SECURITY ATLAS / EVALUATION BRIEF Guardian Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/nozomi-guardian/ THE ATLAS TAKE Guardian is attractive for teams needing local OT/IoT visibility and an investigation surface at the site. Its documented asset and network views establish the basic proposition; Time machine adds a useful differentiator for evaluating change over time. Atlas would make snapshot retention and comparison evidence part of the purchase discussion, rather than assuming historical context exists because the live inventory looks detailed. Guardian should also be scoped independently from Vantage, host sensors and subscriptions. A locally useful investigation and a centrally managed multisite program are related but different requirements. SCOPE This profile covers Guardian and its local analyst functions. Vantage cloud management, Central Management Console, Arc host sensors, Threat Intelligence and Asset Intelligence subscriptions must be scoped separately. WORTH A LOOK WHEN Site teams needing local industrial asset investigation and reviewable historical changes. THINK TWICE WHEN The requirement assumes every cloud-management, host-sensor or intelligence capability is included with Guardian. IMPLEMENTATION 1. Validate observation points Map site traffic to the proposed sensor and confirm which equipment fields can be established passively. 2. Set a useful history policy Choose snapshot cadence and capacity based on the site investigation window, not just default settings. 3. Assign inventory review Give engineers a method to correct or qualify device identities and explain planned changes to analysts. OPERATING REALITY Operators must maintain sensor health, collection coverage and enough snapshot capacity for the investigation window. Asset owners should adjudicate discovered identities and unusual activity. Historical comparison is only useful when the relevant snapshots and fields were preserved, so retention and storage health belong in the routine operations checklist. COMMERCIAL CONSIDERATIONS Request a Guardian-specific quote covering sensor deployment, support and selected subscriptions. Separately identify central management, Vantage and Arc requirements. - Sensor form factor and site coverage - Snapshot storage and retained investigation history - Central management and intelligence subscriptions EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Compare known assets with the local inventory Acceptance evidence: Retain field accuracy and unresolved devices. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Capture a safe configuration change between snapshots Acceptance evidence: Document the diff and its supporting state evidence. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Remove a test observation path Acceptance evidence: Verify sensor-health visibility and the resulting coverage gap. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which sensors, subscriptions and central-management options are included? - What snapshot schedule and storage capacity preserve the required investigation window? - Which device details require approved Smart Polling instead of passive observation? EVIDENCE GAPS - Atlas has not independently measured inventory accuracy or anomaly efficacy. - Confirm snapshot resource limits and fields for the purchased release. SOURCES Guardian overview (Documentation) https://technicaldocs.nozominetworks.com/guardian/latest/products/guardian/topics/intro/c_guardian.html Guardian user guide (Documentation) https://technicaldocs.nozominetworks.com/guardian/latest/products/n2os/topics/sensors/c_n2os_sensors.html Guardian Time machine snapshots (Documentation) https://technicaldocs.nozominetworks.com/guardian/latest/products/n2os/topics/time-machine/c_n2os_time-machine.html Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.