Unified security for MSPs
Test your EDR in minutes
Test one layer of your security with 9 safe attack simulations. See exactly what your EDR blocks, and misses.
*Desktop only. Complete the form
and we’ll email you the simulation link.
- 100% free
- No account required
- Safe to run on your endpoint
Trusted by Leading Partners
Elli Shlomo
Head of Security Research
“We built this test so MSPs can see precisely where their EDR falls short, from missed detections to response gaps, measured against real-world attacks”.
Three easy steps
Run the simulation
Install
Run the simulation
Install the tool on a Windows endpoint
with your EDR currently enabled and active.
No configuration or account required.
See how your EDR responds
Scan
See how your EDR responds
Click “Run Full Scan.” All 9 attack simulations execute automatically in sequence, completing
in under 5 minutes.
Review what was missed
Verdict
Review what was missed
Get a clear report of which techniques
were detected and which were missed.
Use it in your next client conversation or QBR.
One platform.
Every signal connected.
See how MSPs using Guardz achieve measurable outcomes.
Mimic Real-world attacks
Cloud ITDR
Identity Threat Detection & Response (ITDR) proactively verifies MFA and security settings, while actively benchmarking and analyzing user behavior to flag suspicious activity.
Endpoint Security
Stop malware, ransomware, and advanced threats at the source. AI-native EDR (with SentinelOne embedded) and Managed AV (with Windows Defender) ensure real-time protection across devices.
Email Security
Block sophisticated phishing and email-based attacks before they reach users with an API-based and AI-native engine to prevent credential theft, ransomware, and impersonation threats in real time.
Cloud Data Protection
Lock down sensitive business data with seamless cloud protection, without the need for complex policies, ensuring secure file collaboration while preventing unauthorized access and data leaks.
Security Awareness Training
Transform employees into a strong line of defense against cyber threats with pre-scheduled security awareness training that alters behavior and limits human-driven cyber risks before they escalate.
Phishing Simulation
Identify security weaknesses before attackers do by using generative AI and branded templates to automate phishing simulations to measure employee resilience and reinforce cybersecurity awareness.
Secure Browsing
Web security through a browser extension that escalates risk around employees exposed to malicious sites, web redirects, unsafe extensions, and more during their day-to-day internet activity.
External Footprint
Scan the digital footprint of businesses to discover exposures and eliminate vulnerabilities across domains, IPs, and cloud assets; closing security gaps before they’re exploited.
Dark Web
Knowledge of the dark corners of the internet can be exposed by scraping, analyzing and continuously monitoring the dark web for malicious activity targeting businesses and user credentials.
SAM Dump
Attempts to extract credential hashes from the local SAM database.
RDP Enable
Modifies registry to quietly enable Remote Desktop Protocol access.
AMSI Bypass
Attempts to patch the Anti-Malware Scan Interface in memory.
LSASS Access
Requests suspicious access rights to the LSASS process memory.
Reverse Shell
Establishes an outbound connection to simulate C2 communication.
Scheduled Task
Creates a persistent task designed to evade standard detection.
Base64 Execution
Executes an obfuscated PowerShell payload directly in memory.
LOLBin Proxy
AD Recon
FAQ
Yes. Every simulation is engineered to trigger EDR detections while remaining completely benign:
- No malware is deployed
- No data is exfiltrated
- No system changes persist after the scan
Any EDR running on Windows endpoints, including SentinelOne. Common use cases:
- Validate coverage before onboarding a new client
- Verify detection after EDR configuration changes
- Guardz Ultimate customers can use it to confirm MDR coverage is active
Yes, and this is the primary use case. Run it on a client or prospect’s endpoint to show exactly which techniques their current stack misses. Typical scenarios:
- Pre-sales: demonstrate what legacy AV misses vs. EDR
- Onboarding: verify the client’s endpoint is fully protected before going live
- QBR: show concrete detection data, not just status dashboards
Legacy AV detects known malware by signature. EDR detects attack techniques by behavior. Three techniques this tool runs are consistently missed by AV and caught by properly configured EDR:
- AMSI Bypass — disables PowerShell-level defenses before script execution
- LOLBin Proxy — abuses legitimate Windows tools to evade allowlists
- Base64 Execution — runs obfuscated payloads in memory with no file on disk
Ready to test your defenses?
- Download now and validate your EDR protection in minutes.
