In short: Guardz MDR is a 24/7 managed detection and response service included in the Guardz Ultimate and Elite plans. A follow-the-sun security operations team investigates SentinelOne endpoint detections and Guardz identity alerts, then isolates devices or suspends accounts according to rules you approve. It is licensed per user, monthly.
What Guardz MDR is
Managed detection and response (MDR) means a team of security analysts watches your alerts around the clock, decides which ones are real and acts on them before an attacker gets far. Guardz MDR provides that for small businesses without the cost of a dedicated security operations centre.
Guardz combines AI-driven triage with human analysts working in a follow-the-sun model, with teams in North America, Europe and Asia-Pacific. It covers two areas:
- Endpoints: detections from SentinelOne agents supplied through Guardz are investigated and, where needed, the device is isolated from the network.
- Identities: incidents raised by Guardz identity threat detection and response (ITDR), such as a compromised account or a suspicious forwarding rule, are investigated and contained.
MDR is part of the Guardz Ultimate and Elite plans, not a separate add-on for Pro.
What MDR can do on your behalf
Each response action is set either to Approved, where the MDR team carries it out once a threat is confirmed and then notifies the named contact, or to Approval Required, where they contact you first and act only after sign-off. We agree these settings with you at the start.
| Action | Where it applies | What it does |
|---|---|---|
| Isolate device | SentinelOne | Cuts the endpoint off from the network while keeping it connected to the console |
| Revoke sessions | Microsoft Entra ID | Signs the user out everywhere so any stolen session stops working |
| Reset password | Microsoft Entra ID | Forces a new password |
| Reset MFA | Microsoft Entra ID | Removes registered MFA methods so the user re-registers |
| Suspend account | Microsoft Entra ID | Blocks the account entirely |
Guardz recommends pre-approving device isolation and session, password and MFA resets, and keeping account suspension as approval-required so a key person is not locked out without a conversation. We follow that pattern unless you prefer otherwise. Revoking sessions is the newest of these actions, and in Microsoft 365 full revocation can take up to an hour to take effect.
What Elite adds to MDR
| Ultimate | Elite | |
|---|---|---|
| 24/7 MDR for endpoints and identities | Yes | Yes |
| SentinelOne edition | Control | Complete, with deep telemetry |
| Active threat hunting | No | Yes |
| Forensic deep-dive investigations | No | Yes |
Ultimate is the plan most businesses need: confirmed threats are contained at any hour. Elite adds proactive hunting for threats that have not triggered an alert, and forensic investigation when you need to know exactly what happened, for example to answer an insurer or to support a report to the ICO.
How Guardz MDR is licensed
MDR is included in the per-user licence for the Ultimate and Elite plans rather than charged separately. Each user licence covers the person and the devices they use, and SentinelOne agents are supplied through Guardz as part of the plan. If you need to protect many more devices than users, such as servers or shared machines, additional SentinelOne seats can be added.
Billing is monthly on your Forever Systems invoice and there is no minimum user count. Ask us for a quote for your user and device numbers.
Requirements
- Plan: Guardz Ultimate or Elite
- SentinelOne agents deployed on your devices through Guardz. MDR switches on automatically once the plan is active and the agents are deployed.
- Microsoft 365 or Google Workspace connected to Guardz for identity coverage. The identity response actions listed above apply to Microsoft Entra ID.
- Response preferences and a point of contact: who to notify and which actions are pre-approved
Agent health events, such as a device going offline or an agent crashing, are not sent to the MDR team, so we monitor those in the SentinelOne console as part of our service. Guardz advises against automatic isolation policies inside SentinelOne itself, because they can bypass the MDR workflow, so we leave isolation to the MDR process.
How we help
We handle the setup end to end: deploy SentinelOne, connect your tenant, agree response permissions and make sure MDR notifications reach us out of hours. When the MDR team contains something, we pick it up with you: confirm what happened, restore access for the affected user, clean or rebuild the device if needed and close the gap that let it in. You get one point of contact and one invoice. Compare other managed services in EDR, XDR and MDR.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Guardz MDR really 24/7?
Yes. Guardz runs its MDR service with analysts in North America, Europe and Asia-Pacific in a follow-the-sun model, so alerts are handled at any hour.
Does Guardz MDR need SentinelOne?
For endpoint coverage, yes. SentinelOne agents supplied through Guardz need to be deployed for MDR to activate and to isolate devices. Identity incidents detected by Guardz ITDR are also handled by the MDR team.
Will Guardz MDR lock out our staff without asking?
Only for the actions you pre-approve. Each action can be set to Approved or Approval Required. We usually pre-approve device isolation and password, MFA and session resets, and keep account suspension as approval-required.
Can I add Guardz MDR to the Pro plan?
No. MDR is only available on the Ultimate and Elite plans, so you move up a plan to get it. We can make that change at any time.