Security for corporates and group companies

Many sites, many servers, one view

• Every website and web app is protected the same way, with a DNS change per domain, and appears in one console with its own counters, findings and report.
• Linux servers are enrolled with one command each and report to the same console. Windows computers and email domains join it as those areas become available.
• The free security check gives a quick grade for every domain in the group, which is a good first inventory.
• Domain protection for every domain the group owns: registrar lock and expiry, DNSSEC, certificate authority and mail records, newly issued certificates and lookalike domains, with an alert when anything changes. Available now.
• Two-factor sign-in for every console user, and account-takeover detection that flags impossible travel, poor address reputation and coordinated attempts. Available now.
• The external attack surface map, on request, finds the sites and hosts nobody remembered.

Team roles that match the organisation

Viewers can see. Operators can act on findings. Administrators can change protection and manage people. Roles are set per team, so a subsidiary's IT lead sees that subsidiary, a vendor sees only the sites it maintains, and group security sees everything. Every change is written to the activity log with who made it and when.

A monthly report the board can read

Each month Guardian produces a report in plain language: what was blocked, what was found, what was fixed and what is still open. Today the report covers websites. Sections for servers, computers, email and the organisation protection score follow as each area becomes available. It is written so a director with ten minutes understands the state of the group without a briefing. Between reports, Guardian Agent groups real signals into incidents and emails a plain-English explanation of what happened and what to do.

Evidence for auditors

Guardian keeps a timestamped, tamper-evident ledger of what it observed and what your team did about it. Each entry is chained to the one before it, so any alteration shows. Records can be exported so an auditor can confirm they are exactly what Guardian recorded.

Observed facts are also mapped to controls in NIST CSF 2.0, ISO 27001:2022 and OWASP ASVS, with the evidence and the suggested fix for each. This is a mapping, not a certification. Guardian supplies the evidence. Your auditors draw the conclusions.

Read-only, by design

No Guardian agent can block, delete or change anything on your systems. That matters more in a large estate, where one bad change from a security tool can take many companies offline at once. Every change is made by your own administrators from the fix list, and the console records it.

Procurement

Guardian is available by request. Bring us a written scope, your security questionnaire and your data handling requirements. Our team verifies the organisation and the people who will hold access, and replies by email. Guardian is operated in India by Merdot Private Limited, and the console can be hosted in India on request.

Questions

How many sites can one console hold?

As many as the group has. Each is protected and reported separately, and roles decide who sees which.

Can a vendor manage only its own sites?

Yes. Roles are set per team and per site. A vendor sees and acts on the sites it is given and nothing else, and every action is logged.

Does Guardian hold a certification for us?

No. Guardian maps what it observed to NIST CSF 2.0, ISO 27001:2022 and OWASP ASVS controls and gives your auditors timestamped, tamper-evident evidence. The conclusions are theirs.

Can we start with a few sites and grow?

Yes. Most groups start with the public sites, add servers, and bring in computers and email domains as those areas become available.