Guardian AI
Self-hosted AI cybersecurity for your servers
Seven layers of AI threat detection that run entirely on your own machines. Guardian watches every process, file and connection, and responds to attacks in under 30 seconds — with nothing ever leaving your network.
- Docker
- Windows
- Linux
- x86-64
- ARM64
Why Guardian AI
Response in under 30 seconds
Kill the process, block the IP, quarantine the file and produce a forensic report — automatically, before an analyst even reads the alert.
AI that explains itself
Ask “what happened at 3am?” in plain language and get a clear answer, powered by your own keys.
Nothing leaves your network
No telemetry and no cloud dependency — ideal for regulated and air-gapped environments.
Audit-ready in one click
Generate SOC 2, ISO 27001, HIPAA, PCI-DSS and GDPR reports with evidence collected for you.
You own the whole stack
- BYOKBring Your Own Key
Plug in your own AI provider key for deep analysis — Guardian never sees or stores it.
- BYOMBring Your Own Model
Prefer a local model? Point Guardian at your own Ollama or vLLM endpoint.
- BYODBring Your Own Data
Every event, log and forensic report stays in your own database.
- BYOIBring Your Own Infrastructure
Runs as a Docker container on your servers — cloud, on-prem or air-gapped.
- BYOXBring Your Own eXecution
You own the whole detection stack end to end. No telemetry, no call-home.
Capabilities
- ✓7-layer threat scanner (hash, entropy, YARA, AI deep-scan and behaviour)
- ✓Real-time file-integrity monitoring with instant alerts
- ✓Process tree analysis — detects privilege escalation, miners and reverse shells
- ✓Live network monitor with C2 domain blocking and geo-mapping
- ✓NIST-based incident response workflow with one-click containment
- ✓Natural-language AI analyst chat (BYOK)
- ✓One-click compliance reporting
- ✓Single dashboard for 1 to 1,000 servers
Own Guardian AI for life
One lifetime licence. Runs on your own servers — cloud, on-premise or air-gapped. Your keys, your data.