Your network has a border. Schildmark watches it.

Detection and response for endpoints, servers, cloud accounts and firewalls, with patching and audit evidence built in. One agent on each machine. Hosted by us, or run on your own servers.

Talk to sales Read the docs

An address that keeps failing to sign in is blocked on the firewall you already run. The alert, the block and its reason stay together, so anyone can see later why it happened.Illustration

One console for the whole job

Most small security teams run five tools and copy between them. Schildmark does the five jobs in one place, on the same data.

Detect: Alerts from every endpoint, server, cloud account and network device in one console, ranked by severity.; Windows, macOS and Linux. AWS, Google Cloud, Microsoft 365. Syslog from firewalls and switches.
Respond: Block an address on the firewall or cloud you already run, straight from the alert, with the reason recorded.; Sophos Firewall, FortiGate, OPNsense, AWS WAF, Cloudflare, Azure, Google Cloud, DigitalOcean.
Patch: See the missing updates on every machine and install them on a schedule you approve.; The same agent, installed with --patching. Rollouts in waves, risks you accept on record.
Prove: Map alerts and configuration checks to the frameworks you report on, and download the evidence as one file.; A warning when log retention is shorter than your framework expects.
Ask: The analyst explains an alert in plain language and suggests the next step.; You decide what it may see: off, standard, or only providers that sign a BAA.

One agent. One command.

Monitoring and patching come from the same small agent. Every job it runs is signed by your console and checked on the machine before it starts.

# Linux; Windows (MSI) and macOS work the same way
curl -fsSL --proto '=https' -o install.sh \
  'https://soc.example.com/enroll/install.sh'
sudo bash install.sh --token '…' --patching

Signed jobs. Nothing runs on a machine unless your console signed it.
No second tool. No separate patch server or remote-execution system to expose.
Rename and remove safely. Removing a machine removes its data too.

Evidence your auditor can read

Choose the frameworks you report on. Schildmark maps what it sees to their controls and keeps the proof.

ISO 27001GDPRSOC 2HIPAAPCI DSSNIST 800-53

Controls from real data

Alerts and failing configuration checks are mapped to the controls they affect.

One evidence file

Download the evidence for a period as a ZIP, with a summary that states any gaps.

Retention checked

If your logs are kept for less time than a framework expects, the console says so.

NIS2 brings logging and incident-reporting duties to many German organisations. Ask us which of them Schildmark covers for you.

Hosted or on your own servers

The same product either way. Your data is never mixed with another customer's.

Hosted by us

Each customer gets its own stack on its own server. Nothing that holds your data is shared.

Upgrades take a backup first and roll back by themselves if the new release does not start.

Self-hosted

Run Schildmark on your own servers, on one node or two. Your data stays with you.

We provide the licence and the releases. Support access needs your approval every time.