TL;DR
One year after launch, Cayosoft Guardian Protector has grown to include 213 threat signatures covering 300+ detections, helping organizations monitor Active Directory, Entra ID, Microsoft 365, Intune, Teams, Exchange Online, and emerging non-human identity risks in real time, at no cost.
A year ago, we launched Cayosoft Guardian Protector with a simple belief: every organization should be able to see identity risk as it develops, not only after an incident or during the next scheduled assessment. Real-time threat detection and continuous monitoring should not be limited to organizations with the largest budgets, security teams, or toolsets.
Guardian Protector was created to make meaningful protection accessible. It gives organizations continuous monitoring, built-in threat detection, real-time alerts, and searchable change history at no cost, without object caps, trial expirations, or agents on domain controllers.
Built to Help Organizations See More
Microsoft environments continue to grow in size and complexity. Active Directory, Microsoft Entra ID, Microsoft 365, Intune, Teams, and Exchange Online are deeply connected, while AI agents, service principals, applications, and automated accounts add an expanding layer of nonhuman identity.
Protector brings continuous, agentless monitoring across these services and identities into one place. It shows who or what made a change, what changed, when it happened, and where it originated. Support for multi-domain, multi-forest, and multi-tenant environments gives teams a centralized view of activity and potential threats.
A Growing Threat Directory
Guardian Protector launched with 179 built-in threat signatures. One year later, the revamped library includes 213 threat signatures covering more than 300 detections. New and updated signatures are delivered automatically into the product, helping protection keep pace as identity risks evolve.
Along the way, we added detections that reflect how quickly the identity attack surface is changing. These signatures go beyond well-known indicators to identify emerging risks across human and non-human identities, cloud applications, authentication activity, certificate services, and endpoint administration. Each detection is designed to help teams recognize conditions that attackers can exploit, understand why the activity matters, and investigate before a weakness becomes an incident.
Here are a few recent additions:
- Microsoft Entra ID agent identity with no active owner
This threat signature detects a Microsoft Entra ID agent identity that has no assigned active owner. An owner whose account is disabled cannot sign in, review the agent’s permissions, validate its ongoing business purpose, or respond to an alert involving it. When every assigned owner is disabled, the agent is effectively unowned, creating a governance gap that can allow excessive permissions, stale access, or suspicious activity to persist without accountable oversight.
- Microsoft Entra ID account enumeration via unknown OAuth client IDs
This threat signature detects Microsoft Entra ID authentication requests that specify an OAuth client ID with no corresponding application registration or service principal in the tenant. Without application metadata such as a recognized name, owner, permissions, and expected sign-in behavior, defenders have less context for determining whether the request is legitimate. Attackers can use unknown or fabricated client IDs during account enumeration and other authentication probing, while detections that depend on known application identifiers or successful sign-ins may overlook the activity.
- Active Directory Certificate Services auditing not configured
This threat signature detects an Active Directory Certificate Services (AD CS) deployment where Certificate Services auditing is not configured. Without this auditing, security teams may lack the event data needed to identify certificate requests, issuance activity, configuration changes, and other actions that can support privilege escalation or persistence. Detecting the gap helps organizations restore the visibility required to investigate certificate-based attacks and validate that sensitive CA activity is being recorded.
- Microsoft Intune Multi Admin Approval access policies not configured
This threat signature detects an Intune tenant where no Multi Admin Approval access policies are configured. Without approval requirements, a single administrator may be able to perform sensitive changes without independent review, increasing the impact of a compromised account, malicious insider, or simple administrative error. The detection highlights where organizations can add separation of duties and an additional control before high-impact Intune actions are completed.
The public Cayosoft Threat Directory shares that knowledge with the broader community, explaining what each threat means, why it matters, and what administrators can do next.
Built Alongside the Community
One of the most rewarding parts of the past year has been hearing directly from the people using Guardian Protector. Our Reddit community gives Microsoft administrators, security professionals, and IT teams a place to ask questions, share experience, and influence what comes next.
Monthly Community Hours provide another direct connection with the Cayosoft team, where users can discuss emerging challenges, hear what is new, and share ideas that help keep Protector focused on real-world needs.
That community-first work also earned external recognition. Guardian Protector received a Gold Stevie® Award in the Identity & Access Security Solution category at the 2026 American Business Awards®. We are proud of the award and grateful to the community that helped make Protector more useful over the past year.
Guardian Protector was created to make meaningful protection accessible. It gives organizations continuous monitoring, built-in threat detection, real-time alerts, and searchable change history at no cost, without object caps, trial expirations, or agents on domain controllers.
Why Visibility Matters More Than Ever
Organizations now manage far more than employee accounts. Applications, service accounts, service principals, managed identities, and AI agents increasingly perform work and access critical systems on an organization’s behalf. As these non-human identities grow in number and capability, teams need to understand what is changing, who or what is driving it, and when activity deserves attention.
Continuous monitoring and real-time detection provide that awareness, helping organizations spot unexpected changes and investigate potential issues before they become larger problems.
Looking Ahead
As we enter Guardian Protector’s second year, we will keep expanding detections, growing the Threat Directory, enhancing monitoring, and listening to the community that helps guide its direction.
To everyone who joined a Reddit discussion, participated in Community Hours, shared feedback, submitted an idea, or supported Guardian Protector over the past year: thank you. Guardian Protector was built to help the Microsoft IT community, and we look forward to continuing to improve it together.
Get Started
Download Guardian Protector to begin continuous monitoring and real-time threat detection at no cost, explore the Threat Directory, and be sure to join the Reddit community.