Pass Cyber EssentialsKnow the rocks
before you reach them

Connect your Microsoft 365 tenant. guardstate finds every failing control on every device, fixes what it can on its own, works with you on the rest, verifies each fix on the device and writes the evidence an assessor can trust.Windows, macOS, iOS and Android, alongside your Microsoft 365 tenant.

See guardstate in action

An example company with 42 Windows devices and one Microsoft 365 tenant. Follow one problem from the moment it's found, through the fix you approve, to the evidence at the end.

The light changes when the fix lands.Five screens, from the first finding to the evidence.

Find
Your tenant and every device, checked against Cyber Essentials v3.3
Fix
Each fix comes from a fixed list built into the agent and signed at release
Verify
The device is checked again after the change, and that result is what gets recorded
Evidence
Every check and fix is kept as evidence, ready whenever the assessor asks
  1. What an assessor would find today. Five control themes, 42 Windows devices, one Microsoft 365 tenant. Four themes are met. One is slipping, and guardstate already knows which devices would fail if an assessor checked them.
  2. Find the two that would fail. Two laptops are missing critical updates. Those must be installed within 14 days, and these are on day 11. Day 15 is an automatic fail. The other 40 devices are up to date.
  3. Fix, once you have approved it. guardstate suggests a fix from a fixed list built into the agent and signed at release. Nothing runs on the device until you approve it.
  4. Check the device, then record the evidence. guardstate checks the device again after the change and records what it finds. The entry is added to your tenant’s own evidence chain.
  5. The evidence is already there. All five themes met, the next check already scheduled, and the evidence collected without anyone pulling it together by hand. It keeps running on its own; there is no report to ask for.

Why not just the tools you already have?

A dashboard that tells you

It reads your tenant and hands back a score and a list. You still do the fixing, you still chase the stragglers, and you still assemble the proof by hand before the assessor arrives.

A patch or RMM tool that does the work

It keeps devices updated, and does that well. But it can't show that a control was met on a given device on a given date, so it leaves you with no Cyber Essentials evidence.

Intune alone

No proof that updates went on within 14 days, no patching for the third-party apps that fail most assessments, and no sight of devices that were never enrolled.

guardstate works alongside Intune and imports from it. It doesn't replace or take over anything you already run.

What you run today.

  • A patch tool£0 to £3
  • Application control£4 to £8
  • A compliance agentabout £3 to £4
  • A retainer, or a spreadsheet£6 to £12

Most firms run two or three of these. At 25 devices that is typically £8 to £15 a device a month; all four together come to £13 to £27.

Figures are representative of the UK market in Q3 2026.

One agent and one bill.

Four things to buy, four things to keep working, four renewals, and the evidence still assembled by hand the week before the audit.

What it costs.

Pricing

Core

£4.00per device per month

£3.00 from device 51 £100.00 a month minimum

See where every device and your tenant stand, decide what to fix, and keep the evidence.

  • Every Windows device and your Microsoft 365 tenant checked against Cyber Essentials Plus v3.3, as often as you choose
  • Finds the devices nobody enrolled
  • Evidence stored securely per device per control
  • Remediation guidance for anything you would rather do yourself
  • Triage and approvals, so nothing changes without your say-so

Remediation add-on

£2.00per device per month

£1.50 from device 51 On top of Core, for every device

The fixes applied for you, once you have approved them.

  • Fixes applied from a signed, fixed list, each one checked on the device afterwards
  • Enabled for the whole tenant in one step
  • Anything still needing a human decision waits in triage for your approval

Annual billing is 20% less than monthly. Nothing is charged per fix or per check. Seven days free, no card. Not included: the certificate, the Plus audit, insurance. Windows, macOS, iOS and Android, alongside your Microsoft 365 tenant.

The rules, in brief.

Cyber Essentials v3.3 covers more than most people expect, and Plus tests it on a sample of your own devices. Five control themes, and five rules that catch companies out. NCSC, scheme overview

  • Firewalls
  • Secure configuration
  • Security update management
  • User access control
  • Malware protection
Every device is in scopeIf it connects to the internet it counts, and cloud services cannot be excluded from the assessment.
Missing MFA fails outrightA single cloud service without multi-factor authentication is an automatic fail, whatever else is in order. IASME
Fourteen days to patchUpdates marked critical or high severity must be applied within 14 days of release, on every device. Day 15 is a fail. IASME
The answers freeze when testing startsOnce the Plus testing begins, the self-assessment cannot be changed. Whatever it says on that morning is what you are tested against, and a correction afterwards is a new submission. IASME
The devices nobody enrolledThe largest single cause of failure is the 5 to 15% of devices that were never enrolled, and so were never looked at until the assessor picked one. a certification body's account
The same lighthouse in bright morning light, on a green headland above a calm sea

Passed, and still passing.

Pass the Plus assessment, and keep the evidence up to date without checking every device yourself.

A demo, and a 7-day trial.

Tell us what you run and what you need. Your message becomes one email to enquiries@guardstate.co and is not stored anywhere else.

Who we reply to
Your company
Your enquiry

Optional. A rough window is plenty.