Ask the person who runs IT at a school where the firewall support contract is up to, whether the Essential Eight evidence is current, and what the monitoring is complaining about right now, and you will usually get three answers from three different systems. One of them will be a spreadsheet. The spreadsheet will be out of date.
That is not a criticism of school IT teams. It is a description of the job. A team of one or two people carries renewals, compliance, security and day to day operations at the same time, with tools that were each bought to solve one of those problems and none of which talk to each other. We built Altitudo Guardian to put those jobs in one place, and this post explains what it does and why we think it matters.
The three jobs a school IT team actually has
Strip away the ticket queue and the work falls into three parts.
Know what you have and when it is due. Licences, support contracts, warranties, subscriptions and certificates, each with a date attached. Miss one and the first anyone hears is a phone call on a Monday morning because the portal certificate expired overnight, or an invoice from the vendor to reinstate lapsed support at the penalty rate.
Stay secure and prove it. Boards and insurers now ask about the Essential Eight as a matter of routine. In most schools the controls are largely in place. The problem is that the evidence is spread across inboxes, shared drives and someone’s memory, so every audit starts from scratch.
Run it day to day. Monitoring raises alerts, the network needs changes, servers get built, the firewall gets touched. Without a record, every incident review opens with the same argument about who changed what and who said it was fine.
Guardian is organised around those three jobs rather than around a product category, and each part feeds the same view of what needs attention today.
Know what you have
Guardian keeps every licence, contract and subscription with its dates and sends reminders before anything lapses. Renewals are picked up from Xero invoices automatically, so the register stays current without anyone retyping it. Devices on the network are discovered, numbered and checked to see whether they are still answering. SSL certificates renew automatically before expiry, and the new certificate is installed only once someone approves it.
It also produces next year’s IT budget from the contracts and planned spend already in the system, with a reason attached to every line, as a Word or PDF report the business manager can take to the board.
Stay secure and prove it
Every Essential Eight and ISO 27001 control is tracked with the evidence behind it. Automated checks run against Microsoft 365, and the report is written for an auditor with the exceptions listed first, because that is the part an auditor reads.
Vulnerability scans run from inside the network on a schedule, with findings tied back to the asset they were found on. Web filtering assurance tests that the filter actually blocks what policy says it should, for each group of users, and raises a flag the moment a result changes. Change management records every change, who approved it, and when.
Run it day to day
Guardian connects to the Zabbix monitoring a school already runs and adds the layer most teams are missing: an explanation. When a problem is raised, the AI assistant reads it and tells the engineer what it means, the likely cause and the steps to fix it, in plain English rather than alert codes. The same assistant lives in the Technician desktop app, where it checks the PC in front of the engineer the way an experienced colleague would: Wi-Fi signal, IP settings, DNS, ping and recent network events.
Orchestration covers Windows server builds on VMware or Hyper-V, DHCP scopes, DNS records and Palo Alto firewall changes. Firewall migration moves another vendor’s configuration onto Palo Alto on the IronSkillet baseline.
What the AI does not do
This is the part we are most deliberate about. The AI in Guardian explains and recommends. It does not act on its own. Nothing reaches a firewall, a server build or a DHCP scope without a change that a named person has approved, and that person cannot be the one who raised it. On a PC, the assistant offers a short list of checked actions and asks before running any of them.
Schools are rightly cautious about automation touching production systems, and so are we. The result is a platform where the speed comes from the explanation and the safety comes from the approval, which is the right way around.
Hosted in Australia, built to be trusted
The platform runs in AWS Sydney and the AI runs on Australian-region services, so the data sovereignty question in a procurement pack has a one word answer. Device passwords stay on the on-site appliance rather than in the cloud, cloud tokens are encrypted, appliance updates are signed and never install automatically, and access is by invitation only with each organisation seeing only its own data.
Guardian connects to what a school already runs, Microsoft 365, Palo Alto, VMware, Hyper-V, Zabbix and Xero, rather than asking anyone to replace them.
Three packages, priced per site
Essentials covers the platform: renewals, budget reports, change management, certificates, assets, compliance reporting and email alerts. Professional adds the on-site appliance, which brings vulnerability scanning, web filtering assurance, Zabbix monitoring and the Technician app. Managed adds orchestration and firewall changes, run for the school by Altitudo engineers.
Pricing is per site rather than per user or device, so a school is not penalised for a growing fleet. We confirm pricing after a demo on your own environment, because the right package depends on what you already run.
See it on your own systems
The quickest way to judge Guardian is to see it with your own renewals, assets and monitoring rather than a sample dataset. The demo takes about forty-five minutes and there is no obligation afterwards. Book a demo, or read the full breakdown on the Altitudo Guardian service page. If you are looking at the wider picture of how we work with schools, our IT services for schools page is the place to start.
