Managing a network means handling its most sensitive material: firewall rules, account lists, logs full of user names and IP addresses, and the credentials that unlock everything. Sending that to a cloud AI service is a hard sell to any IT manager, and for good reason.
What a cloud AI agent would need to see
To diagnose a lockout storm or a VPN attack, an agent reads event logs, sign-in records, firewall logs and configuration. To fix it, it needs credentials. A cloud-hosted agent would hold or relay all of that off your premises, on infrastructure you don’t control, under terms that can change.
The on-site design
Vantage Guardian runs a local language model on a dedicated box inside your network, on the management VLAN:
- The model runs locally. Prompts, logs and reasoning never leave the box.
- Credentials live in an on-box vault, issued for minutes at a time per step and revoked straight after. The model never sees a plaintext password.
- The audit trail stays on site. Copies can be forwarded to your own log server.
- The portal holds no secrets. It carries approvals and summaries only, over an outbound-only encrypted connection. You open no inbound ports.
GDPR and data minimisation
Logs contain personal data. Keeping processing on your premises avoids an international transfer question entirely, keeps the data with the controller, and makes data-protection impact assessments far simpler. It also makes the “where is our data?” conversation with clients very short.
Isolation between clients
For MSPs this matters twice over. With one box per client site, each with its own vault, keys and audit trail, a problem at one client can’t reach another. Isolation comes from the hardware, not from a shared cloud tenant.
Resilience
Guardian is out-of-band: it manages your network through the same remote management paths an engineer uses, and it isn’t in the data path. If the internet link drops, it keeps working locally. If the box itself goes offline, your network carries on as normal.
The trade-off: hardware
Local AI needs a GPU with enough memory to run a capable model. That’s a real cost, and it’s why we publish honest sizing tiers, from a quiet small-office tower to data-centre GPUs, on our hardware page. Model quality on local hardware is improving quickly, and the exam tells us when a model class is good enough.
Cloud AI is convenient. For something holding the keys to your network, on-site is the responsible default.
Want Guardian on your network? Join early access as a design partner.