One device. One price.
Complete protection.
No per-seat licensing. No cloud subscription required. No surprise fees. Hardware-enforced security at a fixed cost.
Pre-configured hardware with one year of firmware updates included.
Continued firmware updates and detection engine improvements after your first year.
Your DEC-1 continues to function without a subscription. Updates are optional but recommended to stay current with new detection capabilities.
Multi-device deployments with centralized monitoring and priority support.
The cost of not having VaultGuardian
Change Healthcare
Total breach cost
MGM Resorts
Operational disruption
Caesars
Ransom paid for data alone
VaultGuardian DEC-1: $349.
Frequently asked questions
What happens if my subscription lapses?
Your DEC-1 continues to function at full capability. You just won't receive firmware updates or new detection rules until you renew. We don't brick your hardware.
Can I configure custom thresholds?
Yes. The web dashboard lets you adjust all detection thresholds, switch between detection modes (STANDARD/STRICT/VAULT), and toggle action modes (LIVE/AUDIT/TEST). Start with AUDIT to baseline your traffic, then go live.
Does VaultGuardian phone home?
No. Zero cloud dependency. The device operates entirely on your local network. No telemetry, no cloud analysis, no external connections. Your data stays yours.
What if VaultGuardian triggers a false positive?
That's what AUDIT mode is for. Run it for a week to understand your normal traffic patterns and set thresholds above your peak legitimate upload speed. The 5-rule engine with adjustable thresholds makes false positives configurable to near-zero.
Can VaultGuardian protect against encryption attacks?
Not directly — encryption happens on disk, not on the network. But because attackers exfiltrate before they encrypt, VaultGuardian catches the breach during the exfiltration phase and alerts your team, giving you time to prevent the encryption step. For encryption protection, pair VaultGuardian with immutable snapshots (ZFS, btrfs, WORM).
How hard is it to set up?
Plug the WAN port into your router. Plug the LAN port into your backup server. Connect to the management interface. Set your server's MAC address. Set your thresholds. Done.