Pick the box that fits the network.
The GPU’s memory decides how large an AI model Guardian can run, and model size drives reasoning depth. Every tier also needs at least two network ports and room for months of audit trail. These tiers are design targets: they become a firm spec once a model passes our exam on them (latest results).
Development & evaluation
| GPU | 16 GB GPU (e.g. RTX 5060 Ti 16 GB) |
|---|---|
| RAM | 32–64 GB |
| Storage | 1 TB NVMe |
| Model class | ~14–20B |
Building and testing Guardian. Proves the plumbing; not for production.
Small office
| GPU | 24–32 GB GPU (e.g. RTX 4090 24 GB, RTX 5090 32 GB) |
|---|---|
| RAM | 64 GB |
| Storage | 1 TB NVMe + 1 TB SSD |
| Model class | ~20–32B |
Single site, one IT contact. Quiet desktop tower or short-depth rack box.
SMB / multi-site
| GPU | 48 GB GPU (e.g. RTX 6000 Ada 48 GB, L40S 48 GB, Radeon PRO W7900 48 GB) or 2 × 24 GB |
|---|---|
| RAM | 128 GB |
| Storage | 2 TB NVMe + 2 TB SSD |
| Model class | ~30–70B (quantised) |
Several sites over VPN, AD + M365, compliance reporting.
Enterprise
| GPU | 80 GB+ data-centre GPUs (e.g. A100 / H100 80 GB) or multiple 48 GB cards |
|---|---|
| RAM | 256 GB+ |
| Storage | RAID 1 NVMe, 4 TB+ |
| Model class | 70B+ or several models |
Your own servers or cluster, HA pair, on-site portal, SSO.
Design targets, not final specs. Final sizing follows the exam results; see how we test.
What would your site need?
Three questions, one starting recommendation. We’ll confirm it with you before anything is ordered.
Every way it can run.
Supplied appliance
A pre-built Guardian box per site, imaged, tested and shipped. Plug into the management VLAN and power. Updates arrive signed.
Bring your own server
Your hardware, our certified build. It must meet the tier spec, and a short exam run confirms the box before go-live.
VM with GPU passthrough
Hyper-V Discrete Device Assignment, VMware passthrough or vGPU, or Proxmox PCIe passthrough. Dedicated VM, dedicated GPU, management VLAN only.
Kubernetes
For enterprise platforms: containers on GPU nodes via the NVIDIA GPU Operator, with the vault and audit store on persistent volumes. Planned.
Multi-site hub
One box per site is the default. For many small branches, a hub box at head office with lightweight collectors at each branch over site-to-site VPN. Planned.
Air-gapped
No internet at all: an on-site portal, model and software updates on signed offline media, and threat feeds imported manually. Enterprise option.
High availability
A warm-standby second box with replicated audit trail and vault. Because Guardian is out-of-band, a failure never takes the network down.
MSP estate
One box per client site, every client isolated, all managed from one MSP approval queue and portal.
Apple Silicon & CPU-only
Large-memory Macs are a promising quiet option for small offices. CPU-only boxes suit monitoring and batch work but are too slow for live incident reasoning.
What the box needs from you.
| Placement | Management VLAN, alongside switches and hypervisor management |
|---|---|
| Inbound | None. You open no inbound firewall ports |
| Outbound | HTTPS (443) to the Guardian portal and update service only. None when air-gapped |
| To managed devices | SSH (22), WinRM (5985/5986), HTTPS vendor APIs (443), SNMP (161) as each device needs |
| Identity | Least-privilege service accounts per system, held in Guardian’s vault |
| Power | ~300–800 W under load depending on GPU. A UPS is strongly recommended |
| Form factor | Quiet tower for offices, 2U rack server for comms rooms |
The kit UK networks actually run.
Systems
Windows Server & Windows 11, Active Directory, Entra ID, Microsoft 365 / Exchange Online, Ubuntu & other Linux.
Firewalls & routers
Fortinet FortiGate, Ubiquiti UniFi, DrayTek, SonicWall, WatchGuard, pfSense / OPNsense, MikroTik.
Switching & Wi-Fi
Cisco IOS & Meraki, HPE Aruba, UniFi switches and access points.
Security tools
Wazuh, Microsoft Defender. Planned: Sophos, Palo Alto, Check Point, Juniper.
Virtualisation
Hyper-V for monitoring today. Planned: VMware and Proxmox.
Backups (monitor only)
Veeam and NAS repositories (TrueNAS, Synology): job health, restore-point age and capacity.
Two support levels: full control (a tested adapter with verify and rollback) or knowledge only (Guardian diagnoses and writes exact steps for a human to run).
What we test it on.
| Box | Spec | Role |
|---|---|---|
| Lab host | 16+ cores, 128 GB RAM, 2 TB NVMe + 2 TB SSD, Hyper-V | Runs every lab VM: firewall, DC, servers, PCs, simulated internet |
| Guardian box | 24–48 GB GPU, 64 GB RAM, 1 TB NVMe, 2 NICs | The real appliance under test, same build as a client box |
| UniFi kit | Managed switch + access point | Real switching and Wi-Fi, because UniFi can’t be fully emulated |
| Dev rig | RTX 5060 Ti 16 GB | Daily development and the first model benchmarks |
Hardware questions.
Does Vantage Guardian sit in the data path?
No. Guardian is out-of-band: it manages your network through the same remote management paths an engineer would use (SSH, WinRM, vendor APIs). If the Guardian box powers off, your network keeps running; you simply lose Guardian's monitoring and automation until it's back.
Can we run Guardian on hardware we already own?
Yes, for enterprise and capable SMB sites: bring your own server that meets the spec for your tier, or a VM with a GPU passed through (Hyper-V DDA, VMware passthrough or vGPU, Proxmox PCIe passthrough). We certify the build with a short exam run before go-live.
Can it run without a GPU?
Monitoring, alerting and the audit trail can, but the AI reasoning is too slow on CPU alone for responsive incident work. CPU-only is suitable for batch jobs such as overnight grading, not as the main engineer.
What about Apple Silicon?
Macs with large unified memory can run big local models efficiently and are under evaluation as a quiet small-office option. They aren't a supported production platform yet.
Is the hardware sizing final?
No. These are design targets. Final sizing depends on which model class passes the exam at PhD level, and we'll publish that when the results support it.