Coming soon · Vantage Guardian is in development and being tested now. · In development Talk to us about your network
A technician with a laptop working on a server rack

Setup & onboarding

From first call to go-live in six weeks.

Every step of putting Guardian on a client network: what we do, what your team does, and why it watches for a month before it touches anything.

Start with a discovery call →Client checklist

Photo: Derrick Coetzee from Berkeley, CA, USA, CC0, via Wikimedia Commons (cropped)

The eight steps

Earn trust first. Then act.

  1. 01

    Discovery call

    Week 0 · 45 minutes

    We learn how your network is built and run: sites, device counts, firewall and switch brands, AD or Entra, Microsoft 365, backup software and who your IT manager is. You get an indicative tier and price.

  2. 02

    Network survey

    Week 1

    A read-only inventory: device list, VLANs, management paths and current monitoring. We agree which systems Guardian will manage at full control and which are knowledge-only.

  3. 03

    Prerequisites

    Week 1–2 · your IT team

    You prepare the management VLAN port, least-privilege service accounts, a firewall API admin locked to the Guardian box's address, and a Microsoft 365 app registration with only the permissions Guardian needs. We send a checklist with exact steps for your vendors.

  4. 04

    Install day

    Week 2 · half a day on site or remote

    The box is racked or placed, powered via UPS, connected to the management VLAN and enrolled. Service credentials go straight into Guardian's vault: typed by your team, never emailed and never seen by the AI.

  5. 05

    Observer phase

    Weeks 2–5 · Monitor only

    Guardian watches everything and changes nothing. It builds a baseline, maps your network and writes the daily diary. You see what it would have done, with evidence, before it is allowed to do anything.

  6. 06

    Permissions workshop

    Week 5 · 1 hour with your IT manager

    We walk through the diary together and set the access-rights matrix: which device groups move to Ask or Auto, maintenance windows, protected devices, emergency containment on or off, and who gets paged.

  7. 07

    Go-live

    Week 6

    Safe, obvious tasks go to Auto (service restarts, workstation patches, unlocks, IP blocks). Everything riskier starts on Ask. The approval queue and alerts go to your manager's phone and email.

  8. 08

    Ongoing

    Every month

    A monthly review of the diary, fault register and approvals; signed software and model updates, each of which must pass the exam before release; and permission changes whenever you want them.

Client checklist

What we’ll ask your team for.

Nothing exotic. It’s the access a new senior engineer would need, scoped down to exactly what Guardian’s permissions allow.

  • A port on the management VLAN and a UPS-backed power socket
  • Outbound HTTPS from the box to the Guardian portal (none if air-gapped)
  • A named IT manager, and a backup contact for out-of-hours pages
  • Least-privilege service accounts for AD / Entra and the Windows servers
  • A firewall API admin restricted to the Guardian box’s address
  • Read access to switches and Wi-Fi controllers (write where you opt in)
  • A Microsoft 365 app registration with only the scopes Guardian needs
  • Read-only access to backup job status (Guardian never restores)
  • Your list of protected devices that are never contained automatically
  • Your maintenance windows and change-freeze dates
Who does what

Clear lines. No surprises.

Responsibilities during setup and in service
TaskVantagePointClient
Supply, image and test the Guardian boxVP
Network survey and adapter selectionVP
Management VLAN port, power and UPSYOU
Service accounts and API admins (least privilege)YOU
Typing credentials into the vaultYOU
Install, enrolment and connection checksVPYOU
Observer-phase diary and baseline reportVP
Deciding permissions and protected devicesYOU
Approving Ask-level changesYOU
Backups and restoresYOU
Physical work: cabling, disk swaps, firmwareYOU
Updates, exam-tested before releaseVP
Why observe first

A month of “here’s what I’d do.”

During the observer phase the diary shows every fault Guardian found and exactly what it would have changed, with the evidence. Your manager sees its judgement on your own network before granting a single permission.

Most clients finish the phase knowing which tasks they’re happy to hand over, and which they want to keep approving.

Leaving is easy

Your record. Your network.

If you stop, we revoke every credential, export the full audit trail and diaries to you, and wipe or hand over the box. Guardian was never in your data path, so nothing goes down on the way out.

Setup FAQ

Setup questions.

How long does a Vantage Guardian setup take?

About six weeks from discovery call to go-live for a typical single-site SMB. Most of that is the deliberate four-week observer phase, where Guardian monitors only and earns trust before it changes anything.

Do we have to give Guardian domain admin?

No. Each system gets a least-privilege service account limited to the actions Guardian is allowed to take, and credentials are issued from the vault for minutes at a time, per step.

What happens if we stop using Guardian?

We revoke every credential, give you a full export of the audit trail and diaries (it's your record), and securely wipe the box or hand over the hardware if you bought it. Your network keeps running throughout, because Guardian was never in the data path.

Can our existing MSP or IT provider be the manager?

Yes. The manager role can be your in-house IT lead, your MSP, or both, with different people approving different device groups.

Start with a discovery call →