For companies with 10 to 500 staff, and the IT providers who serve them
Proof that you can recover. Proof that you're not exposed.
Guardian checks two things every month and writes them up in plain language: whether your backups would actually restore after a ransomware attack, and whether any of your equipment is reachable from the internet. It is the evidence NIS2 auditors, cyber insurers and your customers' security reviews now ask for.
Why now
Three things changed in 2026. Backup management became a legal control, insurers started demanding tested restores, and a cyber-attack on supermarket freezers showed what an unpatched controller on the internet costs.
NIS2 names backups
Article 21(2)(c) requires business continuity "such as backup management and disaster recovery" as an evidenced control. Supply-chain clauses push the same questions down to small suppliers, even below the thresholds.
Insurers check restores
Cyber-insurance renewals now ask for isolated backup credentials, immutable copies and tested restores within the last 90 days, with documented results. No evidence, higher premium or no cover.
Freezers got hacked
In October 2026 attackers reached refrigeration controllers at hundreds of French supermarkets through software that could no longer be updated. Losses: tens of millions of euros in spoiled food. The vendor had already identified the risk.
"Attacking equipment that is essential to preserving fresh produce and the food supply of the French people is extremely serious and without precedent."Chief executive of Coopérative U, after the October 2026 attack, as reported by E24 and the BBC
How it works
Read-only connections and public data only. No agents on your production servers, no penetration testing, no exploitation, nothing changed without your say. You authorise exactly what we look at, in writing, before we look. Guardian observes and proves; it never attacks.
Connect
A read-only link to your backup system (Veeam, Proxmox Backup, Synology, Azure Backup) and a list of the public addresses and equipment you own.
Check
Every day we collect job results, retention, immutability and restore-test records, and scan your external footprint against known-vulnerable products: refrigeration, HVAC, cameras, UPS, door systems.
Report
Once a month you get a plain-language report with a traffic-light summary and a fix list in priority order, written for a managing director, not an engineer. Urgent findings come the same day.
Prove
Quarterly, a signed attestation of your restore tests and exposure status, formatted to answer insurer and NIS2 questionnaires directly.
What the report answers
Seven questions, the same every month, so trends are obvious and auditors see consistency.
| Question | Evidence collected | Who asks for it |
|---|---|---|
| Did every backup job complete? | Job logs, success rate, missed systems | NIS2 Art. 21, insurers |
| Have you restored something recently, and did it work? | Restore test records with dates and outcomes | Insurers (90-day window), auditors |
| Is there a copy ransomware cannot delete? | Immutability and retention settings, off-site copy | Insurers, NIS2 implementing regulation |
| Can one stolen password destroy the backups? | Credential separation, MFA on backup console | Insurers |
| What of yours can be reached from the internet? | External scan of authorised addresses | NIS2 Art. 21, customers' supply-chain reviews |
| Is any of it known to be vulnerable or unsupported? | Match against vulnerability databases and vendor end-of-life notices | Cyber Resilience Act context, insurers |
| Can someone send email as you? | SPF, DKIM and DMARC checked from public DNS | Insurers, customers; CEO-fraud prevention |
| Is any of your equipment out of vendor support? | Your device list matched monthly against end-of-life notices | Cyber Resilience Act context, insurers |
| Have staff logins leaked, or is someone imitating your domain? | Breach-data lookups and lookalike-domain watch (Plus) | Insurers, finance teams |
| Is your Microsoft 365 safely configured? | Read-only posture: MFA coverage, legacy auth, admin count, stale accounts (Plus) | Insurers, NIS2 Art. 21 |
| Are you ready for the next questionnaire? | Gap list mapped to NIS2 Art. 21 and common insurer forms | You |
Pricing
Monthly, cancel any time, prices exclude VAT. Every plan is non-intrusive: public data and read-only connections only.
Company
- Backup evidence, all systems
- External exposure check, non-intrusive
- Email spoofing protection: SPF, DKIM, DMARC
- Certificate and domain expiry alerts
- Equipment end-of-life watch
- Monthly report, same-day alerts, quarterly attestation
Company Plus
- Leaked staff credentials, from breach data
- Lookalike-domain watch against invoice fraud
- Microsoft 365 posture, read-only
- Website hygiene: TLS, headers, outdated software
Compliance
- NIS2 Article 21 policy kit: backup, continuity, incident response, generated from your real evidence
- Questionnaire answers for insurers and customers from live data
- Annual evidence file for audits
IT providers: the Provider plan covers up to ten client sites on any tier from €449 a month, with reports in your name. Scanning covers only addresses and systems the customer owns and authorises in writing. Guardian does not perform penetration tests. It reports and attests; it does not replace your IT provider or your backup software.
Talk to us
Leave an email and we will reply within one working day with a short questionnaire to see whether Guardian fits.
Replace the placeholder address with the real one before launch.