Full scope managed security for onchain teams.
Audits cover point-in-time contract deployments. Managed Security covers the entire scope of all organization operations through time.
- Operational security
- Controls
- CI/CD
- Offchain attack surface
- Smart contract inventory
- Live risk tracking
- Monitoring & Response
Sixteen contracts live. The cloud beside them ships every week.
Needs Operational controls CI/CD verification Multisig ops Deployment ops Monitoring & Response Compromise Threat Map
Day-to-day operations secured by the Sentry platform.
Operations are not a questionnaire you answer once a year. Sentry holds them as controls: a written standard covering keys, signers, access, pipelines, infrastructure and the people running them, each one checked against evidence from the systems you actually operate.
- Key management16
- Multisig operations12
- Access & identity21
- Change control11
- Release & CI/CD14
- Infrastructure18
- Secrets handling9
- Incident readiness8
- Devices & people9
No transaction is signed before a Guardian engineer has verified what it actually does.
Evidence- Safe tx 0x7c4a…e910 · setFeeRecipient(address)
- Simulated against live state · 1 of 4 signatures so far
Calldata decoded by hand, destination matched against the change request, and the call simulated on live state before the first signature. Forty-one this month, and one sent back.
- A transaction is queued in the treasury Safe onchain · 1 of 4 signatures · verified before signing
- A deploy key was found in a repository code host · push access to 3 repos · reopens SE-2.02
- Key management16 controls Custody assumptions, key generation and storage, signer device hygiene, and access recovery that has been tested rather than assumed. The hot keys your services hold count here too, not only the ones a person holds.
- Multisig operations12 controls Every transaction queued in the Safe is verified by a Guardian engineer before a signer approves it: read back from the Safe API rather than taken from the interface in front of the signer, calldata decoded, destination and parameters matched against the change request, and the call simulated against live state. A signer gets a verdict, not a hash to trust. The signing set is held the same way, through this quarter's joiners and leavers and a recovery path that has been rehearsed.
- Access & identity21 controls Who can do what across every system, whether SSO and 2FA are actually enforced, how joiners and leavers are handled, and which accounts still work after someone leaves.
- Change control11 controls Approval thresholds, environment separation, and change windows, checked as they are actually enforced rather than as they are documented. A control nobody turned on is the one every post-mortem finds.
- Release & CI/CD14 controls Who can trigger a deploy and what it is allowed to reach: runner permissions, branch protection, artifact integrity, and the fact that the pipeline replaces the services holding your hot keys without touching a contract.
- Infrastructure18 controls Admin panels, automation servers, RPC dependencies, monitoring systems, bots, and privileged backend services.
- Secrets handling9 controls Where API keys, tokens, and private keys are stored and shared day to day, who and what can read them, and how often they are rotated in practice.
- Incident readiness8 controls Runbooks, escalation channels, emergency roles, and a rehearsal of the containment decision with the people who would have to make it.
- Devices & people9 controls Laptop and phone security for the people holding keys, disk encryption, updates, and what an attacker gets from one compromised workstation.
Cover your operational threat model, architecture weak-points, and the steps to take now.
Book your system review callSentry discovers your offchain exposure first.
Shield is Guardian's continuous coverage of everything you have facing the internet: hosts, ports, services, storage, certificates, edge rules, and the names that lead users to you. Automation finds candidates. An engineer confirms each one before it reaches you, which is the difference between a tool and a service.
- Asset discovery Subdomain enumeration, DNS sweeps, and reconnaissance across your public footprint to find the hosts you have and the ones you forgot you had.
- Exposed services and data Open ports, admin interfaces, public buckets, open directories, backups, and configuration files readable by anyone who knows the URL.
- Networks and edge TLS and certificate issuance controls, WAF and CDN rules, and whether the origin can simply be reached directly, around them.
- Names and delivery path Registrar locks and DNSSEC, dangling records, lookalike registrations, and detection when the served bundle changes.
- Verified by hand Every automated finding is reviewed by an engineer and the edge configuration is checked directly. You are not handed a scanner report, and you are not paged for one.
CNAME still points at a host deleted in March. Anyone can claim the name.
Confirmed by an engineerYour living breathing asset & threat surface map.
Sentry holds one map of everything you own and everything that can reach it: the addresses that are live, who holds owner, pauser and upgrader on each one, whether those holders are multisigs or somebody's laptop, and what the timelocks and parameters are set to this morning. It is redrawn as the estate moves, so what you are looking at is true today rather than true at the last audit.
- Privileged role map Owner, pauser, upgrader and parameter rights per contract, with the holder named. Every one that turns out to be an EOA rather than a threshold is flagged.
- Configuration against review Timelocks, thresholds, pause state, fee and risk parameters, and oracle sources, compared against the configuration your audit was actually carried out against.
- Deployment review Each new implementation, proxy change, and parameter update reviewed in the week it lands, so the gap between what was audited and what is live never quietly widens.
- Multisig management Signer set and threshold reviewed as people join and leave, signer device hygiene, transaction simulation before approval, and recovery that has been tested rather than assumed.
- Revocation discipline The deployer key, the migration role, and the temporary admin granted for a launch, each tracked until it is actually gone rather than until someone says it will be.
One asset arrived this week and one is gone. The map is redrawn as that happens, so the surface you are looking at is the one you have now.
Live risks monitored and managed by our MDR team.
Detections are cheap. Deciding which of them matters at three in the morning, and then doing something about it, is not. Guardian's managed detection and response team watches the estate around the clock: onchain state and privileged calls, the cloud and the code host, the edge and the names. What is real is confirmed by an engineer who already knows your system, and it comes to you with a decision attached rather than a notification.
Eleven minutes is the number that matters. The 1,166 signals nobody woke you for are what make eleven minutes possible.
- Around the clock Privileged calls and onchain state, the cloud and the code host, the edge and the names, watched continuously. Someone is on shift at three in the morning on a Sunday, which is when most of the incidents you have read about actually landed.
- Detections built from your estate Rules and thresholds come from your own inventory: these addresses, these roles, these signers, these hosts, this week's version of all of it. A template rule set pages you about everything and catches nothing.
- Triaged before it reaches you Every detection is read by an engineer who already knows your system and what was true about it yesterday. The noise is absorbed here. What reaches you has been confirmed, and it arrives with what it means.
- Response, not notification When something is real the team works the response with you: pause, revoke, rotate, rebuild, in the order that actually holds. You are not handed a runbook at the worst hour of your quarter and left to read it.
- A live risk register What is open right now, who owns it, what moved in the estate this week, and which changes are still waiting on a decision. One list kept current, rather than a report that starts ageing the day it is delivered.
Don't wait for compromise, lock everything down today.
It starts with an hour on your architecture: what you run, what can reach it, and where the threat surface actually sits.