Find your fit
Who it is for
An MSP consolidating security operations across clients may value a single issue view and separate customer onboarding path. It should map every client’s directory, devices, email system and region before assuming one rollout works everywhere.
A small business buying through an MSP should ask which Guardz plan and response service its provider includes, who approves disruptive actions, and who receives incident notifications.
The work it supports
Core capabilities
Set up the MSP organization in the intended region, then add clients either through an administrator connection or a 72-hour single-use invite for each customer IT administrator. Multiple regions require separate MSP accounts.
The starting footprint and dark-web scans give an early view of exposed assets and possible leaked credentials. The first footprint result can take 3 to 72 hours, so the opening dashboard should not be treated as a complete baseline.
Activate the directory, cloud-data, email and endpoint controls required for each client. Grant only the requested permissions and check that users, devices and mailboxes actually appear in the expected tenant.
Use the MSP dashboard to sort client and asset issues, then inspect a finding and its remediation steps. An issue marked In Progress may not close until a later scan verifies the change.
ITDR evaluates identity configuration and user behavior. Response capability depends on integration and permissions, so an MSP should review policy and test a controlled scenario before permitting account actions.
Ultimate and Elite include managed detection and response in the current plan cards. The MDR team can act within configured permissions; the incident screen also supports response actions and an approval-required preference.
Plan for evidence retention and exit needs early. Guardz distinguishes customer-exportable alerts and issues from raw underlying logs or telemetry that customers cannot export through Guardz.
Understand the offer
Pricing and getting started
Pro is the base tier for identity, endpoint, email, awareness and external-exposure coverage. Its plan card should be read as available scope; each control still needs the applicable setup.
Ultimate adds SentinelOne Control EDR, Check Point Advanced Email and 24/7 managed detection and response. Compare those entitlements against the client’s existing endpoint and mail licenses to avoid unclear overlap.
Elite builds on Ultimate with SentinelOne Complete EDR, Check Point Complete Email with outbound DLP and encryption, active hunting and deeper forensic investigation. Confirm response scope and service terms in the proposal.
The vendor asks MSPs to request exact pricing rather than publishing a fixed seat price. It describes per-user pricing; ask for the user count, region, endpoint flexibility, minimum commitment and any separate add-ons in the written quote.
The current help guide says both new MSPs and newly onboarded clients receive a 14-day trial with Elite access. Before the trial ends, choose a paid plan and verify what features will cease if the client moves to Pro or does not subscribe.
Subscriptions guidance says billing is monthly even when an annual selection changes the per-user rate. Confirm the contract term, true-up process and cancellation details rather than treating the invoice cadence as the commitment length.
Some features, including Syslog, Prisma Browser and certain Check Point Complete cases, may generate separate invoices. Include those line items in the quote comparison.
Look a little closer
Before you choose
Start a bounded evaluation with a noncritical tenant and an agreed permission scope. Check the first scan, one issue investigation, the response approval setting and the trial-to-plan transition before rolling out across clients.
If clients span regions, confirm the separate MSP-account setup, admin access and data residency requirements in advance. For each client, record which directory, mailbox and endpoint controls were actually activated.
Security outcomes cannot be inferred from plan names alone. Request the written coverage, MDR response rules, add-on charges, retention/export terms and client responsibilities before replacing an existing security stack.
12 distinct sources behind this profile. Research observed Oct 26, 2026. Features and offers can change.
View sources and research →
