Tool profile
Guardsix: cost, fit and limits
Guardsix is a European security platform made by Guardsix A/S of Copenhagen, which appears to be the rebranded Logpoint, and its Guardsix SOAR is the on-premises response layer of its SIEM, running playbooks against alerts from SIEM and network detection tools.
What to know first
Guardsix SOAR automates investigation and response steps such as host isolation, credential reset, process termination and forensic capture, while analysts keep the decisions. The page states self-hosted, on-premises deployment that can be fully air-gapped, with playbooks running locally. It describes no AI features, prices or certifications, and links to separate pages on integrations and pricing predictability. Check the pricing predictability page directly for terms.
Guardsix at a glance
| Maker | Guardsix A/S, Denmark |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI SOAR Platforms in 2026, rank 5 of 10 |
| Website | guardsix.com |
Who Guardsix is best for
Sovereignty-minded European SOCs
The vendor promises your data, your deployment and your jurisdiction, with a Danish legal entity and an on-premises option that needs no cloud service.
Critical infrastructure and OT operators
Air-gapped operation and integrations that the page says span EDR, identity, cloud and OT suit sites where internet access from the SOC is restricted.
Teams already using Guardsix SIEM
SOAR receives alerts from the SIEM and from network detection with context attached, so the response layer needs little extra plumbing.
Guardsix plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Guardsix SOAR | Not described | Automated investigation and response workflows, run on your own infrastructure, as the response layer of the SIEM. |
| Additional integrations | Not described | The page says SOAR can expand with hundreds of additional integrations across EDR, identity, cloud and OT, without giving a number or price. |
| Pricing predictability | Linked page not read | The site promises a break from ingestion-based pricing and links a sizing calculator for the SIEM, but states no figures on the SOAR page. |
Checked November 2026.
What Guardsix does
- Containment actions
- Playbooks cover host isolation, credential reset, process termination and forensic capture, and coordinate steps across tools so analysts do not hand off by hand. Steps run in sequence.
- Contextual alerts
- Alerts from SIEM and network detection arrive with context attached, and automation handles enrichment and repetitive tool handoffs. Analysts then start from a prepared case file instead of raw alerts, which saves the first lookups on each ticket.
- Local playbook execution
- Playbooks run on your own infrastructure with proven response steps, and the vendor says it maintains the integrations. A customer does not have to rebuild a connector when a third-party API changes, according to the page.
- Air-gapped deployment
- The environment can be self-hosted and fully air-gapped, with no cloud infrastructure in the response path. Sites that cannot reach the internet from the SOC can still run response automation inside their own network boundary.
- Audit trail
- The audit trail is mapped to NIS2 Article 21, DORA, the CAF and sector frameworks, which is alignment, not certification. Compliance teams can reuse it as evidence of control.
How Guardsix handles your data
The SOAR page states the platform is self-hosted and on-premises, can be fully air-gapped and keeps no cloud infrastructure in the response path, so data stays where the customer deploys it. The privacy policy covers the website only: it names Guardsix A/S in Copenhagen, says processors operate within the EU and EEA or in countries with sufficient protection, and gives no retention periods. No certification and no AI statement appears on the pages read, so the vendor's policy was not checked for AI data use.
Where Guardsix falls short in practice
- No AI described. The SOAR page mentions guided playbooks but no AI or machine learning, so buyers looking for agentic triage must look elsewhere or ask for a roadmap.
- Opaque pricing and certifications. The page names no certification and gives no pricing figures, so a procurement review will need documents from the vendor. Ask for a compliance pack.
- Rebrand context. The site does not state the link to Logpoint directly. Image paths and the status page suggest a rebrand, so ask the vendor to confirm contracts, support terms and old documentation.
Works with
Alternatives to Guardsix
Guardsix: common questions
Is Guardsix the same company as Logpoint?
The Guardsix site does not say so directly, but its image paths mention a Logpoint rebrand and its status page points to a Logpoint address. Confirm the relationship with the vendor before relying on old Logpoint documents. Ask for written confirmation of contract entities.
Can Guardsix SOAR run without internet access?
Yes. The SOAR page says deployment is self-hosted and on-premises and can be fully air-gapped, with no cloud infrastructure in the response path. Connectors to third-party tools still need network paths you permit. Run a connector test before you commit.
What actions can Guardsix SOAR take automatically?
The page lists containment steps such as host isolation, credential reset, process termination and forensic capture, plus coordination across tools. It says analysts keep the decisions, so ask which actions can run without approval. Agree the approval list during the pilot.
Does Guardsix SOAR use AI?
The page does not mention AI or machine learning. It describes guided playbooks and decisions without saying whether any model is involved, so ask the vendor directly if AI triage is a requirement. Its roadmap may differ from the current product page.
Where is Guardsix based?
The privacy policy names Guardsix A/S at Valkendorfsgade 13A, Copenhagen, Denmark, with company registration DK-26301939. Data location for a deployment depends on where the customer installs the software. Ask for hosting details separately if you use any cloud-based parts of the product, such as support portals or documentation tools.