Warden365 watches your tenant's sign-in and audit logs, explains every detection in plain English, and lets your officer acknowledge or remediate it from their phone. No agents on a single endpoint.
Sample tenant data. The simulator below writes into it as you use it.
Pick one of three Microsoft 365 attack paths and launch it. The attack is simulated — the detection logic, the MITRE mapping and the alert your officer receives are exactly what ships. Nothing here is pre-recorded.
No query language to learn, no endpoint rollout to negotiate, no data leaving your tenant.
Every detection arrives with what it means and what to do, written for a human on a Sunday morning — not a KQL snippet.
Reads Microsoft 365 audit and sign-in logs through Graph. Nothing to install, package or defend on staff machines.
Acknowledge or apply a named remediation from the phone, behind an explicit confirm. Hunting stays on the Warden365 host, by design.
Every rule carries its technique ID, so your board reporting and your auditor's framework already line up.
Runs on hardware you own, authenticated with your own Entra ID app registration. The audit buffer never leaves the tenant.
Prove the detections fire before you need them. Three real Microsoft 365 attack paths, on demand, against a test account.
That is the Warden365 side — the app registration, the poller, and your first real detections. No endpoint rollout to schedule and no forwarder to babysit. Reaching the host from a phone is separate work on your network, and how long it takes depends entirely on what you already run.
Create a read-only Entra ID app registration and point Warden365 at it. Nothing is installed on staff machines and nothing changes on your network.
READ-ONLY BY DEFAULTThe poller reads sign-in and audit logs continuously, maps every hit to a MITRE ATT&CK technique and writes it to an audit buffer on your own host.
FIRST ALERTS SAME DAYAlerts arrive on the phone in plain English with what it means and what to do. Acknowledge, or confirm a named remediation. Hunting and dossiers stay on the Warden365 host.
This step is the one that needs a route from the phone to your host — published through Entra, or over a tunnel you already run. Both routes are in the FAQ.
CONFIRM BEFORE ANY ACTIONThere is no Warden365 cloud sitting between you and your logs. The whole path lives inside your own tenant and on your own hardware — which is exactly why there is no data processing agreement to sign.
Sign-in & audit logs, read where they already live.
Audit buffer, index and dossiers — they never leave this box.
Alerts in plain English — acknowledge or remediate, behind a confirm.
All three run on the same audit buffer as the core platform — no second agent to deploy, no second console to learn, no extra licence to reconcile.
Live in the product today — not a promise.
Detection ships today. Containment is the work in progress.
Designed, not started. Shaped by what pilot tenants ask for.
The same detections a cloud SIEM gives you — without shipping your logs to someone else’s data centre, without an agent on every machine, and without a bill that scales with how noisy your tenant is.
| Warden365 | Traditional cloud SIEM | |
|---|---|---|
| Where your logs live | ✓On a host you own | Egressed to the vendor’s cloud |
| Endpoint agents | ✓None — reads Microsoft Graph | An agent or forwarder per machine |
| Who can see your data | ✓Only you — no relay in the path | Held by the vendor; DPA required |
| Pricing model | ✓By team size, not data volume | Per-GB ingested — scales with noise |
| What an alert says | ✓Plain English + MITRE technique | Query output to interpret yourself |
| Out-of-hours triage | ✓From a phone, behind a confirm | Console or on-call rota |
| Time to first detection | ✓Same day — one read-only app registration | Connectors, pipelines and tuning |
We read your Microsoft 365 setup, read-only, check 12 areas, and hand you a report that ranks every gap with the fix in plain English. Anything that could be your own doing, like a new admin, we confirm with you first, so the report never alarms you about your own changes.
Nine areas work on any Microsoft 365 plan. Those marked P1 or P2 need Entra ID P1 or P2; without it, the report says so rather than skipping them.
No VAT is currently charged. 50% on booking, 50% on delivery, in five working days. Choose Warden365 within 60 days and we credit the full fee against your first year.
The sample report is for a fictional company.
Per user, and your whole team moves to a lower rate as you grow — so scaling up never costs more per head, and you never pay more than the next band up. One licence covers the poller, the console and the mobile companion; with no agent there is nothing to install per seat, and no per-GB bill that balloons with your alert volume. Full prices are revealed at launch — ask us for a quote. Billed annually in advance, and if you start with an assessment, its fee comes off your first year.
Per user per month, GBP. No VAT is currently charged. Your whole team is billed at your current band’s rate — and never more than the next band up.
If something here is missing, ask us directly — we would rather answer it before you buy than after.
No. Warden365 reads Microsoft 365 audit and sign-in logs through Microsoft Graph. There is no endpoint agent to package, deploy, exempt from AV, or explain to your users.
Onto a host you own. The audit buffer, the index and the dossiers all stay on your hardware — there is no vendor cloud in the path and nothing to sign a data processing agreement about.
A read-only Entra ID app registration with directory audit and sign-in log scopes. Remediation runs under a separate, explicitly approved write identity — the poller itself can never change anything.
Remediation is a job for either surface — the console or the phone app. Both apply the same named actions behind a typed confirmation, a named officer and an append-only audit log, under a separate write-scoped identity. Nothing ever acts on its own, and every action carries a signature.
Hunting and dossiers are console-only, by design. The console also carries the full picture for deep work; the phone is the out-of-hours half — see it, understand it, acknowledge or fix it.
Two ways, and you pick by what you already own. If you have Entra Application Proxy or Private Access, publish Warden365 through it — your conditional access is enforced before a request ever reaches the host, and with Application Proxy there is nothing to install on the phone at all.
If you don't, any tunnel you already run works: the corporate VPN client your staff already have, Cloudflare Tunnel, or a WireGuard mesh such as Tailscale. We only need two things and don't mind how you provide them — the phone can reach the Warden365 host on its port, over TLS the phone already trusts. (Site-to-site VPN on its own won't do it: a handset on mobile data is on neither network.)
And if you have neither, nothing is lost. The phone is a convenience, not a requirement — the desktop console does everything it does and more. You would be choosing not to carry alerts in your pocket, not doing without a feature.
No, and no. There is no Warden365 relay or broker in the middle — the phone talks to your host directly across your own transport, so we never hold, proxy or see your logs. That is also why there is no data processing agreement to negotiate.
The one exception is push notification delivery, which has to travel via Apple and Google to reach a locked phone. Those messages are content-free by design: they say “open the app”, never what happened or to whom.
Run them. The attack simulator on this page is the same one that ships with the product — three real Microsoft 365 attack paths you can fire against a test account whenever you want proof.
Pick a plan or stop. If you stop, detections stop and the data stays yours — the audit buffer and any dossiers already generated are just files on your host, to keep or delete as you like.
Removing it is one host, not a fleet: stop the poller service, delete the application directory, and revoke the Entra app registration. There is nothing to clean off staff machines, because nothing was ever put there.
Most teams start with the fixed-price assessment. Trials of the full product are by arrangement, for teams with someone to run it. Tell us which below.
Read-only, fixed price, and a ranked report in five working days. If it shows you need monitoring, choose Warden365 within 60 days and the fee comes off your first year.
Pricing, procurement paperwork, and a guided demo run against your own tenant.
Setup help, detection tuning, and questions about a live incident.
Found a flaw in Warden365 itself? Tell us here. We answer every report.
You do not have to take our word for any of this — the demo on this page runs the same detections the product ships with.
RUN A LIVE SIMULATION
KempCore
product