NEW CMMC Level 2: SPRS −203 to 110, the technical side done in 35 minutes Node2Shell (CVE-2026-111497): find and patch it on Windows and Linux 1,020 Windows and Linux servers patched in 13 minutes in one approved run
BlogDocumentationSupportPartnersGovernmentContact sales
Salt's speed. Ansible's ease. AI built in.

Patch, harden, and prove compliance across every server you run.

Patch, configure, and automate every Windows and Linux server, with AI built in. Find every CVE, fix it in one approved run, and hand auditors signed evidence.

Start 90-day free trial Book a 15-minute demo

Small fleet? Gardience is free for up to 10 machines ›

Defense contractor? CMMC Level 2 is built in ›

Runs on your own server, inside your network. Not a cloud service: nothing is sent to us, and we have no access to it.

Runs onAWSMicrosoft AzureGoogle CloudVMware and bare metalAir-gapped networks

Paying per node for Red Hat Ansible Automation Platform or Broadcom’s VMware Tanzu Salt?

One flat yearly price per fleet, Windows and Linux included. No per-node, per-core, or per-user fees, ever.

Switching from Ansible Automation Platform, VMware Tanzu Salt, SUSE Multi-Linux Manager, Red Hat Satellite, Puppet, or WSUS? See the end-of-support timeline.

See the math for your fleet
Ansible Automation Platform Premium, 1,000 servers (list)
$192,500 a year
Gardience Team, 1,000 servers
$15,000 a year
You keep $177,500 every year.
1,020Windows and Linux test servers on AWS patched in 13 minutes in one approved run, with a signed evidence pack. How we measured it
10,000machines in the scale test every release must pass
26fresh server setups the installer must pass every release, including CIS-hardened servers and HTTPS-inspecting proxies
1flat yearly price per fleet. No per-node, per-core, or per-user fees
CMMC Level 2 for defense contractors

From −203 to 110 on CMMC Level 2. Gardience handled the technical side in 35 minutes.

Gardience patched, hardened, and BitLocker-encrypted all 20 Windows servers that hold controlled data, set every CMMC setting, and wrote the statements for every requirement the machines can prove. Gardience gives you 14 policy templates and a checklist of the proof assessors ask for. You fit the policies to how your company works and upload your proof, and the score updates as you go.

SPRS score before
−203
Nothing recorded, machines unpatched and unencrypted.
SPRS score after
110
The highest score possible: every requirement met. Servers fixed in 35 minutes, policies and proof uploaded.
Covers all 110 requirementsEvery NIST SP 800-171 requirement in one place, with its status, its evidence, and a live SPRS score.
Fix the technical side, upload the restGardience checks and fixes the technical requirements on your machines, most in one click. For everything else, upload your records or send an upload link to whoever has them.
Review and acceptStatements drafted for every requirement the checks prove. Edit them, then accept them in one step.
Ready for your assessorSystem Security Plan, plan of action (POA&M), and a signed evidence pack from the same data.
Alerts when something slipsA requirement marked Met whose check starts failing is flagged right away.
BitLocker without lost keysDrives are encrypted only after each recovery key is in the vault and in a kit kept off the server.

Small contractors spend $70,000 to $250,000 getting ready for CMMC Level 2. Gardience is $10,000 a year.

Typical first year of CMMC Level 2 prep, small contractor
$70,000 to $250,000
Gardience Starter with CMMC, up to 250 machines
$10,000 a year

Much of that bill is consultants at $250 to $400 an hour doing the work Gardience automates: patching, hardening, encryption, CMMC settings, and the statements that prove them. The assessor’s fee is separate either way.

Ranges are published industry estimates of first-year cost; the DoD’s own estimate for the Level 2 assessment alone is about $105,000 over three years.

Starter is $6,000 a year and CMMC Level 2 adds $4,000. Both are included in the free 90-day trial. Buy Starter + CMMC ›   CMMC Level 2 software ›   Free SPRS score calculator ›   CMMC Level 2 checklist ›   How it works ›   Talk to us ›

Patch and compliance: 1,020 managed nodes, 1,020 of 1,020 patched and passing the baseline, 0 pending updates
1,020 Windows and Linux servers after one approved run: every one patched, 0 updates pending, with a signed evidence pack.
Patching and vulnerabilities

Every CVE, every server, fixed in one approved run.

  • Daily CVE matching from Microsoft, Red Hat, Debian, and Ubuntu security data
  • Installs only the fix needed, only on the machines that need it
  • Pilot ring first, a second person approves, then everything else
  • Replaces WSUS for servers, with Linux in the same view
How CVE fixing works ›
Real screenshots, 1,020 servers

1,000 Linux and 20 Windows servers, one console, one approved run.

An operator asked for the patch, a second person approved it, and every server was patched, rebooted, and hardened. Run on AWS on October 26, 2026, with the evidence pack to prove it.

Windows Server and Amazon Linux servers in one list, all up to date and passing
Windows and Linux in one list, every server up to date.
Vulnerabilities: 1,020 of 1,020 machines checked against each vendor's security data
Before the run: all 1,020 checked against each vendor's security data, every CVE with a fix listed.
Workflows and approvals: pilot ring, a second person approves, then the broad ring
Pilot ring first, a second person approves, then everything else. Nobody approves their own change.
Automation you already have

Ansible, Terraform, and AI agents, under one approval and one audit log.

Keep the playbooks and infrastructure code your team already wrote. Gardience runs them across Windows and Linux and records every change.

Ansible playbooks

Run existing playbooks over Salt, on Windows without WinRM.

# your playbook, unchanged - hosts: windows_web tasks: - name: IIS installed ansible.windows.win_feature: name: Web-Server state: present
Ansible in Gardience ›

Terraform provider

New machines enroll and configure themselves on first boot.

resource "gardience_enrollment" "web" { label = "web tier" groups = ["web", "pci"] hours = 2 } # user_data joins the fleet at boot
Terraform in Gardience ›

AI agents over MCP

Agents find exposure and draft fixes. A person approves before anything runs.

// Claude, Copilot, or your own agent { "tool": "vulnerabilities", "cve": "CVE-2026-111497" } → exposed servers listed, fix drafted → waiting for approval (2 people)
AI and MCP in Gardience ›
AI with guardrails

Ask about your fleet. Approve the fix. Done.

  • Bring your own model: Anthropic, OpenAI, or one hosted inside your network
  • Agents act only on the machines their key is scoped to
  • Nothing runs without a human approval, and every step is audited
See the AI features ›
Ask Gardience writing a Salt state from a plain-English request
Say what you want in plain words. Ask Gardience writes it, shows exactly what will run, and waits for you.
Security and compliance

Built for environments that have to prove control.

STIG and CMMC-aware hardening, two-person approval, and evidence assessors can verify on their own.

Signed evidence packsPer-machine results of every approved run, verifiable offline.
Tamper-evident auditEvery action chained and signed. A gap or edit is detected.
Two-person approvalChange windows, approvals, and team scopes on every run.
Air-gapped installOffline bundle with prebuilt images. No internet needed.
Single sign-onSAML and OIDC with role mapping from your identity provider.
Standby failoverA second server takes over. Agents follow on their own.
Signed releases and SBOMEvery release signed, every image with a software bill of materials.
Outside pen-test readySecurity tests run on every release. Details
Pricing

One flat price per fleet. Windows and Linux cost the same.

Free

$0
Up to 10 machines, no end date. Patching, CVEs, hardening, Ansible, and AI.
Get the free license

Starter

$6,000 / year
Up to 250 machines. Everything, with support.
Start a trial

Team

$15,000 / year
Up to 1,000 machines. Everything, with support.
Start a trial

Enterprise

from $40,000
Over 1,000 machines. Government buys any plan at the same price.
Talk to sales
Talk to us

Tell us about your fleet.

Two or three lines is enough. A person will reply and set up a short call to size it.

Running in 5 minutes on your own server. Free for 90 days.

Start free trialRequest a demo