Gardience - 2026 Pricing, Features, Reviews & Alternatives

Gardience is an on-premises server management console built on open-source Salt, covering patch management, configuration hardening, compliance tracking, and automation across mixed Windows and Linux fleets. It runs entirely on the customer's own infrastructure with no data transmitted to the vendor, supporting AWS, Microsoft Azure, Google Cloud, VMware, bare metal, and fully air-gapped networks. Supported OS coverage spans Windows Server 2016 through 2025, Windows 10 and 11, and major Linux distributions including Red Hat, Debian, and Ubuntu.

Gardience addresses the full CMMC Level 2 requirement set by tracking all 110 NIST SP 800-171 controls with live status, evidence, and a calculated SPRS score. Machine-level checks cover 51 of those 110 requirements, with most failing settings remediable in a single click. The platform generates System Security Plans, POA&M documents, and signed, offline-verifiable evidence packs, replacing consulting engagements typically priced between $70,000 and $250,000 for small defense contractors. Daily CVE matching pulls from Microsoft, Red Hat, Debian, and Ubuntu security feeds, applying only the required fix to affected machines. Patch deployment uses configurable pilot and broad rings with two-person approval and defined change windows. STIG/CIS-aligned hardening baselines include scored drift detection and automated repair. BitLocker encryption is supported with recovery keys vaulted before encryption runs. Existing Ansible playbooks and Terraform code execute unchanged, and a Terraform provider handles auto-enrollment on first boot.

Gardience enforces two-person approval on every change with no self-approval permitted, backed by a tamper-evident, chained audit log and signed releases with a software bill of materials (SBOM) per release. AI agents connect via the Model Context Protocol (MCP) and support bring-your-own models from Anthropic, OpenAI, or a model hosted inside the customer's network. A plain-English interface generates Salt states from natural-language requests, displays exactly what will run, and requires human approval before any execution. Agents are scoped strictly to authorized machines. Additional capabilities include SAML and OIDC single sign-on with role mapping, event-driven automation via Salt beacons and reactors, standby failover with automatic agent follow, and a flat annual per-fleet pricing model with a no-expiry free tier for up to 10 machines.