air-gapped environments | Not addressable — the model depends on egress. | Dependencies are self-hosted, so the stack runs with no internet egress. |
Where a cloud service fits your constraints, it may well be the easier choice. This page exists for the organisations it does not fit.
Differentiators
What the architecture buys you
On-prem AI, local LLM
The AI SOC Analyst runs a local language model. Full triage, correlation and reporting with zero data egress to an AI provider.
White-label for MSPs
A fully re-brandable multi-tenant console. One deployment serves many customers, each isolated and seeing only their own data.
A unified stack
SIEM, XDR, EDR, vulnerability management, threat intelligence, ITDR, AIDR and SOAR in a single product — not a bundle of bolt-ons.
Full MITRE ATT&CK mapping
Detections and incidents map to ATT&CK techniques and tactics against a complete enterprise knowledge base.
Transparent architecture
Built on proven open foundations. No black box — you can audit the rules and the data, because both are yours.
No usage lock-in
Self-hosted licensing instead of per-gigabyte or per-event cloud metering.
Fit
Who this is built for
MSSPs and MSPs
Run one deployment, sell managed SOC to many clients, each fully isolated, and re-brand the console as your own.
Healthcare
On-premises means protected health information never leaves the network, with HIPAA compliance tagging and evidence built in.
Fintech and SaaS
SOC 2 and PCI evidence, a full audit log, RBAC and tenant isolation.
SMB and lean security teams
An AI SOC analyst that handles first-line triage, so a small team covers more ground.
Questions
The ones worth asking
Is self-hosting just more work for us?
It is more infrastructure responsibility, and that is the honest trade. What it buys is that the data stays yours, the licensing is not metered on volume, and the deployment is usable in environments that cannot export telemetry at all. For an organisation with no such constraint and no appetite for running infrastructure, a cloud service may genuinely suit better.
Does an on-prem AI mean a weaker AI?
It means a local model rather than a frontier hosted one. The design compensates by keeping the AI as a downstream consumer of detections rather than the detection mechanism, so the platform never depends on the AI to function — and by grounding it in a retrieval knowledge base over your own environment and incidents.
How does this compare to running Splunk or Elastic ourselves?
Those are data platforms you then build detection on. GuardsArm ships the detection engine, the behavioural analytics, the ATT&CK mapping, correlation, response and the agent as one product. The underlying indexing is enterprise-grade, so the data layer will be familiar.
What is not generally available yet?
Two things, named plainly: the macOS agent, where the code is ready and the signed and notarized build is pending, and multi-node high-availability clustering. Deployments are single-node today.
Do you also run the SOC for us?
That is a separate offering. The platform is what you run yourself; GuardsArm also delivers managed detection and response and SOC-as-a-service as services. The two are deliberately distinct, and which fits depends on whether your constraint is data residency or staffing.
Bring your constraints
Air-gapped, regulated, multi-tenant, or simply unwilling to export telemetry — those are the conversations this platform exists for.
24/7 SOC Monitoring Available