01
What the product does
The exact data available depends on the selected connector, source licence and customer asset scope.
Guardian assurance product
Turn vulnerability data into prioritised remediation and reviewed closure.
Guardian Vulnerability Management connects supported asset and vulnerability sources to one customer-readable posture, remediation queue, evidence trail and resolution-review process.
Australian data residency
Guardian for Australian customers is built, operated and hosted in Australia. All Guardian customer and platform data, including backups and recovery copies, is maintained and stored within Australia.
Connector-neutral source modelAsset and vulnerability posturePrioritised remediationEvidence and resolution review
Buyer decision summary
Know what Guardian Vulnerability Management does, what the customer sees and what Damocles is responsible for before activation.
Guardian retains supported source identifiers, observation dates, affected scope, remediation status, action history and approved evidence. Customer views do not expose credentials, raw upstream payloads or unrelated tenant data.
The commercial schedule identifies the licensed source, covered assets or seats, assessment scope, synchronisation, retention, customer users, provider relationship and any managed remediation activity. Connector licensing and Damocles service are separate inputs even when sold as one solution.
Guardian does not imply universal asset discovery, complete vulnerability coverage, unlimited scanning, guaranteed remediation or automatic acceptance of a source-reported resolution.
02
What the customer sees
Leadership, IT teams and providers receive different depth while using the same underlying records.
03
What Damocles manages
Platform-only delivery and managed remediation support remain separate commercial responsibilities.
The operational problem
Vulnerability programs fail when teams measure scanner volume instead of whether material exposure is being removed.
Customers can have thousands of findings without a clear answer on which assets are exposed, which vulnerabilities can be exploited, who owns the change, or whether a reported resolution reflects a real fix. Different tools also use different severity, asset, status and exception models.
Guardian normalises the supported source information into a consistent customer workflow. The source technology remains responsible for discovery and assessment; Guardian is responsible for customer scope, prioritisation, ownership, remediation state, evidence and reporting.
01
Focus on material exposure
Use severity, affected assets, internet exposure, business criticality, known exploitation context and remediation dependency to identify the work that matters first.
02
Make ownership visible
Give each required change an accountable owner, due date, status, expected outcome and source drilldown.
03
Review the result
Use source state, patch state, rescans, configuration evidence or approved exceptions before accepting closure.
Product capability
A complete vulnerability-remediation operating layer above supported assessment sources.
The exact data available depends on the selected connector, source licence and customer asset scope.
AI
Asset inventory and ownership
Map supported devices, servers, workloads and groups to the correct customer, business role and remediation owner.
VP
Vulnerability posture
Present severity, affected scope, first and last observation, current status and source context in a consistent model.
PR
Prioritisation
Combine technical severity with exposure, criticality, exploit context, age and customer policy to focus remediation.
EX
Exception and acceptance
Record approved exceptions, compensating controls, review dates, evidence and decision ownership.
RM
Remediation workflow
Create actions for patching, upgrading, configuration, isolation, removal or another approved treatment.
RV
Resolution review
Distinguish no-longer-observed, fixed, restart-required, exception, accepted and evidence-review states where supported.
What the customer sees
Customers see the remediation program, not an unexplained export from a scanner.
Leadership, IT teams and providers receive different depth while using the same underlying records.
EX
Executive posture
Material vulnerability exposure, overdue remediation, affected critical assets and movement over the selected period.
IT
Technical work queue
Affected assets, source evidence, recommended treatment, owners, due dates and linked actions.
PG
Patch and restart state
Where supported, identify available patches, installed state, required restart, failure and exception conditions.
PV
Provider view
Authorised customer posture and remediation without exposing other tenants or unrelated upstream data.
TR
Trend and lifecycle
Measured open, new, resolved, returned and accepted states using real retained history.
RP
Assurance reporting
Customer-readable summaries linked to the asset, finding, action, evidence and source record.
What Damocles manages
Damocles can operate the integration, quality and remediation process according to the selected service schedule.
Platform-only delivery and managed remediation support remain separate commercial responsibilities.
CN
Connector onboarding
Configure authentication, customer mapping, asset scope, synchronisation, source-health checks and safe field translation.
DQ
Data-quality review
Review duplicate assets, stale records, missing ownership, inconsistent severity and unsupported fields.
PR
Prioritisation workshops
Help the customer define risk-based queues, target timelines, exception rules and escalation thresholds.
MR
Managed remediation coordination
Track assigned work, chase overdue actions, coordinate evidence and escalate blocked remediation where contracted.
VR
Verification support
Review rescans, patch state, configuration evidence and source changes to support closure decisions.
SR
Service reporting
Provide agreed vulnerability, remediation, exception and service-health reporting through Guardian.
Operating lifecycle
From connected source to reviewed remediation outcome.
The source continues to perform the technical assessment while Guardian manages the customer lifecycle around it.
01
Connect
Authorise the source, customer scope, asset mapping and synchronisation method.
02
Normalise
Convert supported assets and findings into consistent customer records and source-health state.
03
Prioritise
Apply severity, exposure, asset criticality, age, exploit context and customer policy.
04
Assign
Create the remediation action, owner, due date, treatment and evidence requirement.
05
Remediate
Patch, upgrade, reconfigure, remove, isolate or apply the approved compensating control.
06
Verify and report
Review source state and evidence, then record closure, residual risk, exception or further work.
Common use cases
Common vulnerability-management use cases.
The product can be used with different supported source technologies and customer operating models.
SB
Small-business remediation
Give a small IT team one prioritised queue instead of a large vendor report that lacks local ownership.
MS
MSP customer operations
Manage authorised customer vulnerability posture, actions and reporting through a provider-scoped Guardian workflow.
EN
Enterprise consolidation
Normalise supported sources or business units into one executive and remediation model while retaining source traceability.
PA
Patch assurance
Connect vulnerability findings to endpoint patch state, restart conditions, failures and exception follow-up where supported.
EX
Exception governance
Record compensating controls, expiry dates, evidence and owner review for vulnerabilities that cannot be immediately removed.
AU
Audit and board reporting
Show material exposure, remediation progress, overdue work and evidence without claiming unsupported compliance outcomes.
Operating model
How Guardian Vulnerability Management is onboarded, integrated, evidenced and scoped commercially.
These details remain explicit before activation, but are grouped into one operating view so buyers can review the responsibilities without working through four separate page sections.
ON
Onboarding and implementation
Implementation begins with asset authority, source capability and the customer remediation model. Damocles confirms the customer relationship, asset ownership, supported source, authentication method, synchronisation schedule, retention, required fields and source-health checks. Sample records are reviewed before broader import so customer and provider scope can be validated. The customer defines asset groups, criticality, owners, remediation timelines, exception authority and evidence requirements. Existing service-management or patching workflows are mapped so Guardian actions complement the customer process rather than create a competing queue. Go-live includes a baseline review, duplicate and stale-asset checks, priority validation, user access, reporting and a documented process for source failure, unsupported records and later connector changes.
IN
Connector and integration model
The public product remains stable even when the selected vulnerability connector changes. A supported connector must provide authenticated access, explicit customer mapping, stable source identifiers, asset and finding fields, synchronisation state and safe error handling. Guardian stores the source reference needed for traceability while presenting a consistent customer model. The selected connector may be a commercial platform, a self-hosted assessment source, a patch-management source or another approved system. The proposal names the implementation and supported fields; the public website describes the product outcome without making one vendor mandatory. New connector requests are assessed for tenant isolation, API support, data ownership, rate limits, field quality, source health, retention, supportability and commercial impact before being represented as available.
EV
Data, evidence and reporting
Every reported result should be traceable to a source, asset, action and review decision. Guardian retains supported source identifiers, observation dates, affected scope, remediation status, action history and approved evidence. Customer views do not expose credentials, raw upstream payloads or unrelated tenant data. Reports distinguish measured vulnerability state from interpretation. Trend is shown only where retained records support it, and a source that stops reporting is not silently represented as proof that the issue was fixed. Where evidence is attached or referenced, access remains customer and role scoped. Superseded findings, exceptions and closure decisions retain an auditable history according to the approved workflow.
CM
Commercial unit and responsibilities
Pricing and entitlement follow the measurable asset, seat, target or service unit defined in the proposal. The commercial schedule identifies the licensed source, covered assets or seats, assessment scope, synchronisation, retention, customer users, provider relationship and any managed remediation activity. Connector licensing and Damocles service are separate inputs even when sold as one solution. Guardian Core does not automatically include a commercial vulnerability licence or unlimited assets. Guardian Assurance provides the vulnerability and remediation operating model; the source technology and quantities remain explicit product components. The customer owns timely access, asset context, remediation decisions and approved change. Damocles owns the connector and managed activities listed in the service schedule. Unsupported systems, remediation engineering and emergency response remain separate unless included.
Frequently asked questions
Questions buyers ask about Guardian Vulnerability Management.
The exact answer is confirmed in the proposal and package schedule, but these points should be understood before activation.
Q1
Can Guardian use our existing vulnerability platform?
Yes where a supported connector exists and the customer can provide authorised access, stable asset ownership and the required source fields.
Q2
Can multiple sources be combined?
Potentially. Each source must retain traceability and customer ownership, and duplicate or conflicting records need an agreed reconciliation model.
Q3
Does Guardian perform the vulnerability scan?
The selected assessment source performs technical discovery and testing. Guardian manages the customer posture, remediation, evidence and reporting around supported results.
Q4
Can Damocles fix the vulnerabilities?
Managed patching and remediation coordination may be included through selected products. Broader engineering and application remediation are separately scoped.
Q5
How are exceptions handled?
Approved exceptions record the owner, rationale, compensating control, evidence, expiry and review date rather than simply hiding the finding.
Q6
What happens when a connector fails?
Guardian shows the source-health or unavailable state. Missing data is not converted into a zero-risk result.
Scope and boundaries
Coverage follows the selected connector, licence, customer asset scope and approved remediation process.
Guardian does not imply universal asset discovery, complete vulnerability coverage, unlimited scanning, guaranteed remediation or automatic acceptance of a source-reported resolution.
Unsupported fields, inaccessible assets, stale agents, source outages and records without confirmed customer ownership remain visible as limitations or are excluded according to the approved policy.
Penetration testing, secure code review, cloud review and specialist engineering remain separate where deeper validation or implementation work is required.
Take the next practical step
Review the source data, asset ownership and remediation backlog that are not producing reliable closure.
We will map the current assessment technology, connector requirements, covered assets, prioritisation, actions, evidence and managed responsibilities.