Agentic Workspace Security
COMPTEC IT utilises GUARDZ as it AI-Native unified Cybersecurity platform for its clientele wwhich allows COMPTEC IT to provide: identity, email, endpoint, and browser protection. Native ITDR, SentinelOne EDR, Networks, Check Point email security, and adaptive Security Awareness Training feed one connected view, so an incident shows up as one story instead of alerts scattered across tools. AI agents handle correlation and triage, and the Guardz 24/7 MDR team handles response. We have a fully qualified SOC tea dedicated to supporting our clients and our first layer of defense for all clients.
The Workspace Security Controls
Identity, email, endpoint, and browser are where attacks land. Security Awareness Training and Exposure deal with the human mistakes, misconfigurations and the external vulnerabilities that give attackers traction in the first place. Deploy and manage all six from one console, across every client.
ITDR:
Identity Threat Detection and Response actively benchmarks and analyzes user behavior as well as attack patterns.
Email Security:
Embedded Check Point email security with in-line API for phishing, zero-day malware, URLs, internal email scanning and more.
Endpoint Security:
Embedded SentinelOne EDR with AI-native malware and ransomware detection and real-time response.
Security Awareness Training:
AI-powered awareness training and phishing simulations adapt to user context and behavior. Automated onboarding and AI orchestration help reduce human risk with less manual effort.
External Exposure:
Continuous outside-in visibility across the attack surface, leaked credentials from the dark web, and data exposure in cloud drives.
Browser:
Embedded Prisma Browser for Business with malware scanning, malicious-site blocking, and AI tool visibility. Browser events correlate with identity, email, and endpoint alerts.
Managed Detection & Response (MDR)
Guardz MDR delivers continuous threat hunting, monitoring, incident triage, and rapid response across ITDR, EDR, browser, and email events. Agentic triage filters and enriches every alert before it reaches our fully managed 24/7 SOC, and the Autonomous Analyst presents each incident in the platform with a summary, the evidence, and the next action.
Alert Ingestion:
Ingests and classifies abnormal user behavior in the cloud and S1 alerts via API (no extra agent).
Agentic Triage:
Uses Agentic AI to triage and enrich raw findings, categorize threats, suppress benign detections, and escalate verified ones.
Response Actions:
User suspension and device isolation according to MSP approvals, while playbooks and incident reports steer further mitigation.
Service-Level Commitments:
24/7/365 expert managed SOC with 60-minute SLA for critical alerts and reported incidents.
Communication Channels:
Summarizes each incident in plain language, lays out the evidence, and takes response actions within approved scope.
Autonomous Analyst:
Real-time incident communication via phone, email, chat, and platform notifications, with full audit trail per incident.
Identity Threat Detection & Response - Managed ITDR
Guardz ITDR continuously monitors user behavior to flag abnormal patterns in cloud logs, preventing account takeover by cutting off attacker access before damage occurs.
Cloud-Native Coverage:
Natively integrates with M365 and Google Workspace to run analysis across the most critical cloud logs without complex integrations or service accounts.
Behavioral Analytics & Baselining:
Monitors user behavior to build benchmarks over time and detect deviations from these normal patterns, spotting threats like credential abuse and privilege misuse.
Automated Threat Response:
One-click actions to suspend or isolate users, revoke sessions, and reset pwds or MFA, cutting off stolen credentials and hijacked sessions before an attacker moves laterally.
Incident Timeline & Forensics:
Visualizes the full attack path across identity findings to help admins understand the who, what, when, and how, making incident investigation fast and actionable.
Cross Signal Mapping:
Correlates diverse findings from configurations, logins, mailboxes, and other log activity to expose complex identity attacks that would otherwise evade detection.
Built-In Use Cases & Playbooks:
Attack scenarios like BEC, ATO, and Data Exfiltration are formulated by expert researchers and threat hunters who also define playbooks to guide MSPs through incident response.
ITDR Technical Requirements & Deployment
Supported Integrations:
Microsoft 365 Google Workspace
Cloud Identity Source:
Microsoft Entra ID Google Identity
Deployment & Management:
Agentless with secure API integrations (Graph API) Enterprise Applications: Detection (read-only) and Response (read-write) Permissions are granted per OAuth 2.0 protocol with admin privileges
SentinelOne Singularity - Managed EDR
Behavioral and Static AI Engines:
Detects ransomware, fileless and zero-day threats via real-time analysis of processes and memory without cloud reliance.
Device Control:
Controls USB, Bluetooth, and HID devices to prevent unauthorized access.
Automated Response:
Agents autonomously terminate processes, quarantine files, and use rollback via Windows VSS.
Threat Investigations:
Storyline correlation with integrated VirusTotal and MITRE ATT&CK intelligence.
Firewall Control:
Enforce network access rules based on device location with profile-based policies.
Vulnerability Management:
Scans installed third-party apps and maps CVEs to MITRE ATT&CK.
Policy Management:
Global detection and remediation policies managed per org or customer via Guardz console.
Application Inventory:
Provides versioned software inventory for audit, compliance, and hygiene visibility.
SentinelOne Tiers & Deployment
SentinelOne Control delivers strong endpoint protection designed to stop threats before they execute.
- Advanced prevention (malware, ransomware, exploits) Automated remediation at the endpoint level
- Core visibility into alerts and security events
SentinelOne Complete* includes all Control level protection plus full EDR capabilities for advanced investigation and threat hunting.
- Deep telemetry (process, network, DNS, file activity) Full attack storyline & root-cause analysis
- Cross-endpoint investigation & event search Custom detection and STAR rules
Check Point (Avanan) Email Security - Managed Email Security
By integrating Check Point Email security into the same platform that also safeguards endpoints, identities, and more, Guardz enables service providers to close the gaps that attackers exploit while optimizing daily operations.
AI-Based Anti-Phishing:
Analyzes 300+ indicators per message to stop advanced phishing, BEC, and spoofing attacks.
Inline API Scanning:
Patented pre-delivery and in-mailbox inspection that detects threats missed by Microsoft/Google.
Zero-Day Malware Defense:
Parallel malware analysis and sandboxing to block ransomware and unknown file exploits.
Malicious URL Protection:
URL reputation checks, rewriting, and click-time analysis to prevent web-based attacks.
Allow/Block List Control :
Supports global allow/block lists of senders, domains, IPs and headers.
Inbound/Outbound/Internal Email Protection
Inbound/Outbound/Internal Email Protection:
Encrypted Attachment Handling:
Inspects password-protected files for hidden threats.
DLP& Encryption*:
Detects sensitive content and encrypts data based on policy.
Check Point (Avanan) Email Security - Managed Email Security
Technical Requirements & Deployment
Supported Platforms:
Microsoft 365 Google Workspace
Deployment Model:
100% API-based; no MX record changes, no SEG, no proxy, no appliances.
Shared Mailbox Support:
Protection extends to shared mailboxes and group mailboxes.
Native Quarantine Compatibility:
Works with Microsoft 365 Unified Quarantine.
Unified Policy Management:
All organization-level settings controlled through Guardz.
OAuth Permissions:
Uses secure org-level read/write scopes for scanning and enforcement.
Palo Alto Prisma Browser for Business - Managed Browser Security
Embedded in Guardz for tenant provisioning, deployment and configuration. Unifies browser events with identity, email, endpoint and data protection to help MSPs secure client workspaces.
Real-Time Phishing & Web Threat Protection:
AI analyzes pages as they render to block fake logins, browser-in-the-browser impersonation and adversary-in-the-middle session theft to protect day to day web browsing.
Malware Security:
Scans uploads and downloads across all file types for malware, analyzing chunked payloads or other evasive tactics, before they execute on the device.
Web Content Filtering:
Blocks websites by category or individual site and allows or blocks specific file extensions. One-click category policies reduce manual list management.
Extension Security
Provides near real-time extension inventory per client, with risk-based policies and individual extension blocking. Known-malicious extensions are blocked by default.
Data Controls:
Restricts copy/paste, uploads and downloads by website or category, including AI tools, to help prevent business data leakage.
Data Guardrails:
Blocks websites by category or individual site and allows or blocks specific file extensions. One-click category policies reduce manual list management.
Secure Workspace*:
Presents approved business apps and AI tools in a branded workspace, without per-user setup. Restricts access to the sanctioned browser only. *Standalone browser deployments only.
Cross-Signal Correlation
Normalizes browser events in the Guardz data fabric and correlates them with identity, cloud, email and endpoint activity to enrich incident timelines, MDR investigations and response.
Technical Requirements & Deployment
Plans:
Included in the Elite plan.
Available as add-on to other Guardz plans.
Supported Platforms:
Extension: Chrome, Edge and Brave on Windows and macOS.
Standalone Chromium browser: Windows, macOS and Linux.
Mobile is not currently supported.
Deployment Models:
Silent script deployment through RMM or MDM tools. Deploy the extension, standalone browser or both within a tenant.
Identity Requirements:
Microsoft 365 or Google Workspace. Microsoft 365 enables automatic sign-in after one-time admin consent. Google Workspace requires each user to sign in once.
Provisioning:
Activated per client in Guardz, following Palo Alto Networks compliance screening of tenant details.
Policy Management:
Shared policy engine across both deployment models. Configure policies once, with settings and console access managed per tenant.
Adaptive Security Awareness Training Capabilities
Guardz provides MSPs with ready-to-launch security training and phishing simulations that support consistent delivery of security education designed to measure improvement in user behavior.
Cross-Signal Context:
Plans from each userʼs full context across Guardz: mailbox activity, browser events, SAT history, EDR, open issues, and live incidents.
Self-Running Adaptive Program:
Decides and schedules the right training and phishing simulation for each user, and adapts as behavior changes.
One-Time Configuration:
Set it once for all clients, or tailor it per tenant. A 6-month plan is generated instantly, and settings can be changed at any time.
Per-User Plans:
Every user gets their own roadmap, staggered by risk and history, instead of the same simulation for everyone.
Automatic Follow-Up Training:
A failed simulation automatically sends the matching training video. Repeat failures are simulated more often.
Curated Content Library:
132 phishing simulation templates and 67 training modules, in 75 languages for training videos and simulations.
Onboarding Bundles & Auto-Enrollment
New users join automatically into pre-built (customizable) training bundles ensuring all employees meet awareness requirements from day one.
Full Transparency & Control:
Preview the exact email or video queued for any user, skip or cancel any step, or stop the roadmap with one toggle.
Technical Requirements & Deployment
- Supported on Microsoft 365 and Google Workspace
- Simulations delivered directly into the userʼs mailbox (email security allow-listing may be required)
- Configurable at MSP, tenant and user level.
- Auditor-ready reporting and tracking of all activity exportable as CSV.
- White labeling & branding of all training emails
- Granular tracking of clicks (open rate), credential submissions (failed test) and completed trainings.
- Overdue and non-compliant users flagged per client
- Compliance frameworks: SOC 2, HIPAA, PCI DSS, ISO 27001, CIS 14, GDPR and NIST CSF
Data Fabric
The Guardz Data Fabric is the data layer that brings together signals from identity, email, endpoint, browser, and additional log sources. It processes and correlates these signals to provide security context across customer environments, with federated search enabling queries across connected data sources. Log Ingestion & Retention extends this layer with centralized log collection and long-term storage. MSPs can query the data through MCP, retrieve it through the Open API, and generate various reports with Agentic Reporting.
Open API
Guardz Open API enables admins to programmatically access security and usage data, allowing seamless integration with PSA, SIEM, billing systems and more.
Data Access:
Access Guardz data through a REST API using GET requests to support custom integrations, reporting, and automation.
Data retrieval:
Pull a range of Guardz data, including customer information, tenants, security issues, incidents, users, devices, and usage.
Reporting and automation:
Build dashboards, consolidate data, and automate recurring data retrieval using preferred tools.
MCP (Model Context Protocol)
Connect your preferred AI tools to Guardz through MCP to seamlessly query and interact with security data using natural language.
Supported Tools:
Claude and Claude Code. More coming soon
Security queries:
Query a range of Guardz data including customer information, tenants, security issues, incidents, users, devices, and usage.
Investigation and prioritization:
Interactively ask follow-up questions, filter findings, and combine Guardz data with information from other connected tools.
Agentic Reporting
AI-powered security reporting inside Guardz. Create reports using pre-defined templates and via natural language chat, with scheduling and automated email delivery.
Security context:
Query and correlate a broad range of signals across Guardz, with direct access to federated search and platform data for deeper analysis and reporting.
Custom and predefined reports:
Start with a predefined or custom report, refine the results through chat in plain language, and save it for future use.
Scheduling and automation:
Schedule recurring reports and automate email delivery to keep clients and internal stakeholders informed.
Log Ingestion & Retention
Centralized log collection and long-term retention to support forensic investigations and threat hunting along with insurance requirements, regulation and compliance needs.
Supported logs:
Collect syslog from network and security devices (RFC 3164/5424), Windows Application, Security, and System event logs, and Microsoft 365 and Google Workspace cloud logs.
Deployment and retention
Firewall and Windows log collection requires a Windows device running the Guardz Agent. Retain logs for 1, 2, 3, or 7 years, with 90 days searchable and older logs available through export.
Compliance frameworks:
Support log retention requirements across HIPAA, PCI DSS, CMMC / NIST 800-171, SOC 2, NIS2, ISO 27001, and cyber-insurance policies.